Overview

overview

10

Static

static

3

free_perm/spoof.bat

windows10-ltsc_2021-x64

free_perm/spoof.bat

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

  • Target
    free_perm.zip
  • Size 9.5MB
  • Sample260802-pg6z6aam41
  • SHA256 a2101351bfda7b6831e392e2de9a2a44f4615f6b7cec4189fa8ab43307c58536
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
cerberdefense_evasionexecutionpersistenceransomware

Malware Config

Targets

    • Target
      free_perm/spoof.bat
    • Size 5KB
    • SHA256 366d6b53483ae1e50213de26593f7f8fd6830cba86f14490d27145658949784b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasionexecutioncerberpersistenceransomware

    • Family: Cerber

      Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

      ransomwarecerber

    • Drops file in Drivers directory

    • Creates new service(s)

      persistenceexecution

    • Executes dropped EXE

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks