Analysis
-
max time kernel
127s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
07-06-2024 17:13
General
-
Target
VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe
-
Size
392KB
-
MD5
6653ef20d2a3a6ef656d9c886ebabd93
-
SHA1
bb0cc0b05bb70a3d347faa94fb36a35c771b0692
-
SHA256
48ff838a7fe98ec2c5bb59a8a76100047abcfa6db824f4982b8e7fdf2110f05d
-
SHA512
b68b37147ce0d1389d62f5f72ebb616edc7d2ed2aaa484e85f6dc4b6070c9ce973a523e11e311686dc0efb0757fe52dcfa430afb1f48f98ecfdc257c6f3cc360
-
SSDEEP
3072:viHZTdn6oWzjNtxPPnGau7GMuOYHAifZEeKPi6u7KzrN7ivE5oY4KppRsqYaefiU:QZqPtvGauSM4HAifkGOzrN+HKkalM
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.xlfp45.win/BD8A-DE2B-692C-0291-94D0
http://cerberhhyed5frqa.slr849.win/BD8A-DE2B-692C-0291-94D0
http://cerberhhyed5frqa.ret5kr.win/BD8A-DE2B-692C-0291-94D0
http://cerberhhyed5frqa.zgf48j.win/BD8A-DE2B-692C-0291-94D0
http://cerberhhyed5frqa.xltnet.win/BD8A-DE2B-692C-0291-94D0
http://cerberhhyed5frqa.onion/BD8A-DE2B-692C-0291-94D0
Extracted
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16390) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 2 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 61 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 47 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{B4D97F26-2571-67E6-FEC3-BCB500FF708F}\auditpol.exe"C:\Users\Admin\AppData\Roaming\{B4D97F26-2571-67E6-FEC3-BCB500FF708F}\auditpol.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2920 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2920 CREDAT:865281 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "auditpol.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{B4D97F26-2571-67E6-FEC3-BCB500FF708F}\auditpol.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "auditpol.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85B
MD5879b445140578bf660519a32ddc026c0
SHA1b46804e8e02433d55ac9555a9257eeaafc646d32
SHA2567e7e37bacb611148bde1ca8239988c4f8173319a1a88a3a5e8119ae0d8e23922
SHA512873586926dd8f7c1f875541fd70d77c1346ccc4d73337d22a3ba1591d7fb2336f5babeed8cf7c16366290f621e5b628070579ec083d6fda64712ccc83d756cf1
-
Filesize
219B
MD535a3e3b45dcfc1e6c4fd4a160873a0d1
SHA1a0bcc855f2b75d82cbaae3a8710f816956e94b37
SHA2568ad5e0f423ce1ff13f45a79746813f0f1d56993d7f125ab96f3d93fb54bdc934
SHA5126d8e68b969ef67903aff526e983b0fb496678e4c819139e560a11f754a36c4b5770ac2ecf3fc1d9cb5aaa84f80363b4f55553255569503893192911b80d9d853
-
Filesize
12KB
MD5760cc6692455478fa92fce030c472d61
SHA1dbfe0c1822ac27bb71202d0f2fdf86f01f98cc04
SHA256781ed12b333380bef0192f0a556142220a4b29fec94583d2f2c706ca84b1f228
SHA5125d9f8db42524762187d17a1ca0749ae273ba5438e66562b36f20f97c1c53ecc605e7a9bb7cd7111223771a8eadde7bbf992a332f2e2afce120a62b143ce14b48
-
Filesize
10KB
MD56b7dfd030606b2357e281d6f9233d79b
SHA13e310e82e371338e1ef717c07cf466786c91bfc3
SHA256523fa18c26b106e82163b97011080080277f6f33a75e8e9bb36e60e4db7d9448
SHA51217485b8324d42647918d264cc775b3980f7363ec9c0def6635c71c913f633b114118d37d3dbc054836cf6bb79a92e5bcc2d9a87110b616a84bba36ea59e399a9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD5135d134c77cb10b7dfb5afd5c48f4c5e
SHA1fa0d00a327b805415c08ed958d09a349f59868fe
SHA256b2e1ce338c9331ddd5dd543703063f9c0817891f958f258b1127c4636f3f65c4
SHA512b747ffe03c3ca1beec947f308f306046e1d3f33b3f336a8ee3f8fb34b76794fe30320995454be94175bd46ec361a2c7777b92cba45c7b8372fdb7cf73def94e0
-
Filesize
342B
MD5d0fa92ad5c10d0d06aeb11014dced370
SHA15efa2df315d5f1688ebe5e99e73fda7db76cd696
SHA256d16c6e3d5784fdba5c3bce14160d6bf4b4e8bd6c07f2a6d4cf1803e333feffb2
SHA51239dccd7acbb1208511ae3a9c5f422a99b3e16eca5f41ced8e334a59aab14fa041971ea2e74f73f4e938680475bb2cf42f37e9bf0c01804ddccc127de1436b87c
-
Filesize
342B
MD58463db36609372c4c80e7e04afcf8ddf
SHA1db66b60673d40fb64947320396ecae5a0ac53295
SHA256f83c3f1b89838838159fbea7e0b71855cf283f67a8f5ca247a77f2604a32a229
SHA512cf649c673dae44bcbbc698a49fdc8a9b2a6c49022936a4eb9ba10cf54b4113a3c96fd9e073244b9a4756c31e62de8e2554548ec7f7b0769f5c1189af74f63eb8
-
Filesize
342B
MD5bc8ec1a3b3101042d666e4af77844d04
SHA13776ba6b149c3966a5072b75783e79cfbc260c77
SHA256fe8be250063f07521e5b5926f9a84669b1f9bb8a74e9ea0007d1f1ce7240d404
SHA51290aba5c0ad358b1bf5e4b3d4c0112491a4fbf429f4d4dfdc978e39bd2de639e4bfea6d5c832fa68a18d981a4d4714a25f33b3f0e17985430544ae52ca6349921
-
Filesize
342B
MD51ef7758a17d8b79490cb9b84e2832a05
SHA11edafc6107f3a80ea6155c457c5c448be11a4d7e
SHA256e16399a5c3a2c3568b66c248336e4c9604ece4a8e4cdddb2113fedd3123b2f4f
SHA512b59f91fc09fea58185bfc519ea2bf96c85f9cad9607b0581f6dae4eceadeab495f62e8f1b2e170216a967ed6a9deaa9ba9fbbd640e0520d3aa6f8ed253d55b0f
-
Filesize
342B
MD58f369eaf09c9be59d1a0767bad435b3f
SHA187c2cccbe2b89d9db5f5c2e72b7efff3fd08e73f
SHA256c668b0bec40c9fd9e2e63bde91db365b79acbe65504c73c2c6bf0c5033b077d3
SHA512e9061edb21ca14bd9155876290ed6be6e82d857ca84a6404a33812fc5283c7ccf75c4402e5cfe947e16ee92a983b85a19f4bdf9ea4dc491388e5c3d6e1da1965
-
Filesize
342B
MD52f71242fad7a3c016221b387fb686772
SHA15e3995f8a5f70d7befa59ce422ce9b4b169f2de7
SHA25662e98f638a1ca99c1de1d25f8184227275fb872ccf7e3fcadded8a34efcd2b64
SHA5129c43f17688f6fd716e40ce8393b256e70fc4d75967b66b98ced41ebb0afe0973a5c918b902230c0e6d52a829c27d97da637a6fd46dc79097e017f4dbb12d3e00
-
Filesize
342B
MD59d5cea2af8d44b72311bef9aafe08a18
SHA1a3fa9ddd79a451f5beae990d380bca014ef2f392
SHA2566708a1c1361a87b9181f657df14559346f8afdfe8566f6ed56a8c8ab4f70c9c4
SHA512c4bde200f4a4743b356dc3f588a33566f3d5003abd7ed16d756bd81b9ff19f55f9075e30f95fe6bce012a31baf2ad48f1c8cf5c0fd9adcf2db034edc9560ce5a
-
Filesize
342B
MD558c834131bed9479267fae74ef196bbf
SHA108c897aadc2935dd9f4e583e8aacd98ff173e6b8
SHA2564c65c2d8048d6f5d39e06794e4993b38e0ed039de6bc4aeb2805b958f689fdb4
SHA512da76607aa37e25e964a2641bd2bb05d3403a890c7ba71aefb0973645b35bfaf0c4428239bfecf004c1a515cf765fb7c7eb0422860c50cf3dfd1135df4c4f4a0c
-
Filesize
342B
MD54d2601ac267d65f992d74ed8a8b7ffbe
SHA10cdba7999b028342139539ac7b02bdb30bd079a3
SHA256889e0f5b7bcc3f22381764d10cc5644bc4d6c1ce24e9e2cfde7d9beaa91bf233
SHA512005aac83c8fc807138a44925344f25e53c30914e434c72398a41ca46f6db5496ba2aea21556cd2acf442ab8d1c92ce677554e9aede51918a7356b40d569e38da
-
Filesize
5KB
MD5400e4948352feb2973ab54c110303648
SHA1546247069d591e8060fd5bbfc388995841c5d328
SHA256b7e37a2c23193105cd456f5ef67ed9c92e4d1357f0b0a7d443b1157097dbe650
SHA51291dab6462698542a1cd8abb22e66a680ee6aad85a0bb3aa35447374fd5fac28b304c54008cf5b8213288a1c2c9bdd2175b6231bd80bce9c30a12894cf15ba8e3
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD5e72e2ef047a3458fab3fc8f2abaaddea
SHA13de866626b2016ec511038e1c864de290c5b0340
SHA2560f2dbcb2a4ad9e56557ad7356450e4eabfc9b6d46a1b257161d3b42bb8973213
SHA5126f71266231c7e6178890c33012e6d97ace0a21a5ec81de0f52b6acf846a5fcf39d6057460a614203c7e176e96bc27d5f7b47e0f5803a28d8756789a215f93264
-
Filesize
392KB
MD56653ef20d2a3a6ef656d9c886ebabd93
SHA1bb0cc0b05bb70a3d347faa94fb36a35c771b0692
SHA25648ff838a7fe98ec2c5bb59a8a76100047abcfa6db824f4982b8e7fdf2110f05d
SHA512b68b37147ce0d1389d62f5f72ebb616edc7d2ed2aaa484e85f6dc4b6070c9ce973a523e11e311686dc0efb0757fe52dcfa430afb1f48f98ecfdc257c6f3cc360
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
124KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
8KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
128KB