Overview

overview

10

Static

static

3

free_perm.zip

windows10-ltsc_2021-x64

Sharing

Copy URL Twitter E-mail

General

  • Target
    free_perm.zip
  • Size 10.5MB
  • Sample260802-p679hstbmd
  • SHA256 3a457fa0e4997b1b11fcfbaa8b7fb763731a92ee95e5489af345fbcb586c3505
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
cerberdefense_evasionexecutionpersistenceransomware

Malware Config

Targets

    • Target
      free_perm.zip
    • Size 10.5MB
    • SHA256 3a457fa0e4997b1b11fcfbaa8b7fb763731a92ee95e5489af345fbcb586c3505
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasionexecutioncerberpersistenceransomware

    • Family: Cerber

      Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

      ransomwarecerber

    • Drops file in Drivers directory

    • Creates new service(s)

      persistenceexecution

    • Executes dropped EXE

    • Stops running service(s)

      defense_evasionexecution

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks