Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
15/03/2025, 06:20
Static task
static1
Behavioral task
behavioral1
Sample
2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe
Resource
win10v2004-20250314-en
General
-
Target
2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe
-
Size
207KB
-
MD5
8decb4b6c3256a11d3b1bc4e943e8c7d
-
SHA1
05fc08d5a5ff70dd4546738a51ab2a0b6c2c9923
-
SHA256
336217dba6750195bcb69c21b74d1dcd72980e689beb2c83da2c922896081f61
-
SHA512
463ad11c9e9a3cffd5bde25c49a118a95f5dcb586643cf18d812dd480c0bcee21fa81b6c7ed67d2d93d719c413ad0df50764590062987a70ab3072d9381db1dd
-
SSDEEP
3072:GFpwo1bMOPxCC5DTEBUZBXDjjbzMQqxPjY3YL5f0BTlL8rdfkAU+Fv/HV4a:MpwonxCqTNBXDUQSjhsBTSXFv/HV
Malware Config
Extracted
C:\Users\Admin\Desktop\_1AHZB_README_.hta
http://p27dokhpz2n7nvgr.onion.to/736D-A23D-C6E0-0502-9D5B
http://p27dokhpz2n7nvgr.onion/736D-A23D-C6E0-0502-9D5B
https://www.baidu.com
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Cerber family
-
Blocklisted process makes network request 5 IoCs
flow pid Process 1157 2840 mshta.exe 1160 2840 mshta.exe 1162 2840 mshta.exe 1164 2840 mshta.exe 1166 2840 mshta.exe -
Contacts a large (585) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
pid Process 3028 cmd.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpDBBF.bmp" 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\microsoft\office 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\thunderbird 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\powerpoint 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\steam 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\word 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files\ 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\excel 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\the bat! 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\bitcoin 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\office 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\outlook 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\word 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\onenote 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\ 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\ 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2096 PING.EXE -
Kills process with taskkill 1 IoCs
pid Process 2556 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2096 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2360 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2360 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe Token: SeDebugPrivilege 2556 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2548 DllHost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2548 DllHost.exe 2548 DllHost.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2840 2360 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe 32 PID 2360 wrote to memory of 2840 2360 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe 32 PID 2360 wrote to memory of 2840 2360 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe 32 PID 2360 wrote to memory of 2840 2360 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe 32 PID 2360 wrote to memory of 3028 2360 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe 37 PID 2360 wrote to memory of 3028 2360 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe 37 PID 2360 wrote to memory of 3028 2360 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe 37 PID 2360 wrote to memory of 3028 2360 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe 37 PID 3028 wrote to memory of 2556 3028 cmd.exe 39 PID 3028 wrote to memory of 2556 3028 cmd.exe 39 PID 3028 wrote to memory of 2556 3028 cmd.exe 39 PID 3028 wrote to memory of 2096 3028 cmd.exe 40 PID 3028 wrote to memory of 2096 3028 cmd.exe 40 PID 3028 wrote to memory of 2096 3028 cmd.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe"1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_1AHZB_README_.hta"2⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2840
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\system32\taskkill.exetaskkill /f /im "2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2556
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2096
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2548
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
- System Location Discovery: System Language Discovery
PID:2816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD583142242e97b8953c386f988aa694e4a
SHA1833ed12fc15b356136dcdd27c61a50f59c5c7d50
SHA256d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755
SHA512bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10
-
Filesize
183KB
MD5109cab5505f5e065b63d01361467a83b
SHA14ed78955b9272a9ed689b51bf2bf4a86a25e53fc
SHA256ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673
SHA512753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc
-
Filesize
65KB
MD50473df5a127e1ea150e7e460192c5c30
SHA1c4ec20f9f1239b895bd829ceab8888211e968af3
SHA2565d220cd7cc97e1e1113acab7882abaa7f00704f64f509343fa595b98a33e8c7e
SHA512695f877b84f51233b6d558c74b19cd3271c277c6eade4831d75eab271ab1170597902dd7d7e39b72bf9a75f62c35ee5240f6fc2521848130a52a127e2bd99e4e
-
Filesize
150KB
MD5622818337b243036e4bc371215679ff7
SHA1aeb6689478455013f66c2455ec3104abdc902750
SHA2569a5c98e4ee5b5188d7b9a80cfe37a93a3ec7655f8ecbc875edf34839644cc314
SHA5125bc7642d6d4e74fef86159083fec6a338c80a5732a7ab793bd8021a0c87a01791e503711a7719b8586eee998867b1a29d96fe602130ed016eaac9f8073902fde