Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 08:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe
-
Size
206KB
-
MD5
37fd2cf6583c768d5252f1ed41cf73a4
-
SHA1
baeff61757976ab6b321cd5e99b41a4cd1654815
-
SHA256
7178b30eea42854b1c99fb6989a9439cdc82775c85c9e6289da88eb176d6b018
-
SHA512
51f075e935ce8f9e027fa39e9385ccca2fc5c31919cb12e30ec40e7a2b1d0502472e996ae5bff48eb87b713f8ddb86d8d879bb3c977b3967850e6476d2207cbc
-
SSDEEP
3072:qAMPG/UkQjXxyC5DLsgUBBX4AQqxCn+gFGMolqN3ChldnyW/q+7CGoTXQsOU6oMT:qAMPGh2xyqLqBX4AQfpFnoyQrqga
Malware Config
Extracted
C:\Users\Admin\Desktop\_README_87WY0S_.hta
http://zutzt67dcxr6mxcn.onion.to/7757-ACA0-F1C5-0091-B1C1
http://zutzt67dcxr6mxcn.onion/7757-ACA0-F1C5-0091-B1C1
https://www.baidu.com
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (590) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp78F9.bmp" 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\office 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\steam 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\word 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\excel 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\outlook 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files\ 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\bitcoin 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\the bat! 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\ 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\office 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\word 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\onenote 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\powerpoint 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\thunderbird 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\ 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 4160 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2476 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4312 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe 4312 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeShutdownPrivilege 4312 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe Token: SeCreatePagefilePrivilege 4312 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe Token: 33 4164 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4164 AUDIODG.EXE Token: SeDebugPrivilege 4160 taskkill.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4312 wrote to memory of 4516 4312 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe 88 PID 4312 wrote to memory of 4516 4312 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe 88 PID 4312 wrote to memory of 4516 4312 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe 88 PID 4312 wrote to memory of 1620 4312 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe 92 PID 4312 wrote to memory of 1620 4312 2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe 92 PID 1620 wrote to memory of 4160 1620 cmd.exe 94 PID 1620 wrote to memory of 4160 1620 cmd.exe 94 PID 1620 wrote to memory of 2476 1620 cmd.exe 95 PID 1620 wrote to memory of 2476 1620 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe"1⤵
- Checks computer location settings
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_README_87WY0S_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:4516
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\system32\taskkill.exetaskkill /f /im "2024-06-28_37fd2cf6583c768d5252f1ed41cf73a4_cerber.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4160
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
PID:2476
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x524 0x51c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4164
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD57e555363d8bef00b5941261d7843306c
SHA126c5a2c49b870477b1986eb22312e4bbc0159e70
SHA2568c240fe77397132ce94a100e2d1c999f763e0e563e168cecb46ce8ea42e8c399
SHA51227d12c6126df1636ee277abdcea365d732069eb24e5348a5773ae215650ccdd53367916795bf537e7e865675b84070d0b85106bb61cdf12677bda783feedc7a2