cerber | 145d1db4032e3089d9d7ea9ca70ded01e78b9cf04ada90b3b6e41a674a124b09

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/10/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
Size 396KB
Sample261016-e189hshs6j
SHA256 145d1db4032e3089d9d7ea9ca70ded01e78b9cf04ada90b3b6e41a674a124b09
MD5 c2504894e8026c8ef16c8455721f36e5
SHA1 418b1458b6da923af566690db6541b984de5e480
SHA512 463b720731345d11f2dcfd223b6fd43506499c4eef5d351d5cc911fb51655e7beafdcd91146208cb3c4ac9160ffb1102edb569bf40e24be35ad6545541ee18a4
SSDEEP 6144:HZwcaAnn0IaP7GTrZaqtv1jdOcVBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBS:HZtn2DerZZvxI
TLSH
T14084D142B638ADD0FD5CA1F0BF76E510918778A7B491505F31889EF8A2CD02B12BD5BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery cerber persistence privilege_escalation ransomware upx

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_READ_THI$_FILE_JNAK29_.hta

cerber

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>CERBER RANSOMWARE: Instructions</title> <HTA:APPLICATION APPLICATIONNAME="i3mfotsWhn" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 13pt; line-height: 19pt; } body, h1 { margin: 0; padding: 0; } hr { color: #bda; height: 2pt; margin: 1.5%; } h1 { color: #555; font-size: 14pt; } ol { padding-left: 2.5%; } ol li { padding-bottom: 13pt; } small { color: #555; font-size: 11pt; } ul { list-style-type: none; margin: 0; padding: 0; } .button { color: #04a; cursor: pointer; } .button:hover { text-decoration: underline; } .container { background-color: #fff; border: 2pt solid #c7c7c7; margin: 5%; min-width: 850px; padding: 2.5%; } .header { border-bottom: 2pt solid #c7c7c7; margin-bottom: 2.5%; padding-bottom: 2.5%; } .h { display: none; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { background-color: #efe; border: 2pt solid #bda; display: inline-block; padding: 1.5%; text-align: center; } .updating { color: red; display: none; padding-left: 35px; background: url("data:image/gif;base64,R0lGODlhGQAZAKIEAMzMzJmZmTMzM2ZmZgAAAAAAAAAAAAAAACH/C05FVFNDQVBFMi4wAwEAAAAh+QQFAAAEACwAAAAAGQAZAAADVki63P4wSEiZvLXemRf4yhYoQ0l9aMiVLISCDms+L/DIwwnfc+c3qZ9g6Hn5hkhF7YgUKI2dpvNpExJ/WKquSoMCvd9geDeuBpcuGFrcQWep5Df7jU0AACH5BAUAAAQALAoAAQAOABQAAAMwSLDU/iu+Gdl0FbTAqeXg5YCdSJCBuZVqKw5wC8/qHJv2IN+uKvytn9AnFBCHx0cCACH5BAUAAAQALAoABAAOABQAAAMzSLoEzrC5F9Wk9YK6Jv8gEYzgaH4myaVBqYbfIINyHdcDI+wKniu7YG+2CPI4RgFI+EkAACH5BAUAAAQALAQACgAUAA4AAAMzSLrcBNDJBeuUNd6WwXbWtwnkFZwMqUpnu6il06IKLChDrsxBGufAHW0C1IlwxeMieEkAACH5BAUAAAQALAEACgAUAA4AAAM0SLLU/lAtFquctk6aIe5gGA1kBpwPqVZn66hl1KINPDRB3sxAGufAHc0C1IkIxcARZ4QkAAAh+QQFAAAEACwBAAQADgAUAAADMUhK0vurSfiko8oKHC//yyCCYvmVI4cOZAq+UCCDcv3VM4cHCuDHOZ/wI/xxigDQMAEAIfkEBQAABAAsAQABAA4AFAAAAzNIuizOkLgZ13xraHVF1puEKWBYlUP1pWrLBLALz+0cq3Yg324PAUAXcNgaBlVGgPAISQAAIfkEBQAABAAsAQABABQADgAAAzRIujzOMBJHpaXPksAVHoogMlzpZWK6lF2UjgobSK9AtjSs7QTg8xCfELgQ/og9I1IxXCYAADs=") left no-repeat; } #change_language { float: right; } #change_language, #texts div { display: none; } </style> </head> <body> <div class="container"> <div class="header"> <a id="change_language" href="#" onclick="return changeLanguage1();" title="English">☑ English</a> <h1>CERBER RANSOMWARE</h1> Instructions </div> <div id="languages"> ☑ Select your language <ul> <li><a href="#" title="English" onclick="return showBlock('en');">English</a></li> <li><a href="#" title="Arabic" onclick="return showBlock('ar');">العربية</a></li> <li><a href="#" title="Chinese" onclick="return showBlock('zh');">中文</a></li> <li><a href="#" title="Dutch" onclick="return showBlock('nl');">Nederlands</a></li> <li><a href="#" title="French" onclick="return showBlock('fr');">Français</a></li> <li><a href="#" title="German" onclick="return showBlock('de');">Deutsch</a></li> <li><a href="#" title="Italian" onclick="return showBlock('it');">Italiano</a></li> <li><a href="#" title="Japanese" onclick="return showBlock('ja');">日本語</a></li> <li><a href="#" title="Korean" onclick="return showBlock('ko');">한국어</a></li> <li><a href="#" title="Polish" onclick="return showBlock('pl');">Polski</a></li> <li><a href="#" title="Portuguese" onclick="return showBlock('pt');">Português</a></li> <li><a href="#" title="Spanish" onclick="return showBlock('es');">Español</a></li> <li><a href="#" title="Turkish" onclick="return showBlock('tr');">Türkçe</a></li> </ul> </div> <div id="texts"> <div id="en"> Can't yolruu find the necessary files? Is the cPuYJvseontent of your files not readable? It is normal beC4Lcause the files' names and the data in your files have been encrypDmvXFvted by "CeyUg8aYSbL1rber Ransomware". It mel69bJQyFsans your files are NOT damagelJd! Your files are modified only. This modification is reversible. F0vi5rom now it is not possZcsc18gfDIible to use your files until they will be decrypted. The only way to decuOWdPrypt your files safely is to buy the special decryption software "C8FMerber Decryptor". Any attempts to restfyore your files with the thir6p3IvL8EeQd-party software will be fatal for your files! <hr> You can prochK53C7yZeed with purchasing of the decryption softw5pV3are at your personal page: Plek2gase wait...<a class="url" href="http://p27dokhpz2n7nvgr.1a7wnt.top/6BB5-C228-9E9D-0099-3CC7" target="_blank">http://p27dokhpz2n7nvgr.1a7wnt.top/6BB5-C228-9E9D-0099-3CC7</a><hr><a href="http://p27dokhpz2n7nvgr.1czh7o.top/6BB5-C228-9E9D-0099-3CC7" target="_blank">http://p27dokhpz2n7nvgr.1czh7o.top/6BB5-C228-9E9D-0099-3CC7</a><hr><a href="http://p27dokhpz2n7nvgr.1hpvzl.top/6BB5-C228-9E9D-0099-3CC7" target="_blank">http://p27dokhpz2n7nvgr.1hpvzl.top/6BB5-C228-9E9D-0099-3CC7</a><hr><a href="http://p27dokhpz2n7nvgr.1pglcs.top/6BB5-C228-9E9D-0099-3CC7" target="_blank">http://p27dokhpz2n7nvgr.1pglcs.top/6BB5-C228-9E9D-0099-3CC7</a><hr><a href="http://p27dokhpz2n7nvgr.1cewld.top/6BB5-C228-9E9D-0099-3CC7" target="_blank">http://p27dokhpz2n7nvgr.1cewld.top/6BB5-C228-9E9D-0099-3CC7</a> If tbIel3ghis page cannot be opened  cliNWli85AdNck here  to get a new addrn7WPrBMess of your personal page. If the addreQfhWGzHss of your personal page is the same as befo2re after you tried to get a new one, you cG1kan3kjB7an try to get a new address in one hour. At thPM1Szis page you will receive the complete instrxGfSkuctions how to buy the decryptiFQon software for restoring all your files. Also at this page you will be able to res5gV2tore any one file for free to be sure "CerbeWr Decryptor" will help you. <hr> If your per8xuZPIo3Bsonal page is not availagEuZ3Zcpble for a long period there is another way to open your personal page - instaUbNa3ssTcGllation and use of Tor Browser: <ol> <li>run your IntegRAQ0mdrnet browser (if you do not know what it is run the Internet Explorer);</li> <li>entZI916RJer or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loadTGing;</li> <li>on the site you will be offered to doxwnload Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>ruBrUuqnyy6n Tor Browser;</li> <li>connect with the butt8QLbon "Connect" (if you use the English version);</li> <li>a normal Internet bro1b5ewser window will be opened after the initialization;</li> <li>type or copy the add9press http://p27dokhpz2n7nvgr.onion/6BB5-C228-9E9D-0099-3CC7 in this browser address bar;</li> <li>preWY32jB0Enss ENTER;</li> <li>the site shol4XQTaVJWuld be loaded; if for some reason the site is not lou4bading wait for a moment and try again.</li> </ol> If you have any prXzXl9jnoblems during installation or use of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> and type request in the searcUsXJw7sh bar "Install Tor Browser Windows" and you will find a lot of training videos about Tor Browser installation and use. <hr> Additq25CmjyTeqional information: You will fib1nd the instruD9n14ctions ("*_READ_THIS_FILE_*.hta") for remjstoring your files in any frXnsEV1Nolder with your encerypted files. The instr19POuctions "*_READ_THIS_FILE_*.hta" in the fnolderZzKESs with your encrysjRAupted files are not virKU18qlrrtKuses! The instrucvchYbPtions "*_READ_THIS_FILE_*.hta" will he6mlp you to decZpLUy4Prypt your files. RemembexhyoJ5B8eUr! The worst siya4WFQW4xtuation already happ8c0V0ened and now the future of your files de1FGpends on your determtzination and speed of your actions. </div> <div id="ar" style="direction: rtl;"> لا يمكنك العثور على الملفات الضرورية؟ هل محتوى الملفات غير قابل للقراءة؟ هذا أمر طبيعي لأن أسماء الملفات والبيانات في الملفات قد تم تشفيرها بواسطة "Cerber Ransomware". وهذا يعني أن الملفات الخاصة بك ليست تالفة! فقد تم تعديل ملفاتك فقط. ويمكن التراجع عن هذا. ومن الآن فإنه لا يكن استخدام الملفات الخاصة بك حتى يتم فك تشفيرها. الطريقة الوحيدة لفك تشفير ملفاتك بأمان هو أن تشتري برنامج فك التشفير المتخصص "Cerber Decryptor". إن أية محاولات لاستعادة الملفات الخاصة بك بواسطة برامج من طرف ثالث سوف تكون مدمرة لملفاتك! <hr> يمكنك الشروع في شراء برنامج فك التشفير من صفحتك الشخصية: أرجو الإنتظار...<a class="url" href="http://p27dokhpz2n7nvgr.1a7wnt.top/6BB5-C228-9E9D-0099-3CC7" target="_blank">http://p27dokhpz2n7nvgr.1a7wnt.top/6BB5-C228-9E9D-0099-3CC7</a><hr><a href="http://p27dokhpz2n7nvgr.1czh7o.top/6BB5-C228-9E9D-0099-3CC7" target="_blank">http://p27dokhpz2n7nvgr.1czh7o.top/6BB5-C228-9E9D-0099-3CC7</a><hr><a href="http://p27dokhpz2n7nvgr.1hpvzl.top/6BB5-C228-9E9D-0099-3CC7" target="_blank">http://p27dokhpz2n7nvgr.1hpvzl.top/6BB5-C228-9E9D-0099-3CC7</a><hr><a href="http://p27dokhpz2n7nvgr.1pglcs.top/6BB5-C228-9E9D-0099-3CC7" target="_blank">http://p27dokhpz2n7nvgr.1pglcs.top/6BB5-C228-9E9D-0099-3CC7</a><hr><a href="http://p27dokhpz2n7nvgr.1cewld.top/6BB5-C228-9E9D-0099-3CC7" target="_blank">http://p27dokhpz2n7nvgr.1cewld.top/6BB5-C228-9E9D-0099-3CC7</a> في حالة تعذر فتح هذه الصفحة  انقر هنا  لإنشاء عنوان جديد لصفحتك الشخصية. في هذه الصفحة سوف تتلقى تعليمات كاملة حول كيفية شراء برنامج فك التشفير لاستعادة جميع الملفات الخاصة بك. في هذه الصفحة أيضًا سوف تتمكن من استعادة ملف واحد بشكل مجاني للتأكد من أن "Cerber Decryptor" سوف يساعدك. <hr> إذا كانت صفحتك الشخصية غير متاحة لفترة طويلة فإن ثمّة طريقة أخرى لفتح صفحتك الشخصية - تحميل واستخدام متصفح Tor: <ol> <li>قم بتشغيل متصفح الإنترنت الخاص بك (إذا كنت لا تعرف ما هو قم بتشغيل إنترنت إكسبلورر);</li> <li>قم بكتابة أو نسخ العنوان <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> إلى شريط العنوان في المستعرض الخاص بك ثم اضغط ENTER;</li> <li>انتظر لتحميل الموقع;</li> <li>سوف يعرض عليك الموقع تحميل متصفح Tor. قم بتحميله وتشغيله، واتبع تعليمات التثبيت، وانتظر حتى اكتمال التثبيت;</li> <li>قم بتشغيل متصفح Tor;</li> <li>اضغط على الزر "Connect" (إذا كنت تستخدم النسخة الإنجليزية);</li> <li>سوف تُفتح نافذة متصفح الإنترنت العادي بعد البدء;</li> <li>قم بكتابة أو نسخ العنوان http://p27dokhpz2n7nvgr.onion/6BB5-C228-9E9D-0099-3CC7 في شريط العنوان في المتصفح;</li> <li>اضغط ENTER;</li> <li>يجب أن يتم تحميل الموقع؛ إذا لم يتم تحميل الموقع لأي سبب، انتظر للحظة وحاول مرة أخرى.</li> </ol> إذا كان لديك أية مشكلات أثناء عملية التثبيت أو استخدام متصفح Tor، يُرجى زيارة <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> واكتب الطلب "install tor browser windows" أو "تثبيت نوافذ متصفح Tor" في شريط البحث، وسوف تجد الكثير من أشرطة الفيديو للتدريب حول تثبيت متصفح Tor واستخدامه. <hr> معلومات إضافية: سوف تجد إرشادات استعادة الملفات الخاصة بك ("*_READ_THIS_FILE_*") في أي مجلد مع ملفاتك المشفرة. الإرشادات ("*_READ_THIS_FILE_*") الموجودة في المجلدات مع ملفاتك المشفرة ليست فيروسات والإرشادات ("*_READ_THIS_FILE_*") سوف تساعدك على فك تشفير الملفات الخاصة بك. تذكر أن أسوأ موقف قد حدث بالفعل، والآن مستقبل ملفاتك يعتمد على عزيمتك وسرعة الإجراءات الخاصة بك. </div> <div id="zh"> 您找不到所需的文件？ 您文件的内容无法阅读？ 这是正常的，因为您文件的文件名和数据已经被“Cerber Ransomware”加密了。 这意味着您的文件并没有损坏！您的文件只是被修改了，这个修改是可逆的，解密之前您无法使用您的文件。 ��

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_READ_THI$_FILE_C3I1XK_.txt

Ransom Note

--- [ CERBER RANSOMWARE ] --- ! YOUR DOCUMENTS, PHOTOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED ! --- The only way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: --- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/6BB5-C228-9E9D-0099-3CC7 Note! This page is available via "Tor Browser" only. --- Also you can use temporary addresses on your personal page without using "Tor Browser". --- 1. http://p27dokhpz2n7nvgr.1a7wnt.top/6BB5-C228-9E9D-0099-3CC7 2. http://p27dokhpz2n7nvgr.1czh7o.top/6BB5-C228-9E9D-0099-3CC7 3. http://p27dokhpz2n7nvgr.1hpvzl.top/6BB5-C228-9E9D-0099-3CC7 4. http://p27dokhpz2n7nvgr.1pglcs.top/6BB5-C228-9E9D-0099-3CC7 5. http://p27dokhpz2n7nvgr.1cewld.top/6BB5-C228-9E9D-0099-3CC7 --- Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://p27dokhpz2n7nvgr.onion/6BB5-C228-9E9D-0099-3CC7
http://p27dokhpz2n7nvgr.1a7wnt.top/6BB5-C228-9E9D-0099-3CC7
http://p27dokhpz2n7nvgr.1czh7o.top/6BB5-C228-9E9D-0099-3CC7
http://p27dokhpz2n7nvgr.1hpvzl.top/6BB5-C228-9E9D-0099-3CC7
http://p27dokhpz2n7nvgr.1pglcs.top/6BB5-C228-9E9D-0099-3CC7
http://p27dokhpz2n7nvgr.1cewld.top/6BB5-C228-9E9D-0099-3CC7

Signatures

Family: Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2227	988	mshta.exe
2230	988	mshta.exe
2232	988	mshta.exe
2234	988	mshta.exe

Contacts a large (1109) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1316	netsh.exe
2452	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\documents	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat!	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat!	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\desktop	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp3270.bmp"	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1168 set thread context of 1744	1168	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe	96

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1744-7-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1744-6-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1744-5-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1744-3-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1744-8-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1744-9-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1744-13-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1744-604-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/1744-628-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\program files (x86)\the bat!	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\program files (x86)\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\program files (x86)\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\program files (x86)\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\program files (x86)\microsoft\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\program files (x86)\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\program files (x86)\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\program files\	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\program files (x86)\bitcoin	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\program files (x86)\microsoft\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\program files (x86)\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\program files (x86)\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\program files (x86)\	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\program files (x86)\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\program files (x86)\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\program files (x86)\thunderbird	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\program files (x86)\microsoft\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\program files (x86)\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\program files (x86)\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat!	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\desktop	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\desktop	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat!	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat!	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\documents	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\the bat!	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\documents	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mshta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mshta.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4728	PING.EXE

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4600	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4728	PING.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1744	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
Token: SeCreatePagefilePrivilege	1744	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
Token: SeDebugPrivilege	4600	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1168	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1744	1168	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe	96
PID 1168 wrote to memory of 1744	1168	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe	96
PID 1168 wrote to memory of 1744	1168	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe	96
PID 1168 wrote to memory of 1744	1168	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe	96
PID 1744 wrote to memory of 1316	1744	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe	99
PID 1744 wrote to memory of 2452	1744	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe	101
PID 1744 wrote to memory of 988	1744	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe	109
PID 1744 wrote to memory of 1684	1744	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe	110
PID 1744 wrote to memory of 1968	1744	jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe	113
PID 1968 wrote to memory of 4600	1968	cmd.exe	115
PID 1968 wrote to memory of 4728	1968	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe"
  2⤵
  - Checks computer location settings
  - Creates a file in the Startup directory
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\netsh.exe
    C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1316
- - C:\Windows\SysWOW64\netsh.exe
    C:\Windows\system32\netsh.exe advfirewall reset
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2452
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_READ_THI$_FILE_MS8DSDJI_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Badlisted process makes network request
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:988
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_READ_THI$_FILE_HQMQ_.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1684
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "jaffacakes118_Trojan-Ransom.Win32.Zerber.dqqk.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4600
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4728

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x328 0x2f4
1⤵
PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

_READ_THI$_FILE_6ODLH6O4_.jpeg

Path C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_READ_THI$_FILE_6ODLH6O4_.jpeg
Size 310KB
SHA256 a1455d84130f9843b1ef47a1f8e6529c2ce5fba5451b811bed8bbe7d394303fe
MD5 1f80689c926ea27527c9b8214cd5e614
SHA1 8520ecff6613fc0de96c50daa892e2977e83adcf
SHA512 088d31edf55bb351ed8a941a392094a6e84570feae9bb5684441571696a0b51151a25c87522959e9eb7239caf0388e02234703dd7791a69d7ad189835aca3928
SSDEEP 6144:LjqYWBwRoTacenzDac3x7PviYHmiAEraiLWoOFa5GGYlRE8:LjT0wVcenzDagqW7rnNOFaMGORE8
TLSH
T16B6423733226FB6680704790985BADEF7F88136987F5DCBA01575AF089D0A32CB631D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_READ_THI$_FILE_C3I1XK_.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_READ_THI$_FILE_C3I1XK_.txt
Size 1KB
SHA256 29e6cd933a67c8b65560143048f6756159e12f88ca7432569356588936e7123d
MD5 60c875b9f375d8ba05564caa85514ac8
SHA1 85b844fa9b18a219b0c2fb095f2eb8b27f96d506
SHA512 5479fad2e413d1a48d99aa4d3e1046df9ce3dd2557cd4d91e521c668d0f7aea53181afcbffd948a5ced153a8a0f1a7c5eaa076d3e41ed04718904a0d779ef4c5
TLSH
T1F421566F28C0E044174D65FB33375470D7D7328E79D80390F54B88060B24D756737989
MD5 SHA1 SHA512 TLSH

Submit Download

_READ_THI$_FILE_JNAK29_.hta

Path C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_READ_THI$_FILE_JNAK29_.hta
Size 75KB
SHA256 868aecbfceb1235cb394963e182350e0d62b65f3adb13e39b42318ba712f31d5
MD5 be95bae5f17271ac89e02d75481f185a
SHA1 2057472592489044a822b237f1700d756c21b194
SHA512 a905c11346a581fb376cad5da1e6a181587b0c75908566208e7b4267620262835cc6a0611ee9fb86d6dbe703b678871cbfb3732250af73fc5dad1348d3c8225b
SSDEEP 1536:scV47CqAtqHtV+o+VOurg0m9CqMoEnygcnjg52uzMU:sBK/oyOF9nMogjUk5DF
TLSH
T12573D79D70DDF01B0B6196DB5276A320E0AFFCB1C9846372F1BF4533105A865AA1A8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1168-2-0x0000000002150000-0x0000000002155000-memory.dmp

Download

memory/1744-5-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1744-8-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1744-9-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1744-13-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1744-3-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1744-6-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1744-7-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1744-604-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1744-628-0x0000000000400000-0x000000000043D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads