Analysis
-
max time kernel
129s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
20-07-2024 03:51
General
-
Target
VirusShare_8ec363843a850f67ebad036bb4d18efd.exe
-
Size
186KB
-
MD5
8ec363843a850f67ebad036bb4d18efd
-
SHA1
ac856eb04ca1665b10bed5a1757f193ff56aca02
-
SHA256
27233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
-
SHA512
800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
SSDEEP
3072:TFFzdn1bwoWwW8BplOd4G5ts0RTy/L1yib5icNisjx3jUiXy:TFFzvwoWw3BXOdl5Ts1yw0s13jU5
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.zmvirj.top/EA55-BAD5-F3AF-029E-D6D7
http://cerberhhyed5frqa.qor499.top/EA55-BAD5-F3AF-029E-D6D7
http://cerberhhyed5frqa.gkfit9.win/EA55-BAD5-F3AF-029E-D6D7
http://cerberhhyed5frqa.305iot.win/EA55-BAD5-F3AF-029E-D6D7
http://cerberhhyed5frqa.dkrti5.win/EA55-BAD5-F3AF-029E-D6D7
http://cerberhhyed5frqa.onion/EA55-BAD5-F3AF-029E-D6D7
Extracted
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16389) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 2 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 61 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of UnmapMainImage 3 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{FC0DC950-DB7F-2E42-0A56-A49E2AA3B419}\shrpubw.exe"C:\Users\Admin\AppData\Roaming\{FC0DC950-DB7F-2E42-0A56-A49E2AA3B419}\shrpubw.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:537601 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "shrpubw.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{FC0DC950-DB7F-2E42-0A56-A49E2AA3B419}\shrpubw.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "shrpubw.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "VirusShare_8ec363843a850f67ebad036bb4d18efd.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {A9381364-D733-4C56-B46B-EC8345CCCA63} S-1-5-21-3450744190-3404161390-554719085-1000:PDIZKVQX\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{FC0DC950-DB7F-2E42-0A56-A49E2AA3B419}\shrpubw.exeC:\Users\Admin\AppData\Roaming\{FC0DC950-DB7F-2E42-0A56-A49E2AA3B419}\shrpubw.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5877f593f9b6a7a40705b8d247dd72b75
SHA15f8490670b821a07ca834a1faf78f31829770997
SHA2564c443939b0c4b45bde9860383c3f1a09872b1174ec415ab011287eaaae0cce76
SHA512330eb4dc68db9e5ae40a5a0717a51e68a352d07c2ea38ca18e6da28d90963528a0b19ff846fa6b3f96e1f3b790a472eca8f421fc06da36671cf5e6202a64003d
-
Filesize
10KB
MD5f91d79837f351dc9cb414402ad453695
SHA1d7378f373bb7cd3d03f2494b0f8faa419197d786
SHA256cc9c9afc25e0dd5c0614c4e277684582076e42a83722b0e5a198a7571bdfc4a7
SHA5121f0a4e1a2a5658b73825bb8dd6f385636c5c858ffc29fb3a0f9c459fd5b7b4b06a72e50162b7d24ca93787f4f0a11f956d6d1a179b814f0245b4696de2ab7b1f
-
Filesize
85B
MD54651c0c11cda3f094c0c6e9dc90961a6
SHA1037386c69c3e43e35fa05578f94bfe96a3d107d8
SHA256e05dfa062e05fb66682cc9619fa9bc72dd2633c6068c38512f5646baff0f7540
SHA512e28092c9eb139b64d32611e32bf10d8a17ea0f7f314ef7aa7fbbd4209333dfa692b13246ba405616282621c1662328da28d568e5eebcb6d6bafadd6ff256d560
-
Filesize
225B
MD5f6d629f2a4c0815f005230185bd892fe
SHA11572070cf8773883a6fd5f5d1eb51ec724bbf708
SHA256ff1de66f8a5386adc3363ee5e5f5ead298104d47de1db67941dcbfc0c4e7781f
SHA512b63ecf71f48394df16ef117750ed8608cc6fd45a621796478390a5d8e614255d12c96881811de1fd687985839d7401efb89b956bb4ea7c8af00c406d51afbc7c
-
Filesize
304B
MD5df423e7a23fb317d29fe0a1463483b29
