Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2025, 06:20
Static task
static1
Behavioral task
behavioral1
Sample
2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe
Resource
win10v2004-20250314-en
General
-
Target
2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe
-
Size
207KB
-
MD5
8decb4b6c3256a11d3b1bc4e943e8c7d
-
SHA1
05fc08d5a5ff70dd4546738a51ab2a0b6c2c9923
-
SHA256
336217dba6750195bcb69c21b74d1dcd72980e689beb2c83da2c922896081f61
-
SHA512
463ad11c9e9a3cffd5bde25c49a118a95f5dcb586643cf18d812dd480c0bcee21fa81b6c7ed67d2d93d719c413ad0df50764590062987a70ab3072d9381db1dd
-
SSDEEP
3072:GFpwo1bMOPxCC5DTEBUZBXDjjbzMQqxPjY3YL5f0BTlL8rdfkAU+Fv/HV4a:MpwonxCqTNBXDUQSjhsBTSXFv/HV
Malware Config
Extracted
C:\Users\Admin\Desktop\_V6G905_README_.hta
http://p27dokhpz2n7nvgr.onion.to/736D-A23D-C6E0-0502-9D5B
http://p27dokhpz2n7nvgr.onion/736D-A23D-C6E0-0502-9D5B
https://www.baidu.com
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Cerber family
-
Contacts a large (587) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpD4C5.bmp" 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files\ 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\office 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\powerpoint 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\thunderbird 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\word 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\bitcoin 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\word 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\office 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\steam 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\the bat! 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\onenote 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\ 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\excel 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe File opened for modification \??\c:\program files (x86)\outlook 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\ 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 372 PING.EXE -
Kills process with taskkill 1 IoCs
pid Process 2836 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 372 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5268 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe 5268 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeShutdownPrivilege 5268 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe Token: SeCreatePagefilePrivilege 5268 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe Token: 33 1116 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1116 AUDIODG.EXE Token: SeDebugPrivilege 2836 taskkill.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5268 wrote to memory of 4796 5268 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe 89 PID 5268 wrote to memory of 4796 5268 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe 89 PID 5268 wrote to memory of 4796 5268 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe 89 PID 5268 wrote to memory of 2984 5268 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe 95 PID 5268 wrote to memory of 2984 5268 2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe 95 PID 2984 wrote to memory of 2836 2984 cmd.exe 97 PID 2984 wrote to memory of 2836 2984 cmd.exe 97 PID 2984 wrote to memory of 372 2984 cmd.exe 98 PID 2984 wrote to memory of 372 2984 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe"1⤵
- Checks computer location settings
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_V6G905_README_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- System Location Discovery: System Language Discovery
PID:4796
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\system32\taskkill.exetaskkill /f /im "2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:372
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x404 0x3381⤵
- Suspicious use of AdjustPrivilegeToken
PID:1116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD50473df5a127e1ea150e7e460192c5c30
SHA1c4ec20f9f1239b895bd829ceab8888211e968af3
SHA2565d220cd7cc97e1e1113acab7882abaa7f00704f64f509343fa595b98a33e8c7e
SHA512695f877b84f51233b6d558c74b19cd3271c277c6eade4831d75eab271ab1170597902dd7d7e39b72bf9a75f62c35ee5240f6fc2521848130a52a127e2bd99e4e