cerber | a977765a568fbabd5b00635cb7d58863154c32b50dce5a78e23428a5f721932a

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
Size 235KB
Sample261016-e227lahs7p
SHA256 a977765a568fbabd5b00635cb7d58863154c32b50dce5a78e23428a5f721932a
MD5 5fd23d423b98de380606ea5233e76dc7
SHA1 3012a1b34a8a8c9d855327a475d1661b42a9f69d
SHA512 774978a3725eeff1896ecbc324ca4bf8ad3ef5df9dced65d6ba6bc809ee2f42ea8876b23f3fc7fadc0e3881e430d2e8c392806d121246b15301b7683359dd101
SSDEEP 6144:1QFlN/jIz548NvrhNU9ei3RfWYTXgGMLhbq+cUiJZ:ElZjIz548NdNQ1uA+cF
TLSH
T1E134BE3AF0351739E54C2DB8A93FC605CC675232ACB876634F82E98538B29D05D4EE4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery cerber persistence privilege_escalation ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___41LD8GWA_.hta

cerber

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>CERBER RANSOMWARE: Instructions</title> <HTA:APPLICATION APPLICATIONNAME="sjQChRI9" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style type="text/css"> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 13pt; line-height: 19pt; } body, h1 { margin: 0; padding: 0; } hr { color: #bda; height: 2pt; margin: 1.5%; } h1 { color: #555; font-size: 14pt; } ol { padding-left: 2.5%; } ol li { padding-bottom: 13pt; } small { color: #555; font-size: 11pt; } ul { list-style-type: none; margin: 0; padding: 0; } .button { color: #04a; cursor: pointer; } .button:hover { text-decoration: underline; } .container { background-color: #fff; border: 2pt solid #c7c7c7; margin: 5%; min-width: 850px; padding: 2.5%; } .header { border-bottom: 2pt solid #c7c7c7; margin-bottom: 2.5%; padding-bottom: 2.5%; } .h { display: none; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { background-color: #efe; border: 2pt solid #bda; display: inline-block; padding: 1.5%; text-align: center; } .updating { color: red; display: none; padding-left: 35px; background: url("data:image/gif;base64,R0lGODlhGQAZAKIEAMzMzJmZmTMzM2ZmZgAAAAAAAAAAAAAAACH/C05FVFNDQVBFMi4wAwEAAAAh+QQFAAAEACwAAAAAGQAZAAADVki63P4wSEiZvLXemRf4yhYoQ0l9aMiVLISCDms+L/DIwwnfc+c3qZ9g6Hn5hkhF7YgUKI2dpvNpExJ/WKquSoMCvd9geDeuBpcuGFrcQWep5Df7jU0AACH5BAUAAAQALAoAAQAOABQAAAMwSLDU/iu+Gdl0FbTAqeXg5YCdSJCBuZVqKw5wC8/qHJv2IN+uKvytn9AnFBCHx0cCACH5BAUAAAQALAoABAAOABQAAAMzSLoEzrC5F9Wk9YK6Jv8gEYzgaH4myaVBqYbfIINyHdcDI+wKniu7YG+2CPI4RgFI+EkAACH5BAUAAAQALAQACgAUAA4AAAMzSLrcBNDJBeuUNd6WwXbWtwnkFZwMqUpnu6il06IKLChDrsxBGufAHW0C1IlwxeMieEkAACH5BAUAAAQALAEACgAUAA4AAAM0SLLU/lAtFquctk6aIe5gGA1kBpwPqVZn66hl1KINPDRB3sxAGufAHc0C1IkIxcARZ4QkAAAh+QQFAAAEACwBAAQADgAUAAADMUhK0vurSfiko8oKHC//yyCCYvmVI4cOZAq+UCCDcv3VM4cHCuDHOZ/wI/xxigDQMAEAIfkEBQAABAAsAQABAA4AFAAAAzNIuizOkLgZ13xraHVF1puEKWBYlUP1pWrLBLALz+0cq3Yg324PAUAXcNgaBlVGgPAISQAAIfkEBQAABAAsAQABABQADgAAAzRIujzOMBJHpaXPksAVHoogMlzpZWK6lF2UjgobSK9AtjSs7QTg8xCfELgQ/og9I1IxXCYAADs=") left no-repeat; } #change_language { float: right; } #change_language, #texts div { display: none; } </style> </head> <body> <div class="container"> <div class="header"> <a id="change_language" href="#" onclick="return changeLanguage1();" title="English">☑ English</a> <h1>CERBER RANSOMWARE</h1> Instructions </div> <div id="languages"> ☑ Select your language <ul> <li><a href="#" title="English" onclick="return sh_bl('en');">English</a></li> <li><a href="#" title="Arabic" onclick="return sh_bl('ar');">العربية</a></li> <li><a href="#" title="Chinese" onclick="return sh_bl('zh');">中文</a></li> <li><a href="#" title="Dutch" onclick="return sh_bl('nl');">Nederlands</a></li> <li><a href="#" title="French" onclick="return sh_bl('fr');">Français</a></li> <li><a href="#" title="German" onclick="return sh_bl('de');">Deutsch</a></li> <li><a href="#" title="Italian" onclick="return sh_bl('it');">Italiano</a></li> <li><a href="#" title="Japanese" onclick="return sh_bl('ja');">日本語</a></li> <li><a href="#" title="Korean" onclick="return sh_bl('ko');">한국어</a></li> <li><a href="#" title="Polish" onclick="return sh_bl('pl');">Polski</a></li> <li><a href="#" title="Portuguese" onclick="return sh_bl('pt');">Português</a></li> <li><a href="#" title="Spanish" onclick="return sh_bl('es');">Español</a></li> <li><a href="#" title="Turkish" onclick="return sh_bl('tr');">Türkçe</a></li> </ul> </div> <div id="texts"> <div id="en"> Can't yooTaHbsOkm1u find the necessary files? Is the cSe6ontent of your files not readable? It is normal beI2cause the files' names and the data in your files have been encrypS5vted by "Ce9frber Ransomware". It meIiKWeraans your files are NOT damagevJhFSSWd! Your files are modified only. This modification is reversible. FyOY9zrom now it is not possvKqsLBUible to use your files until they will be decrypted. The only way to decwqU6l0FBd2rypt your files safely is to buy the special decryption software "CZerber Decryptor". Any attempts to restYJ0ore your files with the thirM9eDd-party software will be fatal for your files! <hr> You can procspeed with purchasing of the decryption softwBbdeeXpare at your personal page: Plecauase wait...<a class="url" href="http://p27dokhpz2n7nvgr.12uzfa.top/C8DE-F8AE-2084-0099-35FC" target="_blank">http://p27dokhpz2n7nvgr.12uzfa.top/C8DE-F8AE-2084-0099-35FC</a><hr><a href="http://p27dokhpz2n7nvgr.12hygy.top/C8DE-F8AE-2084-0099-35FC" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/C8DE-F8AE-2084-0099-35FC</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/C8DE-F8AE-2084-0099-35FC" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/C8DE-F8AE-2084-0099-35FC</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/C8DE-F8AE-2084-0099-35FC" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/C8DE-F8AE-2084-0099-35FC</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/C8DE-F8AE-2084-0099-35FC" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/C8DE-F8AE-2084-0099-35FC</a> If tJzQhis page cannot be opened  cliZck here  to get a new addrUcOcSess of your personal page. If the addre2IC3ss of your personal page is the same as befoxSt3zhe2Sre after you tried to get a new one, you covc64an try to get a new address in one hour. At thbMrQTFHSVYis page you will receive the complete instrRagCm0ht2yuctions how to buy the decryptittM7IdJGZnon software for restoring all your files. Also at this page you will be able to resJHYF4Ptore any one file for free to be sure "CerbefhKs7r Decryptor" will help you. <hr> If your perw32Oysonal page is not availa4ZWble for a long period there is another way to open your personal page - instaa6vEVxuSgNllation and use of Tor Browser: <ol> <li>run your Inte9Ysrnet browser (if you do not know what it is run the Internet Explorer);</li> <li>entylfpm4tiZer or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site load7reing;</li> <li>on the site you will be offered to do9wBdwnload Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>ru2P8n Tor Browser;</li> <li>connect with the buttecon "Connect" (if you use the English version);</li> <li>a normal Internet brohUwser window will be opened after the initialization;</li> <li>type or copy the addew57xdrVWress http://p27dokhpz2n7nvgr.onion/C8DE-F8AE-2084-0099-35FC in this browser address bar;</li> <li>preJss ENTER;</li> <li>the site shoKN1uld be loaded; if for some reason the site is not lo9CEybhMfJading wait for a moment and try again.</li> </ol> If you have any prooVpa8xBuoblems during installation or use of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> and type request in the searcFxh bar "Install Tor Browser Windows" and you will find a lot of training videos about Tor Browser installation and use. <hr> Additqional information: You will fithGJyVlDWwnd the instruKFMctions ("*_READ_THIS_FILE_*.hta") for reustoring your files in any fZZ1lj5older with your encfjBirypted files. The instr24tsUzlMuctions "*_READ_THIS_FILE_*.hta" in the fCivQz9POplolderwTs with your encryYLk3dmVW1Cpted files are not viryJhYsaSYaUuses! The instrucWCx28Gstions "*_READ_THIS_FILE_*.hta" will he97Evo5elp you to dec2G7Sm1l7xKrypt your files. Remembecr! The worst si9abuZFvcPptuation already happmKyeKjI3ened and now the future of your files deJsHx54YIdpends on your determxlFvhination and speed of your actions. </div> <div id="ar" style="direction: rtl;"> لا يمكنك العثور عALv5yلى الملفات الضرورية؟ هل محتوى الملفات غير قابل للقراءة؟ هذا أمر طبيع2PPsHdCWي لأن أسماء الملفات والبيانات في الملفات قد تم تشفيرها بواسطة "Cerber Ransomware". وهذا يعني أنfv1OPEAQrQ الملفات الخاصة بك ليست تالفة! فقد تم تعديل ملفاتك فقط. ويمكن التراجع عن هذا. ومن الآن فإنه لا يكن استخدام الملفات الخاصة بك حتى يتم فك تشفيرها. الطريقة الوحيU49N5dدة لفك تشفير ملفاتك بأمان هو أن تشتري برنامج فك التشفير المتخصص "Cerber Decryptor". إن أية محاولات لاستعادةN2UpHPq8g الملفات الخاصة بك بواسطة برامج من طرف ثالث سوف تكون مدمرة لملفاتك! <hr> يمكنك الشروع في شراء برنامج فك التشفير من صفحتك الشخصية: أرجو الإنتظار...<a class="url" href="http://p27dokhpz2n7nvgr.12uzfa.top/C8DE-F8AE-2084-0099-35FC" target="_blank">http://p27dokhpz2n7nvgr.12uzfa.top/C8DE-F8AE-2084-0099-35FC</a><hr><a href="http://p27dokhpz2n7nvgr.12hygy.top/C8DE-F8AE-2084-0099-35FC" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/C8DE-F8AE-2084-0099-35FC</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/C8DE-F8AE-2084-0099-35FC" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/C8DE-F8AE-2084-0099-35FC</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/C8DE-F8AE-2084-0099-35FC" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/C8DE-F8AE-2084-0099-35FC</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/C8DE-F8AE-2084-0099-35FC" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/C8DE-F8AE-2084-0099-35FC</a> في حالة تعذر فتح هذه الصفحة  انقر هنا  لإنشاء عنوان جديد لصفحتك الشخصية. في هذه الصفحة سوف تتلقى تعليمات كاملة حول كيفية شراء برنامج فك التشفير لاستعادة جميع الملفات الخاصة بك. في هذه الصفحة أيضًا سوف تتمكن من استعادة ملف واحد بشكل مجاني للتأكد من أن "Cerber Decryptor" سوف يساعدك. <hr> إذا كانت صفحتك الشخصية غير متاحة لفترة طويلة فإن ثمّة طريقة أخرى لفتح صفحتك الشخصية - تحميل واستخدام متصفح Tor: <ol> <li>قم بتشغيل متصفح الإنترنت الخاص بك (إذا كنت لا تعرف ما هو قم بتشغيل إنترنت إكسبلورر);</li> <li>قم بكتابة أو نسخ العنوان <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> إلى شريط العنوان في المستعرض الخاص بك ثم اضغط ENTER;</li> <li>انتظر لتحميل الموقع;</li> <li>سوف يعرض عليك الموقع تحميل متصفح Tor. قم بتحميله وتشغيله، واتبع تعليمات التثبيت، وانتظر حتى اكتمال التثبيت;</li> <li>قم بتشغيل متصفح Tor;</li> <li>اضغط على الزر "Connect" (إذا كنت تستخدم النسخة الإنجليزية);</li> <li>سوف تُفتح نافذة متصفح الإنترنت العادي بعد البدء;</li> <li>قم بكتابة أو نسخ العنوان http://p27dokhpz2n7nvgr.onion/C8DE-F8AE-2084-0099-35FC في شريط العنوان في المتصفح;</li> <li>اضغط ENTER;</li> <li>يجب أن يتم تحميل الموقع؛ إذا لم يتم تحميل الموقع لأي سبب، انتظر للحظة وحاول مرة أخرى.</li> </ol> إذا كان لديك أية مشكلات أثناء عملية التثبيت أو استخدام متصفح Tor، يُرجى زيارة <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> واكتب الطلب "install tor browser windows" أو "تثبيت نوافذ متصفح Tor" في شريط البحث، وسوف تجد الكثير من أشرطة الفيديو للتدريب حول تثبيت متصفح Tor واستخدامه. <hr> معلومات إض5rimافية: سوف تجد 7إرشادات استعادة الملفات الخاصة بك ("*_READ_THIS_FILE_*") في أي مجلد مع ملفاتك المشفرة. الإرشادات ("*_REcfAD_THIS_FILE_*") الموجودة في المجلدات مع ملفاتك المشفرة ليست فيروسات والإرشادات ("*_READ_THIS_FILE_*") سوف تساعدك على فك تشفير الملفات الخاصة بك. تذكر أن أسوأ موقف قد حدث بالqofZBفعل، والآن مستقبل ملفاتك يعتمد على عزيمتك وسرعة الإجراءات الخاصة بك. </div> <div id="zh"> 您找不到所需的文件？ 您文件的内容无法阅读？ 这是正常的，因为您文件的文件名和数��

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___GV2CRP_.txt

cerber

Ransom Note

CERBER RANSOMWARE ----- YOUR DOCUMENTS, PHOT0S, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/C8DE-F8AE-2084-0099-35FC Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12uzfa.top/C8DE-F8AE-2084-0099-35FC 2. http://p27dokhpz2n7nvgr.12hygy.top/C8DE-F8AE-2084-0099-35FC 3. http://p27dokhpz2n7nvgr.14ewqv.top/C8DE-F8AE-2084-0099-35FC 4. http://p27dokhpz2n7nvgr.14vvrc.top/C8DE-F8AE-2084-0099-35FC 5. http://p27dokhpz2n7nvgr.129p1t.top/C8DE-F8AE-2084-0099-35FC ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://p27dokhpz2n7nvgr.onion/C8DE-F8AE-2084-0099-35FC
http://p27dokhpz2n7nvgr.12uzfa.top/C8DE-F8AE-2084-0099-35FC
http://p27dokhpz2n7nvgr.12hygy.top/C8DE-F8AE-2084-0099-35FC
http://p27dokhpz2n7nvgr.14ewqv.top/C8DE-F8AE-2084-0099-35FC
http://p27dokhpz2n7nvgr.14vvrc.top/C8DE-F8AE-2084-0099-35FC
http://p27dokhpz2n7nvgr.129p1t.top/C8DE-F8AE-2084-0099-35FC

Signatures

Family: Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2186	4716	mshta.exe
2187	4716	mshta.exe
2188	4716	mshta.exe
2189	4716	mshta.exe
2190	4716	mshta.exe
2191	4716	mshta.exe
2192	4716	mshta.exe
2193	4716	mshta.exe
2194	4716	mshta.exe

Contacts a large (1103) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2332	netsh.exe
4744	netsh.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\desktop	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat!	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat!	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\documents	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpBB57.bmp"	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\thunderbird	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\program files (x86)\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\program files (x86)\the bat!	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\program files (x86)\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\program files (x86)\	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\program files (x86)\microsoft\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\program files (x86)\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\program files (x86)\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\program files (x86)\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\program files (x86)\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\program files (x86)\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\program files (x86)\microsoft\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\program files (x86)\microsoft\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\program files (x86)\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\program files (x86)\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\program files\	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\program files (x86)\bitcoin	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\program files (x86)\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\program files (x86)\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\program files (x86)\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\desktop	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\desktop	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\documents	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat!	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\the bat!	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mshta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mshta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5616	PING.EXE

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2900	taskkill.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1976	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5616	PING.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5028	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
Token: SeCreatePagefilePrivilege	5028	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
Token: SeDebugPrivilege	2900	taskkill.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 2332	5028	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe	89
PID 5028 wrote to memory of 4744	5028	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe	91
PID 5028 wrote to memory of 4716	5028	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe	94
PID 5028 wrote to memory of 1976	5028	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe	95
PID 5028 wrote to memory of 1508	5028	jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe	97
PID 1508 wrote to memory of 2900	1508	cmd.exe	99
PID 1508 wrote to memory of 5616	1508	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe"
1⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2332
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4744
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___110S1Y_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - Badlisted process makes network request
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4716
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___EYU0J_.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Opens file in notepad (likely ransom note)
  PID:1976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im "jaffacakes118_Trojan-Ransom.Win32.Zerber.fstl.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

_R_E_A_D___T_H_I_S___41LD8GWA_.hta

Path C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___41LD8GWA_.hta
Size 75KB
SHA256 d5540001f63426c27bb493e373a8519fce78caeb23c279e6e7167e3ae58948bf
MD5 70f4db6ea784b354d0d5682a83d11f54
SHA1 f4f19e4376ce0143342c0bd9ad64ce58f827a58f
SHA512 2075f0e0ca89dfb69b243707614ead39ac165986212c5626fdb9b06fbe2d21628ccda9cfc96ded500b61656ed630c6691181856006b9b68f5b0c94312f8263b9
SSDEEP 1536:yFGbT8eA6XHQU3oYVKUBC4m9CqMo6nyglnjg52uzMa:dLdoIKL9nMoGjZk5Dl
TLSH
T14473E98875EDA01B0B11C6CB217AA310E4AFF8F1C54173B3F4BF86372079865A55A6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_R_E_A_D___T_H_I_S___GV2CRP_.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___GV2CRP_.txt
Size 1KB
SHA256 6a6623c0557e85b40ecfc70338ce271ab0da322547bd39bb128498db3404358f
MD5 5b1a7081cfb24e73723dcc1621cd38e4
SHA1 258c3dc48865862aa1a858f65f9d1bf496010a49
SHA512 256f659c57e9fd9e89cc264cbf4624f1a7854ad2c3ae3004f8ae552f4f8acd925ee0433d968ddbd37f8bb044087866e3b3fd682f5a1f8562d211cfbea5569e80
TLSH
T1DA21FE0E5D99E1405B42C1B633364461DB93B18EB98923E2F81A8D052634D3A477E786
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5028-0-0x0000000000590000-0x0000000000591000-memory.dmp

Download

memory/5028-1-0x00000000005A0000-0x00000000005A1000-memory.dmp

Download

memory/5028-2-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5028-3-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5028-4-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5028-5-0x00000000005A0000-0x00000000005A1000-memory.dmp

Download

memory/5028-6-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5028-603-0x0000000000400000-0x000000000043E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads