cerber | hxxps://github[.]com/kh4sh3i/Ransomware-Samples

Resubmissions

11-10-2024 08:54

241011-kvcw1svdrd 10

10-10-2024 17:11

241010-vqqx7asdjq 10

Analysis

max time kernel
336s
max time network
330s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2024 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/kh4sh3i/Ransomware-Samples

Score

10^/10

cerber discovery evasion persistence privilege_escalation ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___P0LNA_.txt

Family

cerber

Ransom Note

CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/1A8C-1364-80E6-0446-9304 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/1A8C-1364-80E6-0446-9304 2. http://p27dokhpz2n7nvgr.14ewqv.top/1A8C-1364-80E6-0446-9304 3. http://p27dokhpz2n7nvgr.14vvrc.top/1A8C-1364-80E6-0446-9304 4. http://p27dokhpz2n7nvgr.129p1t.top/1A8C-1364-80E6-0446-9304 5. http://p27dokhpz2n7nvgr.1apgrn.top/1A8C-1364-80E6-0446-9304 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://p27dokhpz2n7nvgr.onion/1A8C-1364-80E6-0446-9304

http://p27dokhpz2n7nvgr.12hygy.top/1A8C-1364-80E6-0446-9304

http://p27dokhpz2n7nvgr.14ewqv.top/1A8C-1364-80E6-0446-9304

http://p27dokhpz2n7nvgr.14vvrc.top/1A8C-1364-80E6-0446-9304

http://p27dokhpz2n7nvgr.129p1t.top/1A8C-1364-80E6-0446-9304

http://p27dokhpz2n7nvgr.1apgrn.top/1A8C-1364-80E6-0446-9304

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___OTVS_.hta

Family

cerber

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>CERBER RANSOMWARE: Instructions</title> <HTA:APPLICATION APPLICATIONNAME="Y3Pb" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style type="text/css"> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 13pt; line-height: 19pt; } body, h1 { margin: 0; padding: 0; } hr { color: #bda; height: 2pt; margin: 1.5%; } h1 { color: #555; font-size: 14pt; } ol { padding-left: 2.5%; } ol li { padding-bottom: 13pt; } small { color: #555; font-size: 11pt; } ul { list-style-type: none; margin: 0; padding: 0; } .button { color: #04a; cursor: pointer; } .button:hover { text-decoration: underline; } .container { background-color: #fff; border: 2pt solid #c7c7c7; margin: 5%; min-width: 850px; padding: 2.5%; } .header { border-bottom: 2pt solid #c7c7c7; margin-bottom: 2.5%; padding-bottom: 2.5%; } .h { display: none; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { background-color: #efe; border: 2pt solid #bda; display: inline-block; padding: 1.5%; text-align: center; } .updating { color: red; display: none; padding-left: 35px; background: url("data:image/gif;base64,R0lGODlhGQAZAKIEAMzMzJmZmTMzM2ZmZgAAAAAAAAAAAAAAACH/C05FVFNDQVBFMi4wAwEAAAAh+QQFAAAEACwAAAAAGQAZAAADVki63P4wSEiZvLXemRf4yhYoQ0l9aMiVLISCDms+L/DIwwnfc+c3qZ9g6Hn5hkhF7YgUKI2dpvNpExJ/WKquSoMCvd9geDeuBpcuGFrcQWep5Df7jU0AACH5BAUAAAQALAoAAQAOABQAAAMwSLDU/iu+Gdl0FbTAqeXg5YCdSJCBuZVqKw5wC8/qHJv2IN+uKvytn9AnFBCHx0cCACH5BAUAAAQALAoABAAOABQAAAMzSLoEzrC5F9Wk9YK6Jv8gEYzgaH4myaVBqYbfIINyHdcDI+wKniu7YG+2CPI4RgFI+EkAACH5BAUAAAQALAQACgAUAA4AAAMzSLrcBNDJBeuUNd6WwXbWtwnkFZwMqUpnu6il06IKLChDrsxBGufAHW0C1IlwxeMieEkAACH5BAUAAAQALAEACgAUAA4AAAM0SLLU/lAtFquctk6aIe5gGA1kBpwPqVZn66hl1KINPDRB3sxAGufAHc0C1IkIxcARZ4QkAAAh+QQFAAAEACwBAAQADgAUAAADMUhK0vurSfiko8oKHC//yyCCYvmVI4cOZAq+UCCDcv3VM4cHCuDHOZ/wI/xxigDQMAEAIfkEBQAABAAsAQABAA4AFAAAAzNIuizOkLgZ13xraHVF1puEKWBYlUP1pWrLBLALz+0cq3Yg324PAUAXcNgaBlVGgPAISQAAIfkEBQAABAAsAQABABQADgAAAzRIujzOMBJHpaXPksAVHoogMlzpZWK6lF2UjgobSK9AtjSs7QTg8xCfELgQ/og9I1IxXCYAADs=") left no-repeat; } #change_language { float: right; } #change_language, #texts div { display: none; } </style> </head> <body> <div class="container"> <div class="header"> <a id="change_language" href="#" onclick="return changeLanguage1();" title="English">☑ English</a> <h1>CERBER RANSOMWARE</h1> Instructions </div> <div id="languages"> ☑ Select your language <ul> <li><a href="#" title="English" onclick="return sh_bl('en');">English</a></li> <li><a href="#" title="Arabic" onclick="return sh_bl('ar');">العربية</a></li> <li><a href="#" title="Chinese" onclick="return sh_bl('zh');">中文</a></li> <li><a href="#" title="Dutch" onclick="return sh_bl('nl');">Nederlands</a></li> <li><a href="#" title="French" onclick="return sh_bl('fr');">Français</a></li> <li><a href="#" title="German" onclick="return sh_bl('de');">Deutsch</a></li> <li><a href="#" title="Italian" onclick="return sh_bl('it');">Italiano</a></li> <li><a href="#" title="Japanese" onclick="return sh_bl('ja');">日本語</a></li> <li><a href="#" title="Korean" onclick="return sh_bl('ko');">한국어</a></li> <li><a href="#" title="Polish" onclick="return sh_bl('pl');">Polski</a></li> <li><a href="#" title="Portuguese" onclick="return sh_bl('pt');">Português</a></li> <li><a href="#" title="Spanish" onclick="return sh_bl('es');">Español</a></li> <li><a href="#" title="Turkish" onclick="return sh_bl('tr');">Türkçe</a></li> </ul> </div> <div id="texts"> <div id="en"> Can't yosVFmpCu find the necessary files? Is the cbgontent of your files not readable? It is normal beZCd43cFJ7Bcause the files' names and the data in your files have been encrypVYJ8Dv8HGZted by "CeJZrQqQLN1rber Ransomware". It mebr82hZyiChans your files are NOT damageQEC3EC67d! Your files are modified only. This modification is reversible. Fj78ViQK66trom now it is not possF5ugEjOmXLible to use your files until they will be decrypted. The only way to deco9vrypt your files safely is to buy the special decryption software "Caogrerber Decryptor". Any attempts to resttSore your files with the thir2d-party software will be fatal for your files! <hr> You can procA7P6lyJUsTeed with purchasing of the decryption softwYare at your personal page: PleGjNI7E89Quase wait...<a class="url" href="http://p27dokhpz2n7nvgr.12hygy.top/1A8C-1364-80E6-0446-9304" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/1A8C-1364-80E6-0446-9304</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/1A8C-1364-80E6-0446-9304" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/1A8C-1364-80E6-0446-9304</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/1A8C-1364-80E6-0446-9304" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/1A8C-1364-80E6-0446-9304</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/1A8C-1364-80E6-0446-9304" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/1A8C-1364-80E6-0446-9304</a><hr><a href="http://p27dokhpz2n7nvgr.1apgrn.top/1A8C-1364-80E6-0446-9304" target="_blank">http://p27dokhpz2n7nvgr.1apgrn.top/1A8C-1364-80E6-0446-9304</a> If t1Uucahis page cannot be opened  clinhjGlsck here  to get a new addrtess of your personal page. If the addreZasess of your personal page is the same as befoTre after you tried to get a new one, you c0auUQRan try to get a new address in one hour. At thyZ9is page you will receive the complete instrpU3WtwuDZBuctions how to buy the decryptiKqGeMdon software for restoring all your files. Also at this page you will be able to res7xctore any one file for free to be sure "CerbeWuWeZrr Decryptor" will help you. <hr> If your perjEDDEsonal page is not availabwJble for a long period there is another way to open your personal page - instaJwYw2llation and use of Tor Browser: <ol> <li>run your InteklikO7qYUrnet browser (if you do not know what it is run the Internet Explorer);</li> <li>entgINer or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loadWBDQing;</li> <li>on the site you will be offered to doGUo2ULcwnload Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>ruKr7AiFIo5n Tor Browser;</li> <li>connect with the buttUWQyiBE2on "Connect" (if you use the English version);</li> <li>a normal Internet broqwser window will be opened after the initialization;</li> <li>type or copy the addsress http://p27dokhpz2n7nvgr.onion/1A8C-1364-80E6-0446-9304 in this browser address bar;</li> <li>preuiE6hEss ENTER;</li> <li>the site shoBSd95ztzuld be loaded; if for some reason the site is not loHxz7ading wait for a moment and try again.</li> </ol> If you have any prb0NaGNaoblems during installation or use of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> and type request in the searcj0Rbrh bar "Install Tor Browser Windows" and you will find a lot of training videos about Tor Browser installation and use. <hr> Addit3GiyCOional information: You will fi6znd the instru4xjqUchwSzctions ("*_READ_THIS_FILE_*.hta") for re70FUawstoring your files in any foauf7Pngsolder with your encG6rypted files. The instrPeKkWZtMuctions "*_READ_THIS_FILE_*.hta" in the fPgolderRus with your encryVNmR0bNXkapted files are not virbNh3kjUuses! The instrucg6E2eAtions "*_READ_THIS_FILE_*.hta" will heVBlzDklp you to decRrypt your files. Remembe6r6r! The worst sintuation already happA0tqqDxrw2ened and now the future of your files debEBDNpends on your determMqtlination and speed of your actions. </div> <div id="ar" style="direction: rtl;"> لا يمكنك العثور على الملفات الضرورية؟ هل محتوى الملفات غير قابل للقراءة؟ هذا أمر طبيعي لأن أسماء الملفات والبيانات في الملفات قد تم تشفيرها بواسطة "Cerber Ransomware". وهذا يعني أن الملفات الخاصة بك ليست تالفة! فقد تم تعديل ملفاتك فقط. ويمكن التراجع عن هذا. ومن الآن فإنه لا يكن استخدام الملفات الخاصة بك حتى يتم فك تشفيرها. الطريقة الوحيدة لفك تشفير ملفاتك بأمان هو أن تشتري برنامج فك التشفير المتخصص "Cerber Decryptor". إن أية محاولات لاستعادة الملفات الخاصة بك بواسطة برامج من طرف ثالث سوف تكون مدمرة لملفاتك! <hr> يمكنك الشروع في شراء برنامج فك التشفير من صفحتك الشخصية: أرجو الإنتظار...<a class="url" href="http://p27dokhpz2n7nvgr.12hygy.top/1A8C-1364-80E6-0446-9304" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/1A8C-1364-80E6-0446-9304</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/1A8C-1364-80E6-0446-9304" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/1A8C-1364-80E6-0446-9304</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/1A8C-1364-80E6-0446-9304" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/1A8C-1364-80E6-0446-9304</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/1A8C-1364-80E6-0446-9304" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/1A8C-1364-80E6-0446-9304</a><hr><a href="http://p27dokhpz2n7nvgr.1apgrn.top/1A8C-1364-80E6-0446-9304" target="_blank">http://p27dokhpz2n7nvgr.1apgrn.top/1A8C-1364-80E6-0446-9304</a> في حالة تعذر فتح هذه الصفحة  انقر هنا  لإنشاء عنوان جديد لصفحتك الشخصية. في هذه الصفحة سوف تتلقى تعليمات كاملة حول كيفية شراء برنامج فك التشفير لاستعادة جميع الملفات الخاصة بك. في هذه الصفحة أيضًا سوف تتمكن من استعادة ملف واحد بشكل مجاني للتأكد من أن "Cerber Decryptor" سوف يساعدك. <hr> إذا كانت صفحتك الشخصية غير متاحة لفترة طويلة فإن ثمّة طريقة أخرى لفتح صفحتك الشخصية - تحميل واستخدام متصفح Tor: <ol> <li>قم بتشغيل متصفح الإنترنت الخاص بك (إذا كنت لا تعرف ما هو قم بتشغيل إنترنت إكسبلورر);</li> <li>قم بكتابة أو نسخ العنوان <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> إلى شريط العنوان في المستعرض الخاص بك ثم اضغط ENTER;</li> <li>انتظر لتحميل الموقع;</li> <li>سوف يعرض عليك الموقع تحميل متصفح Tor. قم بتحميله وتشغيله، واتبع تعليمات التثبيت، وانتظر حتى اكتمال التثبيت;</li> <li>قم بتشغيل متصفح Tor;</li> <li>اضغط على الزر "Connect" (إذا كنت تستخدم النسخة الإنجليزية);</li> <li>سوف تُفتح نافذة متصفح الإنترنت العادي بعد البدء;</li> <li>قم بكتابة أو نسخ العنوان http://p27dokhpz2n7nvgr.onion/1A8C-1364-80E6-0446-9304 في شريط العنوان في المتصفح;</li> <li>اضغط ENTER;</li> <li>يجب أن يتم تحميل الموقع؛ إذا لم يتم تحميل الموقع لأي سبب، انتظر للحظة وحاول مرة أخرى.</li> </ol> إذا كان لديك أية مشكلات أثناء عملية التثبيت أو استخدام متصفح Tor، يُرجى زيارة <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> واكتب الطلب "install tor browser windows" أو "تثبيت نوافذ متصفح Tor" في شريط البحث، وسوف تجد الكثير من أشرطة الفيديو للتدريب حول تثبيت متصفح Tor واستخدامه. <hr> معلومات إضfSGeافية: سHdV8rBvntnوف تجد إرشادات استعادة الملفات الخاصة بك ("*_READ_THIS_FILE_*") في أي مجلد مع ملفاتك المشفرة. الإرش8BaT4Piادات ("*_READ_THIS_FILE_*") الموجودة في المجلدات مع ملفاتك المشفرة ليست فيروسات والإرشادات ("*_READ_THIS_FILE_*") سوف تساعدك على فك تشفير الملفات الخاصة بك. تذكر أن أسوأ مو3du2APMDقف قد حدث بالفعل، والآن مستقبل ملفاتك يعتمد على عزيمتك وسرعة الإجراءات الخاصة بك. </div> <div id="zh"> 您找不到所需的文件？ 您文件的内容无法阅读？ 这是正常的，因为您文件的文件名和数据已经被“Cerber Ransomware”加密了。 这意味着您的文件并没有损坏！您的文件只是被修改

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Contacts a large (1115) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4100	netsh.exe
1472	netsh.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rTErod.url	Ransomware.Unnamed_0.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\	cerber.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rTErod.url	Ransomware.Unnamed_0.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
27	raw.githubusercontent.com
28	raw.githubusercontent.com
54	raw.githubusercontent.com

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\documents	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\desktop	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat!	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat!	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam	cerber.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpFBD6.bmp"	cerber.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3700 set thread context of 4156	3700	Ransomware.Unnamed_0.exe	123
PID 3628 set thread context of 2700	3628	Ransomware.Unnamed_0.exe	139

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\microsoft\excel	cerber.exe
File opened for modification	\??\c:\program files (x86)\office	cerber.exe
File opened for modification	\??\c:\program files (x86)\onenote	cerber.exe
File opened for modification	\??\c:\program files (x86)\word	cerber.exe
File opened for modification	\??\c:\program files\	cerber.exe
File opened for modification	\??\c:\program files (x86)\	cerber.exe
File opened for modification	\??\c:\program files (x86)\bitcoin	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\program files (x86)\the bat!	cerber.exe
File opened for modification	\??\c:\program files (x86)\thunderbird	cerber.exe
File opened for modification	\??\c:\program files (x86)\excel	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft sql server	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\program files (x86)\powerpoint	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\office	cerber.exe
File opened for modification	\??\c:\program files (x86)\microsoft\word	cerber.exe
File opened for modification	\??\c:\program files (x86)\outlook	cerber.exe
File opened for modification	\??\c:\program files (x86)\steam	cerber.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\steam	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat!	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\documents	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\desktop	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat!	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\desktop	cerber.exe
File opened for modification	C:\Windows\SysWOW64	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\steam	cerber.exe
File opened for modification	\??\c:\windows\	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server	cerber.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ransomware.Unnamed_0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ransomware.Unnamed_0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cerber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2716	PING.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Kills process with taskkill 1 IoCs

evasion

pid	Process
3968	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	cerber.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3464	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2716	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4964	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
548	msedge.exe
548	msedge.exe
4212	identity_helper.exe
4212	identity_helper.exe
3708	msedge.exe
3708	msedge.exe
2144	msedge.exe
2144	msedge.exe
3700	Ransomware.Unnamed_0.exe
3700	Ransomware.Unnamed_0.exe
3700	Ransomware.Unnamed_0.exe
4156	vbc.exe
4156	vbc.exe
4156	vbc.exe
4156	vbc.exe
3628	Ransomware.Unnamed_0.exe
3628	Ransomware.Unnamed_0.exe
3628	Ransomware.Unnamed_0.exe
2700	vbc.exe
2700	vbc.exe
2700	vbc.exe
2700	vbc.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	3700	Ransomware.Unnamed_0.exe
Token: SeDebugPrivilege	4156	vbc.exe
Token: SeDebugPrivilege	3628	Ransomware.Unnamed_0.exe
Token: SeDebugPrivilege	2700	vbc.exe
Token: SeRestorePrivilege	2908	7zG.exe
Token: 35	2908	7zG.exe
Token: SeSecurityPrivilege	2908	7zG.exe
Token: SeSecurityPrivilege	2908	7zG.exe
Token: SeShutdownPrivilege	3248	cerber.exe
Token: SeCreatePagefilePrivilege	3248	cerber.exe
Token: SeDebugPrivilege	3968	taskkill.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
2908	7zG.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
3464	NOTEPAD.EXE

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE
4964	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 4928	548	msedge.exe	83
PID 548 wrote to memory of 4928	548	msedge.exe	83
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 2284	548	msedge.exe	84
PID 548 wrote to memory of 5092	548	msedge.exe	85
PID 548 wrote to memory of 5092	548	msedge.exe	85
PID 548 wrote to memory of 1540	548	msedge.exe	86
PID 548 wrote to memory of 1540	548	msedge.exe	86
PID 548 wrote to memory of 1540	548	msedge.exe	86
PID 548 wrote to memory of 1540	548	msedge.exe	86
PID 548 wrote to memory of 1540	548	msedge.exe	86
PID 548 wrote to memory of 1540	548	msedge.exe	86
PID 548 wrote to memory of 1540	548	msedge.exe	86
PID 548 wrote to memory of 1540	548	msedge.exe	86
PID 548 wrote to memory of 1540	548	msedge.exe	86
PID 548 wrote to memory of 1540	548	msedge.exe	86
PID 548 wrote to memory of 1540	548	msedge.exe	86
PID 548 wrote to memory of 1540	548	msedge.exe	86
PID 548 wrote to memory of 1540	548	msedge.exe	86
PID 548 wrote to memory of 1540	548	msedge.exe	86
PID 548 wrote to memory of 1540	548	msedge.exe	86
PID 548 wrote to memory of 1540	548	msedge.exe	86
PID 548 wrote to memory of 1540	548	msedge.exe	86
PID 548 wrote to memory of 1540	548	msedge.exe	86
PID 548 wrote to memory of 1540	548	msedge.exe	86
PID 548 wrote to memory of 1540	548	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/kh4sh3i/Ransomware-Samples
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec77846f8,0x7ffec7784708,0x7ffec7784718
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1436 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2604 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,15475808667571691801,10970677632105378363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1236

C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Unnamed_0.zip\Ransomware.Unnamed_0.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Unnamed_0.zip\Ransomware.Unnamed_0.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kfp453ux\kfp453ux.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1780
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE1D.tmp" "c:\Users\Admin\AppData\Local\Temp\kfp453ux\CSC77CFAABBC98E47C8923FA7929FFF5D.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1240
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4156
- - C:\Windows\notepad.exe
    "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
    3⤵
    PID:2144

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\RepairDismount.xla"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4964

C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Unnamed_0.zip\Ransomware.Unnamed_0.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Unnamed_0.zip\Ransomware.Unnamed_0.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\enbfgdn5\enbfgdn5.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2172
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES648C.tmp" "c:\Users\Admin\AppData\Local\Temp\enbfgdn5\CSCC3BD6191ADEE4BA3A21385ABBC44E1C5.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:504
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- - C:\Windows\notepad.exe
    "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
    3⤵
    PID:3956

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap6940:200:7zEvent19567
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2908

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528884
  2⤵
  PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec77846f8,0x7ffec7784708,0x7ffec7784718
    3⤵
    PID:4668

C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Cerber.zip\cerber.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Cerber.zip\cerber.exe"
1⤵
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3248
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4100
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1472
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___NRXWTF_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1604
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___NZNU3G1L_.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  - Suspicious use of FindShellTrayWindow
  PID:3464
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im "cerber.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3968
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg

Filesize
489B

MD5
560e63ad721ff461b61a43cfc54ef909

SHA1
9829fdeea6877667280bbcc9f9a8252d6338fddb

SHA256
0c5fc323873fbe693c1ff860282f035ad447050f8ec37ff2e662d087a949dfc9

SHA512
d2bfd22ec8c2ec9e69d0954ba241999e8e58e3be2abc5601e630593462c31c1a3cb628c45b0fe480ab97e0e06b4572980a7ea979c33d56a5ce1c176842cb7fb6

Download Submit
C:\Users\Admin\AppData\Local\JesYXqkYNx\cfgi

Filesize
489B

MD5
e00a3c7526b6953ebd8aae3a22d9a6f8

SHA1
61252c6ab7b0b5580538f3999a650c07db6581d0

SHA256
ec7e7fbb31e509612cdc456346c7e02ae07b8a5018c0f6309b494b05437ce1ff

SHA512
8afdd52415d94e1249ff2639eec240a87c29bef08a9ae93e71503315060ae46ed3f4c2ab8598d1dac0b54d7b103b52d3ad361913e99d9945ea04b977f0d290f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Ransomware.Unnamed_0.exe.log

Filesize
412B

MD5
3d2efb8ce05124fd69b2bf2beffe5980

SHA1
04d6f17256b3a923bd7d9abb14e3c7289976a918

SHA256
924a09842733197c09594e32578bbcc9c001a051812350676c4d6e1b6b78ff76

SHA512
0871c2c16fbbdb0b9bc317049996a76a646c05d38e602b4fbf6c3369c04d2f3fb34201ae45bececfce942314d81f3790b46f67b06928c9fb120c7cb53d47e566

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
8e47c7b660978eb9b4bf21ef92037988

SHA1
d95844f12aa80fb50e1dd4dc9206bb9b91dcd0a7

SHA256
413e065bcc1bb6a04d30758da0293a4632fc9d21b48be75804d6f4becfac8102

SHA512
5b5733104f2aa3f5330279cbcb4aeed6654ed3629d29360a9dcf17b53500efb7253b1d644db64a645725aea3a8a7b219bce8a3d3609d38ef23f2a305fd92fd07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2f136bd94084974202990a41e2db36af

SHA1
73a32d34c8f62499022663a7aad14010c7ff03a0

SHA256
ace191544988c66eca28a6ebca85e055b6c32ad558acf60682383f8aa95b84ac

SHA512
225c05903c957bd891f346cc0327032469376b33107290498cf21fbd954947a6e360d05b4d18a960ae272c21a09f6a990c12e235e9d81bb90825f941e672f5e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
c58c92892dd43556653431b305191d3d

SHA1
d6182d101a3b03885d9cdec6265d0f7603e25729

SHA256
661bf4df85edf568dbfe6c5242ef027dfed5db48195a1d612173ed049fd131fa

SHA512
cb69a0a82dcf62fe8ed767d92a64aa815214e27601ff71decf5fe8a9a83869b65c5144309b0cc02bc9956b0a824c88947254c7b9c24bc5e1a98232f15297ff58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
786B

MD5
c1ffdd48e8644fb2acaf6e05bd5046bb

SHA1
c7fd4e58c2e0e482942fb521c6dc868d0a3db90c

SHA256
57df413d4881a98adbcc8da1551f7f348ad92c95e67c913612b6d2b147635f9e

SHA512
6430746fcbfad1cdf7e1f457be8e1d79a884eac875d8268d5f9113f6a2b69e390931b9fab28877ba3e86d87776b31ad1521fc15742ee8063c83aca75ae27243e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
a7d1701142cca705f833d70023ef4e1e

SHA1
1b76853132abfcddb4fefac42bf9df5d013c9815

SHA256
6c92f51e7f056e73c407228fc280cb7ca4d00ab02674d1dda4eafd7dc9f070f7

SHA512
806b7ccb375cc6116e64a9fa15229d783615d13b54cf40251561d9b664f0925915c5375ad88f5ca8d061e01367de239c29da79adf693559af53eeb7d9b1ba1a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ed99f9b494494eab680bbd095cf609d

SHA1
3a64acdaddf3eeb51f1a9356c1026624ecbc55f1

SHA256
da92db2c523dc95b4602a7814b8abd2d9ef608daecdecd321571d07cf80b1fba

SHA512
93d372d1b4e634825832827d251c5b833d9ad1738527d8450b34d68cc7d6db0ee9fcabf918729d439dd8b6ced80022e88c61147bf183b14131f408c2a39e5386

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
314b249ff4b894d2b664afa4de8bc4fc

SHA1
b48d122ac6601b2490171c394d02a68ac11e4420

SHA256
60eb21c72533c3ec409d6aa1d92d39b71f5de0e4db7bbe6b19239e06cc673dc7

SHA512
e796a00c779b5b0aedd597624ea40c7be4ab63bce6445935fc89ba4befddf10cea741c70ba9117bf6c32d46189623463b04be9d5ef7592f292de0fdba4b0e0d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
553f520410a8ae3714b58c566ed9878b

SHA1
7d135aceb97205ec6ae58b1db129d1ddf1225bd2

SHA256
7f9670069425dfb8a713bc9f54d8e435c7b35adb9fe6adc437ae297a0da7a76e

SHA512
d8aad7a6a1daa66d68d9a5bfcf65ec33c36032c47e9602cc76ec982dcde7893f64ba6acdf41458e9d7c9de2b0e7989ac55a0b8196b381158611c4cff9297f635

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
69fd9c6b480934669a0b5eb02f84cca5

SHA1
f9f1c15475db961cb40f2fc5b80eee78f2e34c06

SHA256
39d8422f9067e94a55a2abdfffd6734a841a97541888630ea563e7b071b363f3

SHA512
3d4a3e6adb9b2384898c92c7d46cc0bade1ea51116b3fe4b2bdcc8d7c95c8e5e83bd967adbe60a2bf023c383fcdeeba33b88e284295d084ce559e6f6b3135dd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd752823c1c2c87d9d8aacb79e264c38

SHA1
dd12e461e6d275d560b875f458ca6a8f6e352e72

SHA256
ccbd449e44f563139ab9b02d1a12f44737bdcd7f09de911b27482fba554b9ce9

SHA512
264980615bca73a5f9b203baca6d81284896258919a4bbb6c448b699e1746962f37b044201721275c51bff0d0f9c252c5a443e3e2150cefb53319d6d9745f5f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
98ab2d1386afda3cfec33c1d4d75246e

SHA1
abaaed9894f8ac63046d12b202e26db5d4881c17

SHA256
f6382774fb64ab687b01131ba1cd8126154df6a0a6c646e054ac0b5b3a2919ee

SHA512
d7438d59481034ff5044cab97786ae54c16ca7554160b4d342ed1fff15e537bf86a34591b8de9913bd092223e361221018383e3ae7dbd75984f991e6812d2e60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1451e41f8e185d4b9eddc146353b97ac

SHA1
9ba24dfd1df12c6e4831f121853769c3d90cf86f

SHA256
b8516e7bd57fdecdc55362a3244bfdfc084bf6b5afd81339638914943139ae98

SHA512
ae8a10d22f3f16fc494fe729a380c85b4d2feee52f7b13d6370f2283fd4d4273919c046996a310ced91f4025151482f868a162d716220994d678447c6c2f0fab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f92258234ddbe66e3a25fdd7b5f17ae9

SHA1
6d56f99299d0d1d3f15b28277e4a7b57696e777d

SHA256
cc352b82944a3fdf057a3cf142bccf4692c4bcbb18b39fc591ecdf576e5a0240

SHA512
bbccaf5102969b1386841f0626cec1b83b67cd4cd4f96c01b2b920597b4196282b34dc515a84e0659f2dc79ccd866398190a50e4243d716a28204e6916468e88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3758f4b13cc6806f95be66dcf2bf5128

SHA1
3c6f8f37f02c7aa3bfc39b102496f7a33520ec65

SHA256
cc09b441b3d0a55211a9d7ebcdbb3faa278854d6f0ee25dce0d399f3e6fb82b8

SHA512
3519a40714e6dae35a1f0263cf7c89237ecbcd3920331b876a849f1d70f79d704c5865c036a87e07e5098cef9719c392ab74dd6974793139348519d316f445ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1a30a9ebe0bd5992933401ed0e36f9a0

SHA1
6184189cc28e31552cfadf51ea9434d5c663d466

SHA256
fb2d4dda157b5569240da75380197f648c429feeb7aafd3303929dbf4de039bb

SHA512
3f2a9b08555a7a93af1779ecd6c3e55783305fb68b6a24b338f5b751ad6853a6f70c094a11c1f875c51bc2e3b09cde4720b775c6adff052b98e8c40f646bd1d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c19e4ecdb5ccae21c95c8899e36485d9

SHA1
dc49a6771cf6ce135a9af80d6a104097082a089e

SHA256
882c0db6aed945fc0019ea6b8b3738095c8877888d723bb3e03375e776350ce0

SHA512
0e0bd2db3bb9ac807e54d882701a1ef5271fe918c5281dd43451bf67aec799457c4fec8cf362f2f0756c76b3e2373992222ea75dbc65f02ee77e75e83cd5e50d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0a9f3994fcc48e849b3b4cd72c0bbe36

SHA1
0c8fb09061cec50a6e45b1af34a156abff8203ff

SHA256
3db309caba97f5abeaf16f9869703f5cdf48088ddbed39074f3da0aec2eec278

SHA512
4b4081f98a9e06b5d64269350005f6c00f8dde9ba1f6cf7327f402e9e1fc9351cd1961433c08a7fe7b7925ec9bc1f935c7ecce6a7a4d312fc549384ea5e7d5ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1194a5661ea58af74df9b5ca4d21c555

SHA1
09c09a355a0f337c33423a0d1d62dbf19c5ad201

SHA256
74490fde506b4b4f910d5586a3cfd9641a8d6a2458ebeb7ec1671162dd91bacc

SHA512
113f0647ab25a1ecd9d246a420fad18dfc7f0fa6582612a5222138b249e066750fb669820c4f282e35fe0723d998734d8c48ea11d22c5fdae8fb4cebaed40eef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dd9376e96fc660cda43f90ef4e571d26

SHA1
fbdfd07b0625b6798b9accd61d5c4d7af6d633a7

SHA256
65112d9eede67365e2b5878823b4368edc4d4bed7b5cc4a323ee0280725e9c73

SHA512
1f9ef98d72a9f0a4cf713fe74dc6ce0c13965289557e4d1f564764b0add616a6d4e84a96cbb785cb1b091a8cd5bc6e47d2ab066b7a8c55d88fd5ea2d713241f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580c30.TMP

Filesize
1KB

MD5
da3212c3145aea6957eab5907547f18e

SHA1
3c9c41c8d860a21fd0339fb1a576f5d84a654b0b

SHA256
309f9aadc8146aac568a0f03e2fa1f4f58df222d6ec61ff8444a043b0842af41

SHA512
71c2cc45475e84858380841237d23a0a8638da70b393e3554d011d9c39f98fe4d68199c4702673d64724c373375a6d0bc999e261e9ce57a45fcf11b124dfecb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c4ed92e794b309d1707821640735c4f7

SHA1
a17560b7acd9b5b4d6dab1dbfa875184156552b0

SHA256
d172a220b522c7896dde0bf620f1d53dcb247f3ceaabfa8c3792e94cf2e866a5

SHA512
6d0afd544621ddc37f62301305b0fff35ba1b902cf7efdb8349a89f95f63dacb9203e121dd5619c08a5c57d5f643e6df2b56c6e8a5efab8e4691e0a92fe26a9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4c22e1a3d8540e0a1293acc84d098ddb

SHA1
d3421f9dd5e119107b3621e0ccdba210e4878819

SHA256
1e747df35285b47aea0b6f4ab81c78d3abeca7f74d04f53a9a4eb5b5b6a61ca3

SHA512
0f43a7f8b10c88c27fc56f802172e46d23c0f72db42e329f45f59726ccf7de1492e9b860bce91ed2958769616e26b3a91cb8f8a2d23b45a7b8f3d452b1bcbe11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
37edac38d0e61901aa524b06d8413610

SHA1
d526b444895d0da81daa332f7e28787a7a300c4f

SHA256
2ab4f9a74b4f811223ec87760d401fed267bada3f83a31ca69ff5347e3a30b1b

SHA512
425cb0bd045abad9dc31bb2be778f13d48a379e436068a18c1c402b94d0e61793579f68870cb1c0bdd55216f52124c0ce49eceebc1b4be0f71bfe8ef52b116d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6a6961d9ffe1c0832160c0312dc0c09c

SHA1
ce6430616500c1ba9ea41029f34cf4dc9cc70a8b

SHA256
d2e43a6dbe21198d79432a9a27e24f88874375599051cb6eca07894adc57f6ff

SHA512
9474b278d4e26b7ae2cfb52a4e648809edc000397df3141cfb8031f3ff00144ee7c390b40c7b95cdb6dc60c74ecefa82faa4552658f73205fb307743d8130a8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___P0LNA_.txt

Filesize
1KB

MD5
ab516b0334accd613f7525120a3dcd22

SHA1
f8383bbf41a2461c2ba23143fdc4a0d7a94351f7

SHA256
eed4d415808aaa1b38187c67d88339cab8eb408e841d88b431949f4dc7f21272

SHA512
233757e7690cc1f61d22668c21dfb2119ffcd14cb6cefa642b6c280b2de76080f9fb707578ecdede47de1b9b530f81633fade3f65b79a687b015ec4c87268a84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
32629beea6eae79f8c8521777f27fab6

SHA1
af603c68c9ed09be80c8300b6c867f45a9e2d2f2

SHA256
188638630a88fbc28633d1604b0d3f96bd6d06da14a0d7e5b6961a40564e02d9

SHA512
c81a8a217542c22d66d47bd67c68b6dc2a809046ef8a59ec693cc7700c454c831f6b49a8eefb21e9007c67ad39a994c5060ebd892493790c2b00dbed6b354cba

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES648C.tmp

Filesize
1KB

MD5
f60127c08b49f85be015948ed3f7f918

SHA1
e20c92d10f075694f4359e8a7c51ee2537b21853

SHA256
a2afe43f2bcf523c88cad2c81c9c6e557ba567d3bd51855802658334048c83aa

SHA512
6feb18d29745f03aefaada1784a421e4c1095860a99f2a478a10f078bf0914d328fc467f8dbb9f5b8dac147b8770bd3c12a9d9e50060a64620c7906addcf0274

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESAE1D.tmp

Filesize
1KB

MD5
ed924b7a1df2b8ae429aab18752ff048

SHA1
6d1911604a0cfa97b54221951294c7137d991347

SHA256
f5f9c2b7a894f98bd474f85f94267c4e34cb243509a02e5aad87bb391b80c536

SHA512
04dd735ed604ecaff8699cd20658f4eac63adeff0d96075cef42015e87d8d7a92a62f19b1607895abb2effe68e46b8c908c848f9539e7e62866afdcfbc05da60

Download Submit
C:\Users\Admin\AppData\Local\Temp\enbfgdn5\enbfgdn5.dll

Filesize
15KB

MD5
6b281eb091514dacc86f179efa33dd66

SHA1
3f140aa8d4dd8d97684453b3db239a9ff142b93e

SHA256
e2ce82ece2bce184a657f73a5d3955415e5b458e613030b0fcad9f8131999602

SHA512
79b61e2ed3db561845455897ecf887187621ddd3b8ccfc888ca9469f18ca8f72c8ad3a152c4ba6c29fb42ae21da75c0670ea76e29dcfaed30bd5f3364052c309

Download Submit
C:\Users\Admin\AppData\Local\Temp\enbfgdn5\enbfgdn5.pdb

Filesize
49KB

MD5
98068b1071cad59896412b4fcd7d48be

SHA1
2cb3a1d9583bcda46f29069e3174da615f918cc3

SHA256
a8a65f8e9f142c25a79708e826eff32aa216dc9e0fb9640e3fb375ffb067567c

SHA512
66ba76ba3b8a83958cd04fb681df011b1ca09821765f2d7ce9702b45add85f458f7bb02e4eb625ec913d45821d39a7bc7db2c3ee4e52e633917b4536eaa0d622

Download Submit
C:\Users\Admin\AppData\Local\Temp\kfp453ux\kfp453ux.dll

Filesize
15KB

MD5
977bb947b129228717131b6ebbe71fbe

SHA1
191ab6937278d7097364f6e0f9ef48ddfcabf946

SHA256
8b35c953c065573d52866cfc0872239305279a6d09582415eb1108da584ed457

SHA512
4f0b6a011a366fcf23153f328ad86548fa12feca7815fc22d62d568bd9a3eded0946ee3f312ba0b8b14c62e5b96c1dfd856b745e0730cc341527b08b64f99287

Download Submit
C:\Users\Admin\AppData\Local\Temp\kfp453ux\kfp453ux.pdb

Filesize
49KB

MD5
6be1b81c50c12ba21ca6ad76d8df2734

SHA1
ba0736e3faddce7ce801a817c37b038c54d923a3

SHA256
ed76e01b84fe51624a4c8606df2e421ae50281ff72dce98f579645ebbd98e92d

SHA512
b433f8f6d4b41f7de3de92821dbe286e4c6a661db9e07f901a42a4d72c478c4bbf644047407d4c80fddad9831baae0ca081690cac5b6f219ccc774490c0bcbf4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
402B

MD5
9f2e19f49cd1dfafa191986f09d7f85a

SHA1
6ad167734bb677701040221effa4108da52a69a3

SHA256
edab1b37af0163c69efc229fd4720cc126ee02ec8be77762be40368cb4c51058

SHA512
822dbf66e9184ac649b8e019cfcfe7707acc49fe760f4d409df72056763d19a83b14284b40b4a3f23006a524d53446c86e33886337ac1e267c85ba39c48d9a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___OTVS_.hta

Filesize
75KB

MD5
9b13797fb2e8820cdd9c37b9923f526b

SHA1
771634ceb7a9ad3e2a47e39830b5ffe278e642fe

SHA256
7fa6fec072c75fad4b157c452aafdf1eff92a08e5ece572b59b2e976a290bba7

SHA512
6b8d078644ce796d350adc3a1e976219a6357ada6bac2a38e9f239a67bcaac5eea441f5c8f312461437caeefebd73a9040abd865242c3dac807288f215fbc267

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rTErod.url

Filesize
73B

MD5
9603b6e118964288bcb3dfe2c5609dde

SHA1
204f614dc5fbd692b55ec8056cd4d063d96f38ae

SHA256
11bbb92e7c2aff55aa4d1a6cff600fd1fd3d8ee4219b689a4f7c24de75a70f01

SHA512
fd1b6d4995c99831d7a90954c0593788c073fd5490adf86d0f13edb4fa9cfb6bc4aa425f37aa7d59e93c2b3de655887af098fc70d7b4387f7548e77d5467ee2b

Download Submit
C:\Users\Admin\Downloads\Ransomware.Cerber.zip

Filesize
215KB

MD5
5c571c69dd75c30f95fe280ca6c624e9

SHA1
b0610fc5d35478c4b95c450b66d2305155776b56

SHA256
416774bf62d9612d11d561d7e13203a3cbc352382a8e382ade3332e3077e096c

SHA512
8e7b9a4a514506d9b8e0f50cc521f82b5816d4d9c27da65e4245e925ec74ac8f93f8fe006acbab5fcfd4970573b11d7ea049cc79fb14ad12a3ab6383a1c200b2

Download Submit
C:\Users\Admin\Downloads\Ransomware.Unnamed_0.zip

Filesize
835KB

MD5
abc651b27b067fb13cb11e00d33e5226

SHA1
1869459025fcf845b90912236af43a5d8d0f14dd

SHA256
690339e6d19da0b5c63406d68484a4984736f6c7159235afd9eeb2ae00cafc36

SHA512
4b85ae9001b9d1f11d57b6b2565ab0d468c3b8be469cad231e1203c4f6858af98d8e739b03fb849c2f3ec7b493781e88d32e7b7567c4b61cc1189daeea285bbf

Download Submit
C:\Users\Admin\Downloads\Ransomware.Vipasana.zip

Filesize
638KB

MD5
8d2c4c192772985776bacfd77f7bc4d9

SHA1
3b923b911d443e321e551f26c9588b16a994d52e

SHA256
1733b199a7063443c167e3caeae7dda2315f590341ea2152a9b132e1ad8e94a8

SHA512
6c24f2fe498cf38e3f3d66b62915e6fbc8c2746a1d4c3c3de270f994b02e1369b9540099c12d150712574ececbe63c8c9f28877d8aa4557fbbb7890d5a0de6c1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\enbfgdn5\CSCC3BD6191ADEE4BA3A21385ABBC44E1C5.TMP

Filesize
1KB

MD5
54da4b82952ec6b52ad60a29c3a28a05

SHA1
1751823e63fedb29441fa5d15bc5dfc0f707dd47

SHA256
b442ee16d38df2a4615a9f5139e0848b41d2e54f7a5eb94a9e29fc8715b4d36a

SHA512
d4092ec81e0b8f1aa6f6d45b9edcad7b295bc6335f73e9069be36714bd2e1dc4da9c7a89ad0fca6d8f461320a1195a8740b1f4887caaa51834c0c78c8548e753

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\enbfgdn5\enbfgdn5.cmdline

Filesize
248B

MD5
42c9d8c917c9cbe7aee89598fffb7f94

SHA1
60156b65dc6240ea1a8d6caae7e32bb5965cded5

SHA256
982d672ef6d89fb02e8d5a1f6e0770995e7e1de53bfc7e464f2c2652d8f92fee

SHA512
bc4b8c128e272b3f3ee978252c812bfa5fe9cc61e6da788814a3b8ff323237880b744223de3f6e110c42c2c54fc42cf29233b17ed13fbab8fa241941e4e62b18

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kfp453ux\CSC77CFAABBC98E47C8923FA7929FFF5D.TMP

Filesize
1KB

MD5
a9b708c41a206cfe92b7a64af8d32b49

SHA1
e46695a3742f5fee7e100c174f6d41ec87a5dbc6

SHA256
686aec6ee1f5b2f2f30dc514118a587d76ba3e96e7add2af9bc658199186fe10

SHA512
f557b3c7721f49030bdf569280098e337e410974cdbbbe9eb1d2d159d7136b3c5bc91fc65f55f70d2db9d0a238a9d861b27a0705ec979555ca0927137930d4bd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kfp453ux\kfp453ux.0.cs

Filesize
29KB

MD5
be0c48fc5057a467514eec58f1b1264b

SHA1
6d656174c6c9ab1e4c3d75cc9270a2aa4079183b

SHA256
8685fc1ef0ff239f59289b26d9aa7134998f4cc4a15b22c9a8922c071bb32639

SHA512
157df2d4ef94906418ea32be5feedc28aac61787033e7473f0eab8e22d32a2a83ddbb5c43c16b0d5f83c8c27f167e1fcf2967df35bdbafca75327dc35ed443f1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kfp453ux\kfp453ux.cmdline

Filesize
248B

MD5
b7ca194e410a662a59a8455f382171da

SHA1
0705fcefde24bcc5f595923df6a452074ea884be

SHA256
e7c2e0c2b1478643b05e005c7327a62e2bd043db1aac49b682ef1d080d16df5c

SHA512
c073baf295ba25d320a3a3e3a18812bf580e98af68f2dc5fafb8fc4cbcf23e02a53ae4887d7eecdfeb4f1fddd4622b20d4aa8a4f5d5bec7eba4d78086524d751

Download Submit
\??\c:\users\admin\appdata\local\microsoft\office\16.0\excel.exe_rules.xml

Filesize
324KB

MD5
38bb70b8d477ca378d53f1ef4f6bcade

SHA1
5a0235b322b53f5f13253201c9b01b72fb07c308

SHA256
91655144d235061a413f82890a2613a55390a9d59dce30433ba3959393b0fe86

SHA512
6a7af3e3602f031adf5435aeccf7bc1570947426dc2ad502ff38af4b459a02f35e891da1803be8809bbe884169abd7b3692fda2bfa1666ad06fbaf453043adec

Download Submit
\??\c:\users\admin\appdata\local\microsoft\office\otele\excel.exe.db

Filesize
24KB

MD5
371c17d8bedaa34ff49bd0f22ae524eb

SHA1
5cee15d4fbc53b0b6ad0eeebe15a0c2b8ac30123

SHA256
9fb8eb34051aec33d8d21d5b1f41752243dfc7008de8cedc034867fcea9f6abf

SHA512
ed762ce256a6175ee5ece971bfa6dabada3fb68c248d84e79f1412b6b47ad98420ed7811c414a22716a00e42ba0474e6c0825ace323da46142ae70958e04e5b7

Download Submit
memory/2700-482-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/2700-487-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3248-1316-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3248-904-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3248-1346-0x0000000000440000-0x0000000000451000-memory.dmp

Filesize
68KB

Download
memory/3248-1312-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3248-1345-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3248-907-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3628-477-0x0000000002B60000-0x0000000002B6A000-memory.dmp

Filesize
40KB

Download
memory/3700-364-0x0000000005440000-0x00000000054D2000-memory.dmp

Filesize
584KB

Download
memory/3700-347-0x0000000000980000-0x0000000000A68000-memory.dmp

Filesize
928KB

Download
memory/3700-362-0x0000000005320000-0x000000000532A000-memory.dmp

Filesize
40KB

Download
memory/3700-379-0x0000000005AA0000-0x0000000005B3C000-memory.dmp

Filesize
624KB

Download
memory/3700-369-0x0000000005600000-0x00000000056C9000-memory.dmp

Filesize
804KB

Download
memory/3700-366-0x0000000005380000-0x000000000538C000-memory.dmp

Filesize
48KB

Download
memory/3700-365-0x00000000059D0000-0x0000000005AA6000-memory.dmp

Filesize
856KB

Download
memory/4156-380-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/4156-386-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/4156-382-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/4964-407-0x00007FFEA5130000-0x00007FFEA5140000-memory.dmp

Filesize
64KB

Download
memory/4964-404-0x00007FFEA5130000-0x00007FFEA5140000-memory.dmp

Filesize
64KB

Download
memory/4964-405-0x00007FFEA5130000-0x00007FFEA5140000-memory.dmp

Filesize
64KB

Download
memory/4964-406-0x00007FFEA5130000-0x00007FFEA5140000-memory.dmp

Filesize
64KB

Download
memory/4964-461-0x00007FFEA5130000-0x00007FFEA5140000-memory.dmp

Filesize
64KB

Download
memory/4964-408-0x00007FFEA5130000-0x00007FFEA5140000-memory.dmp

Filesize
64KB

Download
memory/4964-409-0x00007FFEA2BB0000-0x00007FFEA2BC0000-memory.dmp

Filesize
64KB

Download
memory/4964-410-0x00007FFEA2BB0000-0x00007FFEA2BC0000-memory.dmp

Filesize
64KB

Download
memory/4964-458-0x00007FFEA5130000-0x00007FFEA5140000-memory.dmp

Filesize
64KB

Download
memory/4964-459-0x00007FFEA5130000-0x00007FFEA5140000-memory.dmp

Filesize
64KB

Download
memory/4964-460-0x00007FFEA5130000-0x00007FFEA5140000-memory.dmp

Filesize
64KB

Download