SHA1dbe38b9deda5213fd635263f519abfdcc996c5cc
SHA2563bc314f144264aca0b04c402bea820372a12c8a14a6cf3b8e1b5f5065e1f4a31
SHA51263c3a3fafd0b353c9e841a28a841c7c035a875c3161fc9246644d152e2bb732a29d89829f2d9cd215e8ded8cfbb71046beedb1d7e28f0fd33e0922017d3a08df
-
Filesize
304B
MD5847a66ba6525ef23a4881947ed3bea45
SHA1f981302aa6c0fc7b36dc4aee7bb9c546d6dd2c4b
SHA256207b487891e07be577be3d551a50b960a3ce2590cddb3b3bf3d21978e248c51f
SHA5121b221e5d3426bcd160f3f73c37a4cf1c8c018013c77d46ec0bf26f87410e26839efa5cb7956dec5b591096ad84b2e3172b086671911cf0e84391bbb35411e598
-
Filesize
304B
MD5c86112886bd5b7596ca04b9005c2de78
SHA16291433ad333cf3425db702de5f950dd651c906f
SHA2568e15ade22c0b601614305104e948da344d4669502ad7d649f119e231c90520c6
SHA5128afd4a9970494616238389c21d9871ead913ce3e9d23c690a1fb7f270b7c46fc51445a8ac185e87e9ff12ca7fd53d06250b06342ad8fddd0bbd2f9bdcb545a71
-
Filesize
304B
MD57e1a874a580fe22e8f3af6a6eff7de59
SHA192da0d5bda774ba7b88638c8e81c924eb2f8f778
SHA2567fba0eebba8d00dbd5d65b6a1c854135e9d08d6207ec489f45847c8764f5175b
SHA512c6566215e6e0567f1440bdf1d55619eaa5bd193a6ca3da57aced9b9e2f206fa3a59a9521a1d58641b5655fb6da1331b1e695edf5367b7794612f8977ad0db514
-
Filesize
304B
MD5e0aab943c2aa3f3b4ead12f41c80bee2
SHA1ffe0d23416c2769856602a118a05ad47ff77152e
SHA25626cc8811a26e4f1f98377008612346b57cbb80352315b09f3ca38bdf2532174b
SHA512138a7d27c1d09983e7a89f5b71df13f55740342082abe5973e40ca4842cd88e046712f99025fcaeb21d4670820309b905954a6eb1ea3a59b104a5506a48a8b4d
-
Filesize
304B
MD51375e096dd786625acae0ab18ba40b14
SHA1e069687292d25bdc065ff0f933822855d8b9d812
SHA256ff97f61d4c29a727cbe19c472630a73dba86b013cff415a382769fe35ab7e824
SHA5129cd94e077fd1e5f25bab5e858af90267b45d3a2c00cb253c36125b3c295f54cc397ff7fdafc65ff2db8face1c6d155764dcbda16e8b083f31fc4a139f6517155
-
Filesize
304B
MD59348273fb0ad0f22fbc58d425a38646a
SHA1cddb459c251815c63021abe947fd81b8381e81b7
SHA256a6bac54a7d6d41c6553aa5d02a3e20be9a43773d26afff739a84e28c52eaf899
SHA512fa32001124812caf331e742aa3c9e7b33813036d4b4503755d2917b0fe4ff176bf0bc77702723986c9950539f427ad9089b4933b51ad7916c00cbbfd0a302b72
-
Filesize
304B
MD5028c788eba3f5072b215ca1f56214f4b
SHA16643ff85763489d4ef1ea373816a7e0d3bcd3468
SHA2569f3ad93ce2475989bc389a997c8a5740ce0752ade9d7e83d9c2a12544518a387
SHA51213ecbd37ac8619d08420a9a4aeabee82c7107e49e081efce5d5abb6d2d4f09bb505af82a7836b95bf4bc24673a017cae3d7141a53d82d5753aa01e55b63c2381
-
Filesize
304B
MD5312e483a190efd6aef87bb91818f82fb
SHA1655f6ac79f29386f4b3da0e9cc19e191d848a7ac
SHA2565e9b76c8b640b56aad82ce12c1af30aced9ce579731bfeb1db2b185d82043b5e
SHA51267a7024104653e75b3719c60a9fddd2fcb163a0b7653ea843e94947d0e9600e4a551da48443084129867cf106d6bc035cb1327a6946c1c01e9b5108b2f0f0992
-
Filesize
304B
MD59b3dd7748173d61d735f9258d68b97b0
SHA183534c83f5139d5ac4e8ddf20b9ad9c0122a56be
SHA256dbf97a8ed1468d1fa3eda676ed0b3851c056deb82f236d32f0b3e1b5301c1893
SHA512e2f408eb706ed5adceb5742eb5f4272410396fe576ca8467dcbc7d6705cce50a79418f045efe30f146835d65f5df419c9483b535914585db05f62bb467d49bae
-
Filesize
304B
MD59b51215ab042ce5495512a38fbea5a1a
SHA1128f39cd56a00841d49abc73806dac16c145851b
SHA25636fecebf0561706f2b3da938f26b8d25dc8c7a388931276b5017e8e424ce0d1d
SHA5125856db1b10a7061dfefb053d5c0511fbea9bbc75fb8da7e6899d46595e9afc75a269497d75cbb41371b97145ccdcfd3025b95c54591da67952fbf058916705ff
-
Filesize
304B
MD58dd0dacced1b3390bdcac515cd7e5123
SHA13985a770f648536b906236d26f57a296a55fc9a4
SHA2564245b47b2e27f0dd205810f3ce027efb8ad1d33839ff8fdd9fcb2545d6da76aa
SHA512ab55f8b62c6bce4e5deef8278c490789800273a54173596b9ee19a07d5d80edff1d6c20b65c740a3dbd4804042525b2b36eb9ba6da7be4acdcc9300a0530d86e
-
Filesize
304B
MD57989e1c9679b2f365f1b45996303df2a
SHA1928ec8c8b2cd631de342d69b345233486cb2fdf1
SHA2569f6c9dfde64f3f6b56eb0f28b536e79a63b2bd028ebcbc3b7893475480733927
SHA5124254861ed9346205cfbb2d48ddc26f2290728345ea8d2352ad0329aba164213a163edad8e7a1d1851914c2aab7b0225d1356d312f79ae3d947c5d175a4709371
-
Filesize
304B
MD5e8a6364edfd9ccf8ba9b443c728dc622
SHA1072e23923f97214dc78c6ad59ef652fcaeb61c49
SHA256ccb6c3ec289f342483bd5c39f0b7140aebba6eb7da403aea045b4bdd4fa4c8ba
SHA512f39c9cac4c9fa0657a2a315a89115c4abb81ee71d2ba893b02c8860551bf78638bfeb1e7bc0f4a24c94a05f0fd6ad504e7a51aed2d282367ec02ad112209c231
-
Filesize
304B
MD5959f2753ce3d0518dbe5ba02cc097532
SHA1b8c6bb52e86f9cd94ee839c97a326f4f970bf492
SHA256fc123674e8aea8e72a98f83cf8e312d497a3a4d30580f29a738e21986b57f9d9
SHA512a245dd7c57db205685bef4a9dff547364bd44d86517f9ac8bcbab67f867699212ed70e3b5c217f7f645cb3c3d5395dc3e7150e509e6c16a5e2a6bbc5278b15bd
-
Filesize
304B
MD51f297bc62643d0ed9944ad81ed7ef97f
SHA155317c226af6135e4475bacb5a5c1923032e4d5f
SHA256c40b62d800f5308368fad5450a002c5ae5b62fe259c07d04df30675491edee7f
SHA512f1470d7c854c5fabef7c82dae6df41173539b0ea27e56977ac799edd0b4eb22468c4a44c5559c3920ba75a443eecf6b1872221db9361afbdf5e7883907ae4f54
-
Filesize
304B
MD516fbce25c58d41202d9811c0dcb19559
SHA18c50a05306846e531d01bc1dfd43a8f14f6b5a70
SHA25693ae539c617bdc35db4dab6a53ce31429753c9c5cfc7199652823ae17ef65b3a
SHA512569bdef5c0f80353806bfc7089de2f36e81dd7872b1665a471346995bc50681af004c1c563182f21a1081f9df5bbda07391c0d344e5e0672beadf41454f0f69c
-
Filesize
304B
MD584c20d23f5e5fc619a4d07bce02263ef
SHA129c9b2e1ea3b39dca209af7070733772b34ed072
SHA2563c1e1a09e23d5c07786695b5b95e5e1b089af8566df38d8b6292e069f9df4c75
SHA512a478aaef1017ba5b337b0369fabc410540e7d82b04f860f9879dbf3f9954ae81b6dcf31e4783fb04a41d91384167828ff9c6648a86a2226a3e70930eb3319066
-
Filesize
304B
MD504935172f833cbf2f5d59819847a50d3
SHA12dceffe1972f6634b3e93f4c3badfac38458e55a
SHA256c79ab0f9c87cf739ef227bb9cd3ff1962bc59f98202431d0a330feccaa6ff925
SHA512e7dee99e0af451377be3b3ec2cb3e05106a3a3fe020b2096a3961d63ec5fddc0c3f18c9881ab7c3077b80673705c66115f55d72f0324b3a12b5248cfff919eef
-
Filesize
5KB
MD578ed3e9439df1d0d71eca4975104ec3f
SHA15d65c8f44cb4e130a9c04d9d4d2c4f9f3cef69a1
SHA256b14f9a1989cd21273271d9d24661b4d484fb919e8233bd23065b4a63e945a8be
SHA512c66ef46abf468e5a1df27111d6eaee3c7f70e63187bee30f70875d2e5cebe0d156f2b636181527e69a131e21928d1d34e6efb516d6f7e7a0217618a57c86a1a3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD5bf7ad82fd3c77bfb9b44ebc7011a99f7
SHA1580c86e4c66529e1cab9c6a9e2d1b3ae7e81ab45
SHA25655ff5999e0b3a3cdec4c3c5b7db731ad39fd29c08e5d847430723cc284eb042f
SHA5128bdf9d0852fdbcb745749f1b8201d325dd6b70d85e4a9224fa8a633e9bea1e1551903e54bc8279b3509b67eff25b2e7fb838b3c10b9023edc82ab94feec05664
-
Filesize
186KB
MD58ec363843a850f67ebad036bb4d18efd
SHA1ac856eb04ca1665b10bed5a1757f193ff56aca02
SHA25627233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
SHA512800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
8KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
132KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB