Overview

overview

10

Static

static

3

1buttonBETA2-22.exe

windows7-x64

10

1buttonBETA2-22.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1buttonBETA2-22.exe

  • Size

    13.6MB

  • Sample

    240804-trclhszakq

  • MD5

    e92e66ade8266a34d040fb51ee5a379d

  • SHA1

    5db9d87344f71afafaef958b206b42751570a210

  • SHA256

    d424f28ef64b3e38d8b5133a47aa6f77394a2a1f8c507346d56886a97f1ac2f0

  • SHA512

    7e8b28ed5a90fa9d27d1481286b6d0b22f6d02a66a27a083a6bc15dec0bf9e63c2d682ffd7286e34294ffc27deb2ede5a9217e2cbc02a125b1bb1fb5fbdd9706

  • SSDEEP

    393216:F5PhlA9gwuDivSwwTmrgBNRY5zD2OgXv60XR0rI9KV3lPLZ:F5PTYgwp7wakBNRY5zU60XaPV3lP1

Score
10/10
cerberdiscoveryevasionexecutionransomware

Malware Config

Targets

    • Target

      1buttonBETA2-22.exe

    • Size

      13.6MB

    • MD5

      e92e66ade8266a34d040fb51ee5a379d

    • SHA1

      5db9d87344f71afafaef958b206b42751570a210

    • SHA256

      d424f28ef64b3e38d8b5133a47aa6f77394a2a1f8c507346d56886a97f1ac2f0

    • SHA512

      7e8b28ed5a90fa9d27d1481286b6d0b22f6d02a66a27a083a6bc15dec0bf9e63c2d682ffd7286e34294ffc27deb2ede5a9217e2cbc02a125b1bb1fb5fbdd9706

    • SSDEEP

      393216:F5PhlA9gwuDivSwwTmrgBNRY5zD2OgXv60XR0rI9KV3lPLZ:F5PTYgwp7wakBNRY5zU60XaPV3lP1

    Score
    10/10
    cerberdiscoveryevasionexecutionransomware

    • Cerber

      Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

      ransomwarecerber

    • Clears Windows event logs

      evasionransomware

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Indicator Removal

1
T1070

Clear Windows Event Logs

1
T1070.001

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

Remote System Discovery

1
T1018

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.