Overview

overview

10

Static

static

7

d8e9c18b3b...18.exe

windows7-x64

10

d8e9c18b3b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    76s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10-09-2024 19:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d8e9c18b3bacc26fd7fea941cf0e04d9_JaffaCakes118.exe

  • Size

    360KB

  • MD5

    d8e9c18b3bacc26fd7fea941cf0e04d9

  • SHA1

    36dedf2275fd14e4feab18d68c349be67a8cda27

  • SHA256

    b6bc11cb6d9140fd424e56daa1e7884b3f788d2927c2de63b483564e65f0f3c4

  • SHA512

    822c8ffa92fa7a8783dfac006e732c34632db59f0c6e7f4b0047e3f26a3b567936270e3698d6bce355de98d25332b8af49f8674e196a888c16dfc0d1efafc3e4

  • SSDEEP

    6144:wB0z1N1FIUm/ZLbDMBvAJIUR8HOy7WqKuIm8yigE1/crn1EcvfSF7i4GpSO:wBg1GZLbDMSJIU4f80il1/I1l69O

Score
10/10
cerberdiscoveryevasionpersistenceprivilege_escalationransomwareupx

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\_READ_THI$_FILE_57WQ_.txt

Ransom Note
----- !!! CERBER RANSOMWARE !!! ----- YOUR DOCUMENTS, PHOTOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED ----- The only way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/8B6C-7B23-3AAF-0099-304B Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.1nhkou.top/8B6C-7B23-3AAF-0099-304B 2. http://p27dokhpz2n7nvgr.1a7wnt.top/8B6C-7B23-3AAF-0099-304B 3. http://p27dokhpz2n7nvgr.1czh7o.top/8B6C-7B23-3AAF-0099-304B 4. http://p27dokhpz2n7nvgr.1hpvzl.top/8B6C-7B23-3AAF-0099-304B 5. http://p27dokhpz2n7nvgr.1pglcs.top/8B6C-7B23-3AAF-0099-304B ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
URLs

http://p27dokhpz2n7nvgr.onion/8B6C-7B23-3AAF-0099-304B

http://p27dokhpz2n7nvgr.1nhkou.top/8B6C-7B23-3AAF-0099-304B

http://p27dokhpz2n7nvgr.1a7wnt.top/8B6C-7B23-3AAF-0099-304B

http://p27dokhpz2n7nvgr.1czh7o.top/8B6C-7B23-3AAF-0099-304B

http://p27dokhpz2n7nvgr.1hpvzl.top/8B6C-7B23-3AAF-0099-304B

http://p27dokhpz2n7nvgr.1pglcs.top/8B6C-7B23-3AAF-0099-304B

Signatures

  • Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

    ransomwarecerber
  • Blocklisted process makes network request 5 IoCs
  • Contacts a large (1095) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in System32 directory 38 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 20 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d8e9c18b3bacc26fd7fea941cf0e04d9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d8e9c18b3bacc26fd7fea941cf0e04d9_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2136
    • C:\Users\Admin\AppData\Local\Temp\d8e9c18b3bacc26fd7fea941cf0e04d9_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d8e9c18b3bacc26fd7fea941cf0e04d9_JaffaCakes118.exe
      2⤵
      • Drops startup file
      • Drops file in System32 directory
      • Sets desktop wallpaper using registry
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2720
      • C:\Windows\SysWOW64\netsh.exe
        C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:3032
      • C:\Windows\SysWOW64\netsh.exe
        C:\Windows\system32\netsh.exe advfirewall reset
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:2752
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_READ_THI$_FILE_TDLD45_.hta"
        3⤵
        • Blocklisted process makes network request
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        PID:572
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_READ_THI$_FILE_57WQ_.txt
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2852
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1076
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im "d8e9c18b3bacc26fd7fea941cf0e04d9_JaffaCakes118.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2420
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 1 127.0.0.1
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:960
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    PID:748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

2
T1112

Credential Access

Discovery

Network Service Discovery

1
T1046

Remote System Discovery

1
T1018

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab9E25.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar9E57.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Users\Admin\Desktop\_READ_THI$_FILE_57WQ_.txt
    Filesize

    1KB

    MD5

    c40abdf73858cdfe12d13b048cbbff1e

    SHA1

    ee1209fea8f2400f5c98c02f64b45de0fef5e032

    SHA256

    732c6fd3350c16b1b0d349f2128043e31751e4bd94eefee673a9105c866c5c0d

    SHA512

    19da7cacb82d0606dc3907aeeff1106eea1088fcc6a7a1d2bceeac669d41c43cf104062b50f0319ad50918c07d41921c6ea8bf686cfdd594ee991748e4fe84aa

    Download Submit

  • C:\Users\Admin\Desktop\_READ_THI$_FILE_TDLD45_.hta
    Filesize

    75KB

    MD5

    b42d15dba5d801d17b33a364c32d8b8a

    SHA1

    9e32df9c5b0429e4ef60d5f17a7134b70bd6a568

    SHA256

    a6c5a264aaaa01f21889dec5df9dfe730bc35e940253780a05c31af71e191ef8

    SHA512

    adbe11889ae0c230d162569101b28995af4a091ff517ca2a16020939787841401175283dbaabbd4c3bfc4bb0895bf3986d6a0837426d4e5720f2a2850c0a48ee

    Download Submit

  • C:\Users\Admin\Desktop\_READ_THI$_FILE_YLGN548F_.jpeg
    Filesize

    150KB

    MD5

    920607e2864a6f66f23c7aa4663740b0

    SHA1

    dbf4b7352bdba8df7c267fe02d11ffd2e62549fd

    SHA256

    acd7846da4bc515aa409a97276b283acc647f13a8684da8f41d9790a164c5a16

    SHA512

    86e2e1ef6725f1f2235bbe8376cfdd0944c2b7b18a8d750eaabce9e99c2ac51d97247f44a51fd5fc51fc816867649d6a12f66d809283344706b29bb3ba0e0d1f

    Download Submit

  • memory/748-104-0x0000000000260000-0x0000000000262000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2136-2-0x0000000001300000-0x000000000138B000-memory.dmp

    Filesize

    556KB

    Download

  • memory/2136-5-0x0000000001300000-0x000000000138B000-memory.dmp

    Filesize

    556KB

    Download

  • memory/2136-0-0x0000000001300000-0x000000000138B000-memory.dmp

    Filesize

    556KB

    Download

  • memory/2720-8-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/2720-100-0x00000000011B0000-0x00000000011C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2720-87-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/2720-79-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/2720-103-0x00000000012E0000-0x00000000012E2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2720-13-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/2720-9-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/2720-122-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/2720-3-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download

  • memory/2720-7-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

    Download