cerber | fae29529c809d1610d0b789f22ed8a16f0bba04d7327c9ac27a5e9e1abef94e0

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/10/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
Size 518KB
Sample261016-e2ljvahs6p
SHA256 fae29529c809d1610d0b789f22ed8a16f0bba04d7327c9ac27a5e9e1abef94e0
MD5 b8e0cb2dbf3ef5495f5f38cd60733959
SHA1 4a070e67fdd4a5aa59a594ab74031a6d354af2d4
SHA512 57dbf02e15c4bbd9e5ece2c4803763cfe4db903c13547439999c89b5df1cc6c2b8cae5f4e815a32922a0f9174d8e07cacc963b018cf7d459985af1d9a008f0d9
SSDEEP 6144:6kMGtHMD7silby4kx1dWuKDNY89SZ/yNJwFZQlyEB:6k9HDilby4kxrWuKDNYmSENJws1
TLSH
T193B4F1C29372FEADDD09847613FDC47A25722C348622854BD792B22DA93799138EDF13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery cerber persistence privilege_escalation ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_READ_THIS_FILE_EZTOF_.hta

cerber

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>CERBER RANSOMWARE: Instructions</title> <HTA:APPLICATION APPLICATIONNAME="iZQlXHXAax" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style type="text/css"> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 13pt; line-height: 19pt; } body, h1 { margin: 0; padding: 0; } hr { color: #bda; height: 2pt; margin: 1.5%; } h1 { color: #555; font-size: 14pt; } ol { padding-left: 2.5%; } ol li { padding-bottom: 13pt; } small { color: #555; font-size: 11pt; } ul { list-style-type: none; margin: 0; padding: 0; } .button { color: #04a; cursor: pointer; } .button:hover { text-decoration: underline; } .container { background-color: #fff; border: 2pt solid #c7c7c7; margin: 5%; min-width: 850px; padding: 2.5%; } .header { border-bottom: 2pt solid #c7c7c7; margin-bottom: 2.5%; padding-bottom: 2.5%; } .h { display: none; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { background-color: #efe; border: 2pt solid #bda; display: inline-block; padding: 1.5%; text-align: center; } .updating { color: red; display: none; padding-left: 35px; background: url("data:image/gif;base64,R0lGODlhGQAZAKIEAMzMzJmZmTMzM2ZmZgAAAAAAAAAAAAAAACH/C05FVFNDQVBFMi4wAwEAAAAh+QQFAAAEACwAAAAAGQAZAAADVki63P4wSEiZvLXemRf4yhYoQ0l9aMiVLISCDms+L/DIwwnfc+c3qZ9g6Hn5hkhF7YgUKI2dpvNpExJ/WKquSoMCvd9geDeuBpcuGFrcQWep5Df7jU0AACH5BAUAAAQALAoAAQAOABQAAAMwSLDU/iu+Gdl0FbTAqeXg5YCdSJCBuZVqKw5wC8/qHJv2IN+uKvytn9AnFBCHx0cCACH5BAUAAAQALAoABAAOABQAAAMzSLoEzrC5F9Wk9YK6Jv8gEYzgaH4myaVBqYbfIINyHdcDI+wKniu7YG+2CPI4RgFI+EkAACH5BAUAAAQALAQACgAUAA4AAAMzSLrcBNDJBeuUNd6WwXbWtwnkFZwMqUpnu6il06IKLChDrsxBGufAHW0C1IlwxeMieEkAACH5BAUAAAQALAEACgAUAA4AAAM0SLLU/lAtFquctk6aIe5gGA1kBpwPqVZn66hl1KINPDRB3sxAGufAHc0C1IkIxcARZ4QkAAAh+QQFAAAEACwBAAQADgAUAAADMUhK0vurSfiko8oKHC//yyCCYvmVI4cOZAq+UCCDcv3VM4cHCuDHOZ/wI/xxigDQMAEAIfkEBQAABAAsAQABAA4AFAAAAzNIuizOkLgZ13xraHVF1puEKWBYlUP1pWrLBLALz+0cq3Yg324PAUAXcNgaBlVGgPAISQAAIfkEBQAABAAsAQABABQADgAAAzRIujzOMBJHpaXPksAVHoogMlzpZWK6lF2UjgobSK9AtjSs7QTg8xCfELgQ/og9I1IxXCYAADs=") left no-repeat; } #change_language { float: right; } #change_language, #texts div { display: none; } </style> </head> <body> <div class="container"> <div class="header"> <a id="change_language" href="#" onclick="return changeLanguage1();" title="English">☑ English</a> <h1>CERBER RANSOMWARE</h1> Instructions </div> <div id="languages"> ☑ Select your language <ul> <li><a href="#" title="English" onclick="return showBlock('en');">English</a></li> <li><a href="#" title="Arabic" onclick="return showBlock('ar');">العربية</a></li> <li><a href="#" title="Chinese" onclick="return showBlock('zh');">中文</a></li> <li><a href="#" title="Dutch" onclick="return showBlock('nl');">Nederlands</a></li> <li><a href="#" title="French" onclick="return showBlock('fr');">Français</a></li> <li><a href="#" title="German" onclick="return showBlock('de');">Deutsch</a></li> <li><a href="#" title="Italian" onclick="return showBlock('it');">Italiano</a></li> <li><a href="#" title="Japanese" onclick="return showBlock('ja');">日本語</a></li> <li><a href="#" title="Korean" onclick="return showBlock('ko');">한국어</a></li> <li><a href="#" title="Polish" onclick="return showBlock('pl');">Polski</a></li> <li><a href="#" title="Portuguese" onclick="return showBlock('pt');">Português</a></li> <li><a href="#" title="Spanish" onclick="return showBlock('es');">Español</a></li> <li><a href="#" title="Turkish" onclick="return showBlock('tr');">Türkçe</a></li> </ul> </div> <div id="texts"> <div id="en"> Can't yoIeVdvrgsu find the necessary files? Is the cgz1hkontent of your files not readable? It is normal benzaUU3nGtcause the files' names and the data in your files have been encrypdpAHted by "Ce3Vfrber Ransomware". It meuKPfrLp9Eans your files are NOT damageygRUwXEkrd! Your files are modified only. This modification is reversible. FY5Ty7rom now it is not possqoible to use your files until they will be decrypted. The only way to dec2rypt your files safely is to buy the special decryption software "CAoDtaRG8ZQerber Decryptor". Any attempts to restU0Qqore your files with the thirE8r8Lved-party software will be fatal for your files! <hr> You can procKRJByveed with purchasing of the decryption softw58are at your personal page: PlembzoVase wait...<a class="url" href="http://p27dokhpz2n7nvgr.1jzmjr.top/9826-260F-444B-0446-9F82" target="_blank">http://p27dokhpz2n7nvgr.1jzmjr.top/9826-260F-444B-0446-9F82</a><hr><a href="http://p27dokhpz2n7nvgr.12hxjv.top/9826-260F-444B-0446-9F82" target="_blank">http://p27dokhpz2n7nvgr.12hxjv.top/9826-260F-444B-0446-9F82</a><hr><a href="http://p27dokhpz2n7nvgr.1pbfky.top/9826-260F-444B-0446-9F82" target="_blank">http://p27dokhpz2n7nvgr.1pbfky.top/9826-260F-444B-0446-9F82</a><hr><a href="http://p27dokhpz2n7nvgr.1wmvk2.top/9826-260F-444B-0446-9F82" target="_blank">http://p27dokhpz2n7nvgr.1wmvk2.top/9826-260F-444B-0446-9F82</a><hr><a href="http://p27dokhpz2n7nvgr.1kyjw7.top/9826-260F-444B-0446-9F82" target="_blank">http://p27dokhpz2n7nvgr.1kyjw7.top/9826-260F-444B-0446-9F82</a> If tddzUQjMFXLhis page cannot be opened  cliksKyM96Gck here  to get a new addrVyazvess of your personal page. If the addrekQuywss of your personal page is the same as befoAre after you tried to get a new one, you cpSgfhE63an try to get a new address in one hour. At th8DIlakfajis page you will receive the complete instr4M0nNuctions how to buy the decryptiBHon software for restoring all your files. Also at this page you will be able to resoh9Zcktore any one file for free to be sure "Cerbeoobyar Decryptor" will help you. <hr> If your pernsonal page is not availa1pUFble for a long period there is another way to open your personal page - insta6J2WF2pX5llation and use of Tor Browser: <ol> <li>run your InteXiXPrnet browser (if you do not know what it is run the Internet Explorer);</li> <li>entNazBbVUer or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loadaNncqing;</li> <li>on the site you will be offered to donPiThUM7Bwnload Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>ruhYblwEn Tor Browser;</li> <li>connect with the buttBZSB0aon "Connect" (if you use the English version);</li> <li>a normal Internet broVFdswser window will be opened after the initialization;</li> <li>type or copy the add3tjcOAkress http://p27dokhpz2n7nvgr.onion/9826-260F-444B-0446-9F82 in this browser address bar;</li> <li>preNzK3gCqss ENTER;</li> <li>the site shoQyL5grEdzDuld be loaded; if for some reason the site is not lo4TKPfhp9ading wait for a moment and try again.</li> </ol> If you have any pr06ButZoblems during installation or use of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> and type request in the searcjh bar "Install Tor Browser Windows" and you will find a lot of training videos about Tor Browser installation and use. <hr> AdditAIeional information: You will fieIrnd the instruWPctions ("*_READ_THIS_FILE_*.hta") for re5F1sstoring your files in any fuaiEolder with your encMOyIWrypted files. The instrz3pcqQuctions "*_READ_THIS_FILE_*.hta" in the faolderhA0DJx3Rs with your encryeskpted files are not virEguses! The instrucQwxvheBtions "*_READ_THIS_FILE_*.hta" will heTJwlp you to decdyrypt your files. Remembe8cr! The worst siituation already happ2ened and now the future of your files deI6UIpends on your determIJYfOdfFjination and speed of your actions. </div> <div id="ar" style="direction: rtl;"> لا يمكنك العثور على الملفات الضرورية؟ هل محتوى الملفات غير قابل للقراءة؟ هذا أمر طبيعي لأن أسماء الملفات والبيانات في الملفات قد تم تشفيرها بواسطة "Cerber Ransomware". وهذا يعني أن الملفات الخاصة بك ليست تالفة! فقد تم تعديل ملفاتك فقط. ويمكن التراجع عن هذا. ومن الآن فإنه لا يكن استخدام الملفات الخاصة بك حتى يتم فك تشفيرها. الطريقة الوحيدة لفك تشفير ملفاتك بأمان هو أن تشتري برنامج فك التشفير المتخصص "Cerber Decryptor". إن أية محاولات لاستعادة الملفات الخاصة بك بواسطة برامج من طرف ثالث سوف تكون مدمرة لملفاتك! <hr> يمكنك الشروع في شراء برنامج فك التشفير من صفحتك الشخصية: أرجو الإنتظار...<a class="url" href="http://p27dokhpz2n7nvgr.1jzmjr.top/9826-260F-444B-0446-9F82" target="_blank">http://p27dokhpz2n7nvgr.1jzmjr.top/9826-260F-444B-0446-9F82</a><hr><a href="http://p27dokhpz2n7nvgr.12hxjv.top/9826-260F-444B-0446-9F82" target="_blank">http://p27dokhpz2n7nvgr.12hxjv.top/9826-260F-444B-0446-9F82</a><hr><a href="http://p27dokhpz2n7nvgr.1pbfky.top/9826-260F-444B-0446-9F82" target="_blank">http://p27dokhpz2n7nvgr.1pbfky.top/9826-260F-444B-0446-9F82</a><hr><a href="http://p27dokhpz2n7nvgr.1wmvk2.top/9826-260F-444B-0446-9F82" target="_blank">http://p27dokhpz2n7nvgr.1wmvk2.top/9826-260F-444B-0446-9F82</a><hr><a href="http://p27dokhpz2n7nvgr.1kyjw7.top/9826-260F-444B-0446-9F82" target="_blank">http://p27dokhpz2n7nvgr.1kyjw7.top/9826-260F-444B-0446-9F82</a> في حالة تعذر فتح هذه الصفحة  انقر هنا  لإنشاء عنوان جديد لصفحتك الشخصية. في هذه الصفحة سوف تتلقى تعليمات كاملة حول كيفية شراء برنامج فك التشفير لاستعادة جميع الملفات الخاصة بك. في هذه الصفحة أيضًا سوف تتمكن من استعادة ملف واحد بشكل مجاني للتأكد من أن "Cerber Decryptor" سوف يساعدك. <hr> إذا كانت صفحتك الشخصية غير متاحة لفترة طويلة فإن ثمّة طريقة أخرى لفتح صفحتك الشخصية - تحميل واستخدام متصفح Tor: <ol> <li>قم بتشغيل متصفح الإنترنت الخاص بك (إذا كنت لا تعرف ما هو قم بتشغيل إنترنت إكسبلورر);</li> <li>قم بكتابة أو نسخ العنوان <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> إلى شريط العنوان في المستعرض الخاص بك ثم اضغط ENTER;</li> <li>انتظر لتحميل الموقع;</li> <li>سوف يعرض عليك الموقع تحميل متصفح Tor. قم بتحميله وتشغيله، واتبع تعليمات التثبيت، وانتظر حتى اكتمال التثبيت;</li> <li>قم بتشغيل متصفح Tor;</li> <li>اضغط على الزر "Connect" (إذا كنت تستخدم النسخة الإنجليزية);</li> <li>سوف تُفتح نافذة متصفح الإنترنت العادي بعد البدء;</li> <li>قم بكتابة أو نسخ العنوان http://p27dokhpz2n7nvgr.onion/9826-260F-444B-0446-9F82 في شريط العنوان في المتصفح;</li> <li>اضغط ENTER;</li> <li>يجب أن يتم تحميل الموقع؛ إذا لم يتم تحميل الموقع لأي سبب، انتظر للحظة وحاول مرة أخرى.</li> </ol> إذا كان لديك أية مشكلات أثناء عملية التثبيت أو استخدام متصفح Tor، يُرجى زيارة <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> واكتب الطلب "install tor browser windows" أو "تثبيت نوافذ متصفح Tor" في شريط البحث، وسوف تجد الكثير من أشرطة الفيديو للتدريب حول تثبيت متصفح Tor واستخدامه. <hr> معلومات إض8Igm9افية: س8mUOوف تجد إرشادات استعادة الملفات الخاصة بك ("*_READ_THIS_FILE_*") في أي مجلد مع ملفاتك المشفرة. الإرش0MWادات ("*_READ_THIS_FILE_*") الموجودة في المجلدات مع ملفاتك المشفرة ليست فيروسات والإرشادات ("*_READ_THIS_FILE_*") سوف تساعدك على فك تشفير الملفات الخاصة بك. تذكر أن أسوأ موYmRقف قد حدث بالفعل، والآن مستقبل ملفاتك يعتمد على عزيمتك وسرعة الإجراءات الخاصة بك. </div> <div id="zh"> 您找不到所需的文件？ 您文件的内容无法阅读？ 这是正常的，因为您文件的文件名和数据已经被“Cerber Ransomware”加密了。 这意味着您的文件并没有损坏！您的文件

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_READ_THIS_FILE_IX9V_.txt

Ransom Note

----- "CERBER RANSOMWARE" ----- YOUR DOCUMENTS, PHOTOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED ----- The only way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/9826-260F-444B-0446-9F82 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.1jzmjr.top/9826-260F-444B-0446-9F82 2. http://p27dokhpz2n7nvgr.12hxjv.top/9826-260F-444B-0446-9F82 3. http://p27dokhpz2n7nvgr.1pbfky.top/9826-260F-444B-0446-9F82 4. http://p27dokhpz2n7nvgr.1wmvk2.top/9826-260F-444B-0446-9F82 5. http://p27dokhpz2n7nvgr.1kyjw7.top/9826-260F-444B-0446-9F82 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://p27dokhpz2n7nvgr.onion/9826-260F-444B-0446-9F82
http://p27dokhpz2n7nvgr.1jzmjr.top/9826-260F-444B-0446-9F82
http://p27dokhpz2n7nvgr.12hxjv.top/9826-260F-444B-0446-9F82
http://p27dokhpz2n7nvgr.1pbfky.top/9826-260F-444B-0446-9F82
http://p27dokhpz2n7nvgr.1wmvk2.top/9826-260F-444B-0446-9F82
http://p27dokhpz2n7nvgr.1kyjw7.top/9826-260F-444B-0446-9F82

Signatures

Family: Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2222	2228	mshta.exe
2225	2228	mshta.exe
2227	2228	mshta.exe
2231	2228	mshta.exe

Contacts a large (1109) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3196	netsh.exe
1480	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\desktop	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat!	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\documents	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat!	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3816 set thread context of 1780	3816	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe	97

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\program files (x86)\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\program files (x86)\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\program files (x86)\microsoft\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\program files (x86)\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\program files (x86)\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\program files (x86)\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\program files (x86)\microsoft\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\program files (x86)\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\program files (x86)\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\program files (x86)\thunderbird	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\program files (x86)\	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\program files (x86)\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\program files (x86)\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\program files (x86)\bitcoin	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\program files (x86)\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\program files (x86)\microsoft\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\program files (x86)\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\program files (x86)\the bat!	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\program files\	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\documents	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\desktop	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat!	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\desktop	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\documents	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat!	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\the bat!	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mshta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mshta.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3824	PING.EXE

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4468	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3784	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3824	PING.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1780	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
Token: SeCreatePagefilePrivilege	1780	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
Token: SeDebugPrivilege	4468	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3816	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
3816	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3816	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
3816	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3816	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 1780	3816	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe	97
PID 3816 wrote to memory of 1780	3816	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe	97
PID 3816 wrote to memory of 1780	3816	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe	97
PID 3816 wrote to memory of 1780	3816	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe	97
PID 3816 wrote to memory of 1780	3816	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe	97
PID 3816 wrote to memory of 1780	3816	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe	97
PID 1780 wrote to memory of 3196	1780	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe	100
PID 1780 wrote to memory of 1480	1780	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe	102
PID 1780 wrote to memory of 2228	1780	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe	106
PID 1780 wrote to memory of 3784	1780	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe	107
PID 1780 wrote to memory of 2404	1780	jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe	110
PID 2404 wrote to memory of 4468	2404	cmd.exe	112
PID 2404 wrote to memory of 3824	2404	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe"
  2⤵
  - Checks computer location settings
  - Creates a file in the Startup directory
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\SysWOW64\netsh.exe
    C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3196
- - C:\Windows\SysWOW64\netsh.exe
    C:\Windows\system32\netsh.exe advfirewall reset
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1480
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_READ_THIS_FILE_EOE6P_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Badlisted process makes network request
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:2228
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_READ_THIS_FILE_14RNHS_.txt
    3⤵
    - System Location Discovery: System Language Discovery
    - Opens file in notepad (likely ransom note)
    PID:3784
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "jaffacakes118_Trojan-Ransom.Win32.Zerber.eaiv.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4468
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_READ_THIS_FILE_EZTOF_.hta

Path C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_READ_THIS_FILE_EZTOF_.hta
Size 75KB
SHA256 6d3f925933e5385c14d6a3ac334da3214e00e6470049228c983e16084dc8a557
MD5 5b8f45a35245bccd1004c8c709348a5a
SHA1 d7fdba480aea72aa2d4687be9bb394fbfc1118b5
SHA512 295625e97606eb4f82537f9a24a3fa2fc98d022d8c81b9c88a1072b9d5a98af7c9b01dd800344dbca08d2da5ed20471a46b4c57c8bbdc402cd6c85783c0f2715
SSDEEP 1536:HfVQS5BAniHejZohV/XE30m9CqMohnygOnjg52uzM6:jSVoj/u9nMo5jik5Dz
TLSH
T16473C68D70CDE0970B918AE71275E744E0ABE8B1C9817376F1BF4933654A463E60B4FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_READ_THIS_FILE_IX9V_.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_READ_THIS_FILE_IX9V_.txt
Size 1KB
SHA256 57e2a319fb7b5e4ce038f03b77d6f4219b5813b0ab6078d0d46a580ea3eaf11c
MD5 4701e5329959477904fc0fa83dbe1049
SHA1 c258ffee6a7a29c21db21bef51344ac8e5fb8de6
SHA512 b5ea8cc53e83dc1e8d400c537ec06da12e6db46480b1822784b14df458a9675988b6a7d1953c4eaa6994972e5ad8c512c9df96e038667f9b8ef5e326606a7325
TLSH
T16721DC0F2CC1D1C26BC9D9F23336D895D7D3218DBA9913A1B85788031B20933976F08A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1780-2-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1780-4-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1780-5-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1780-6-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1780-7-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1780-10-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1780-580-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1780-605-0x0000000000400000-0x0000000000437000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads