23f81b65984917c14e3b681c13fa51f773f88d42d426391cd8d5ba5fc6e5182c

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
31/07/2024, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cerberus.exe
Size 1.2MB
Sample240731-se329szapl
SHA256 23f81b65984917c14e3b681c13fa51f773f88d42d426391cd8d5ba5fc6e5182c
MD5 781ad3cf357d2c85951c2fc4561cdb05
SHA1 5820b3c5f9d4df7e52ddb7707ca78aa686d6c8f5
SHA512 b7c6504aaba8be3fe4e5a971749b4a742d1f52e009ec00499c4b72a97bb57bee7b29707a245ddd668a1e0d37ac8cf0aebeab612517b57416caf3287ef85b38fd
SSDEEP 24576:La+NmkysfhY6WiIVeE8hMCXZ2DIa4WdEagbQiDZdIosgvJZx3QDE1DLJb/PhHH0V:GziXJ/dH0J9
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion exploit

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-857544305-989156968-2929034274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
evasion

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
940	icacls.exe
456	takeown.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-857544305-989156968-2929034274-1000\Control Panel\International\Geo\Nation	cerberus.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
456	takeown.exe
940	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 5 IoCs

Modify Registry

T1112

pid	Process
3220	reg.exe
4960	reg.exe
2856	reg.exe
1624	reg.exe
1884	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	456	takeown.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 4960	3380	cerberus.exe	86
PID 3380 wrote to memory of 4960	3380	cerberus.exe	86
PID 3380 wrote to memory of 2856	3380	cerberus.exe	88
PID 3380 wrote to memory of 2856	3380	cerberus.exe	88
PID 3380 wrote to memory of 1624	3380	cerberus.exe	90
PID 3380 wrote to memory of 1624	3380	cerberus.exe	90
PID 3380 wrote to memory of 1884	3380	cerberus.exe	92
PID 3380 wrote to memory of 1884	3380	cerberus.exe	92
PID 3380 wrote to memory of 3220	3380	cerberus.exe	94
PID 3380 wrote to memory of 3220	3380	cerberus.exe	94
PID 3380 wrote to memory of 456	3380	cerberus.exe	96
PID 3380 wrote to memory of 456	3380	cerberus.exe	96
PID 3380 wrote to memory of 940	3380	cerberus.exe	98
PID 3380 wrote to memory of 940	3380	cerberus.exe	98

C:\Users\Admin\AppData\Local\Temp\cerberus.exe
"C:\Users\Admin\AppData\Local\Temp\cerberus.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:4960
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:2856
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:1624
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:1884
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  - Modifies registry key
  PID:3220
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f c:\windows\system32\*
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:456
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" c:\windows\system32\* /grant Everyone:(F)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3380-0-0x00007FF6DF540000-0x00007FF6DF6E5000-memory.dmp

Download

memory/3380-1-0x00007FF6DF540000-0x00007FF6DF6E5000-memory.dmp