Analysis
-
max time kernel
120s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 08:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe
-
Size
206KB
-
MD5
37fd2cf6583c768d5252f1ed41cf73a4
-
SHA1
baeff61757976ab6b321cd5e99b41a4cd1654815
-
SHA256
7178b30eea42854b1c99fb6989a9439cdc82775c85c9e6289da88eb176d6b018
-
SHA512
51f075e935ce8f9e027fa39e9385ccca2fc5c31919cb12e30ec40e7a2b1d0502472e996ae5bff48eb87b713f8ddb86d8d879bb3c977b3967850e6476d2207cbc
-
SSDEEP
3072:qAMPG/UkQjXxyC5DLsgUBBX4AQqxCn+gFGMolqN3ChldnyW/q+7CGoTXQsOU6oMT:qAMPGh2xyqLqBX4AQfpFnoyQrqga
Malware Config
Extracted
C:\Users\Admin\Desktop\_README_NHT9_.hta
http://zutzt67dcxr6mxcn.onion.to/7757-ACA0-F1C5-0091-B1C1
http://zutzt67dcxr6mxcn.onion/7757-ACA0-F1C5-0091-B1C1
https://www.baidu.com
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Blocklisted process makes network request 6 IoCs
flow pid Process 1156 1700 mshta.exe 1160 1700 mshta.exe 1162 1700 mshta.exe 1166 1700 mshta.exe 1168 1700 mshta.exe 1170 1700 mshta.exe -
Contacts a large (584) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
pid Process 1304 cmd.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp1D8F.bmp" 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\bitcoin 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\word 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\office 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\outlook 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\word 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\office 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\steam 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\the bat! 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files\ 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\ 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\onenote 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\powerpoint 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\excel 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\thunderbird 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\ 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 560 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1328 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1812 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 1812 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe Token: SeDebugPrivilege 560 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2560 DllHost.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1812 wrote to memory of 1700 1812 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe 29 PID 1812 wrote to memory of 1700 1812 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe 29 PID 1812 wrote to memory of 1700 1812 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe 29 PID 1812 wrote to memory of 1700 1812 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe 29 PID 1812 wrote to memory of 1304 1812 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe 35 PID 1812 wrote to memory of 1304 1812 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe 35 PID 1812 wrote to memory of 1304 1812 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe 35 PID 1812 wrote to memory of 1304 1812 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe 35 PID 1304 wrote to memory of 560 1304 cmd.exe 37 PID 1304 wrote to memory of 560 1304 cmd.exe 37 PID 1304 wrote to memory of 560 1304 cmd.exe 37 PID 1304 wrote to memory of 1328 1304 cmd.exe 38 PID 1304 wrote to memory of 1328 1304 cmd.exe 38 PID 1304 wrote to memory of 1328 1304 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe"1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_README_NHT9_.hta"2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
PID:1700
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\system32\taskkill.exetaskkill /f /im "2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:560
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
PID:1328
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:2560
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:2992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD58aaee74c368907fc25e892ad249244f1
SHA15dea839d6c22716429cd93f08f44592037d35913
SHA25656add16388f0f331fd37b001f910f9db10651333b631034f00e0c8f95417506a
SHA5126dac857b0d0965347123890f6b5d618754732332779d341ce374ba7ee8ae5b2e9abfe3ebc29be9f4950555d68d98828f75a8520b180bc102130490add6ea725c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
65KB
MD57e555363d8bef00b5941261d7843306c
SHA126c5a2c49b870477b1986eb22312e4bbc0159e70
SHA2568c240fe77397132ce94a100e2d1c999f763e0e563e168cecb46ce8ea42e8c399
SHA51227d12c6126df1636ee277abdcea365d732069eb24e5348a5773ae215650ccdd53367916795bf537e7e865675b84070d0b85106bb61cdf12677bda783feedc7a2
-
Filesize
149KB
MD51d7feb0b49932ca63e9539651aaa2108
SHA1ccf34f6e5a313c60a86f1a46dd2cd1f93da93fbc
SHA2561e5d4cd0bcc93ecfcf03a5e387ed607132ab9ef8c428a2dde48ee0b6ffbbf47b
SHA512172f4cfe8777613506e0b09b78893ff7c7b94e0b5ea2907ba96ac2ee5f03af3e44268d592f6b8f74682d3e0fe301e1561ccac3fab7651352fb602c68b2e5c8b6