Analysis
-
max time kernel
22s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
05-08-2024 12:19
Static task
static1
Behavioral task
behavioral1
Sample
OHT1k0.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
OHT1k0.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
tXauTiJr.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
tXauTiJr.exe
Resource
win10v2004-20240802-en
General
-
Target
tXauTiJr.exe
-
Size
521KB
-
MD5
464c348f1bdf66a75c6b0d51256e916c
-
SHA1
fa7f683e451ab0a0c6c18a4dde7b9bbdde72ff27
-
SHA256
a58b1f94ba24a2d7f06c2b7a9840243c4e1b75b1b580cf1ce4c5d9af69cedc85
-
SHA512
cb07284fd3d33eef29f761fd0d044a9143b9e934eff49a625290c4da23580c1b0bb1f4cd9d5e574c698fbf791d13aa476be2a550baebb4f925ef019015710233
-
SSDEEP
6144:8a/Z+6VHFnEXbw2Y3h3NWqU/xdwpN8T4LUEDW9VXnHFudT7coWspLaIZ1ZT:8a/h8w2UNiX0gEOpnHFutV5n3
Malware Config
Signatures
-
Cerber 3 IoCs
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
description ioc pid Process 2844 taskkill.exe Mutant created AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8} AMIDEWINx64.exe Mutant created AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8} AMIDEWINx64.exe -
Executes dropped EXE 2 IoCs
pid Process 2648 AMIDEWINx64.exe 2356 AMIDEWINx64.exe -
Loads dropped DLL 1 IoCs
pid Process 2616 cmd.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 2 IoCs
pid Process 2844 taskkill.exe 2280 taskkill.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 480 Process not Found 480 Process not Found -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2844 taskkill.exe Token: SeDebugPrivilege 2280 taskkill.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2244 1720 tXauTiJr.exe 31 PID 1720 wrote to memory of 2244 1720 tXauTiJr.exe 31 PID 1720 wrote to memory of 2244 1720 tXauTiJr.exe 31 PID 1720 wrote to memory of 1888 1720 tXauTiJr.exe 32 PID 1720 wrote to memory of 1888 1720 tXauTiJr.exe 32 PID 1720 wrote to memory of 1888 1720 tXauTiJr.exe 32 PID 1720 wrote to memory of 2416 1720 tXauTiJr.exe 33 PID 1720 wrote to memory of 2416 1720 tXauTiJr.exe 33 PID 1720 wrote to memory of 2416 1720 tXauTiJr.exe 33 PID 1720 wrote to memory of 2088 1720 tXauTiJr.exe 34 PID 1720 wrote to memory of 2088 1720 tXauTiJr.exe 34 PID 1720 wrote to memory of 2088 1720 tXauTiJr.exe 34 PID 1720 wrote to memory of 2768 1720 tXauTiJr.exe 35 PID 1720 wrote to memory of 2768 1720 tXauTiJr.exe 35 PID 1720 wrote to memory of 2768 1720 tXauTiJr.exe 35 PID 2768 wrote to memory of 2844 2768 cmd.exe 37 PID 2768 wrote to memory of 2844 2768 cmd.exe 37 PID 2768 wrote to memory of 2844 2768 cmd.exe 37 PID 1720 wrote to memory of 2616 1720 tXauTiJr.exe 40 PID 1720 wrote to memory of 2616 1720 tXauTiJr.exe 40 PID 1720 wrote to memory of 2616 1720 tXauTiJr.exe 40 PID 2616 wrote to memory of 2648 2616 cmd.exe 42 PID 2616 wrote to memory of 2648 2616 cmd.exe 42 PID 2616 wrote to memory of 2648 2616 cmd.exe 42 PID 1720 wrote to memory of 824 1720 tXauTiJr.exe 43 PID 1720 wrote to memory of 824 1720 tXauTiJr.exe 43 PID 1720 wrote to memory of 824 1720 tXauTiJr.exe 43 PID 824 wrote to memory of 2356 824 cmd.exe 45 PID 824 wrote to memory of 2356 824 cmd.exe 45 PID 824 wrote to memory of 2356 824 cmd.exe 45 PID 1720 wrote to memory of 2932 1720 tXauTiJr.exe 46 PID 1720 wrote to memory of 2932 1720 tXauTiJr.exe 46 PID 1720 wrote to memory of 2932 1720 tXauTiJr.exe 46 PID 2932 wrote to memory of 2280 2932 cmd.exe 48 PID 2932 wrote to memory of 2280 2932 cmd.exe 48 PID 2932 wrote to memory of 2280 2932 cmd.exe 48 PID 1720 wrote to memory of 1672 1720 tXauTiJr.exe 50 PID 1720 wrote to memory of 1672 1720 tXauTiJr.exe 50 PID 1720 wrote to memory of 1672 1720 tXauTiJr.exe 50 PID 1720 wrote to memory of 940 1720 tXauTiJr.exe 52 PID 1720 wrote to memory of 940 1720 tXauTiJr.exe 52 PID 1720 wrote to memory of 940 1720 tXauTiJr.exe 52 PID 1720 wrote to memory of 2300 1720 tXauTiJr.exe 54 PID 1720 wrote to memory of 2300 1720 tXauTiJr.exe 54 PID 1720 wrote to memory of 2300 1720 tXauTiJr.exe 54 PID 1720 wrote to memory of 2872 1720 tXauTiJr.exe 56 PID 1720 wrote to memory of 2872 1720 tXauTiJr.exe 56 PID 1720 wrote to memory of 2872 1720 tXauTiJr.exe 56
Processes
-
C:\Users\Admin\AppData\Local\Temp\tXauTiJr.exe"C:\Users\Admin\AppData\Local\Temp\tXauTiJr.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2244
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1888
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2416
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2088
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C TASKKILL /F /IM WmiPrvSE.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\system32\taskkill.exeTASKKILL /F /IM WmiPrvSE.exe3⤵
- Cerber
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS %RANDOM%%RANDOM%%RANDOM%2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exeC:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 264412284191933⤵
- Cerber
- Executes dropped EXE
PID:2648
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV %RANDOM%%RANDOM%%RANDOM%2⤵
- Suspicious use of WriteProcessMemory
PID:824 -
C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exeC:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 264412284191933⤵
- Cerber
- Executes dropped EXE
PID:2356
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C TASKKILL /F /IM WmiPrvSE.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\system32\taskkill.exeTASKKILL /F /IM WmiPrvSE.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amide.sys2⤵PID:1672
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amifldrv64.sys2⤵PID:940
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe2⤵PID:2300
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2872
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD5785045f8b25cd2e937ddc6b09debe01a
SHA1029c678674f482ababe8bbfdb93152392457109d
SHA25637073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba
SHA51240bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9
-
Filesize
452KB
MD5c4d09d3b3516550ad2ded3b09e28c10c
SHA17a5e77bb9ba74cf57cb1d119325b0b7f64199824
SHA25666433a06884f28fdabb85a73c682d1587767e1dfa116907559ec00ed8d0919d3
SHA5122e7800aae592d38c4a6c854b11d0883de70f938b29d78e257ab47a8a2bbf09121145d0a9aea9b56c16e18cde31b693d31d7ebfcd0473b7c15df5d7ae6708bbd2