File name:

Ransomware.Cerber.zip

Full analysis: https://app.any.run/tasks/361307cb-23fb-4fca-9345-74c9dc91a67c
Verdict: Malicious activity
Threats:

Cerber is a Ransomware-as-a-Service (RaaS) that appeared in 2016, spread quickly and has been evolving since. It became well-known for its file encryption, offline capabilities, and sophisticated evasion techniques. It primarily targets enterprises, financial institutions, and government entities, encrypting their data and demanding ransom payments in Bitcoin. It also targets everyday users encrypting personal files (photos, documents) with the risk of their permanent loss.

Malware Trends Tracker     >>>
Analysis date: December 02, 2023, 21:14:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
cerber
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

5C571C69DD75C30F95FE280CA6C624E9

SHA1:

B0610FC5D35478C4B95C450B66D2305155776B56

SHA256:

416774BF62D9612D11D561D7E13203A3CBC352382A8E382ADE3332E3077E096C

SSDEEP:

3072:EJk9kcytz1Qg4kViSMoq9OsLvz8L5HINY8lYdeIX8woWJQHr6LqK2fU0MwL0b06R:EUkcyVlDq8rIblYomoWnvfp0g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • CERBER has been detected (SURICATA)

      • cerber.exe (PID: 1924)

    • Connects to the CnC server

      • cerber.exe (PID: 1924)

    • Actions looks like stealing of personal data

      • cerber.exe (PID: 1924)

  • SUSPICIOUS

    • Start notepad (likely ransomware note)

      • cerber.exe (PID: 1924)

    • Reads the Internet Settings

      • cerber.exe (PID: 1924)
      • mshta.exe (PID: 2464)

    • Creates files like ransomware instruction

      • cerber.exe (PID: 1924)

    • Starts CMD.EXE for commands execution

      • cerber.exe (PID: 1924)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2764)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 2764)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 844)

    • Reads the machine GUID from the registry

      • cerber.exe (PID: 1924)

    • Checks supported languages

      • cerber.exe (PID: 1924)

    • Reads the computer name

      • cerber.exe (PID: 1924)

    • Create files in a temporary directory

      • cerber.exe (PID: 1924)

    • Dropped object may contain TOR URL's

      • cerber.exe (PID: 1924)

    • Creates files or folders in the user directory

      • cerber.exe (PID: 1924)

    • The dropped object may contain a URL to Tor Browser

      • cerber.exe (PID: 1924)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 2464)

    • Checks proxy server information

      • mshta.exe (PID: 2464)

    • Manual execution by a user

      • WINWORD.EXE (PID: 3832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 788
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2017:05:23 21:17:36
ZipCRC: 0xed332b67
ZipCompressedSize: 220092
ZipUncompressedSize: 619008
ZipFileName: cerber.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs #CERBER cerber.exe mshta.exe notepad.exe no specs winword.exe no specs cmd.exe no specs taskkill.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
844"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Ransomware.Cerber.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1852"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\_R_E_A_D___T_H_I_S___C9YET3_.txtC:\Windows\System32\notepad.exe—cerber.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1924"C:\Users\admin\AppData\Local\Temp\Rar$EXb844.18500\cerber.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb844.18500\cerber.exe
WinRAR.exe
User:
admin
Company:
Elaborate Bytes AG
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb844.18500\cerber.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2072ping -n 1 127.0.0.1 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
2464"C:\Windows\System32\mshta.exe" "C:\Users\admin\Desktop\_R_E_A_D___T_H_I_S___4DXLY68_.hta" C:\Windows\System32\mshta.exe
cerber.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2764"C:\Windows\system32\cmd.exe"C:\Windows\System32\cmd.exe—cerber.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3176taskkill /f /im "cerber.exe" C:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
3832"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\variouswaste.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
Total events
4 724
Read events
4 230
Write events
359
Delete events
135

Modification events

(PID) Process:(844) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(844) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
2
Suspicious files
34
Text files
25
Unknown types
4

Dropped files

PID
Process
Filename
Type
1924cerber.exeC:\users\admin\appdata\roaming\microsoft\onenote\14.0\preferences.datbinary
MD5:136B08BB3F68D3DA755DB35C09CA0D6F
SHA256:45A8991E16DF346912AFD1E32C0394D673538AFBE6CA7D3F0452304F7CE3A615
1924cerber.exeC:\users\admin\appdata\roaming\microsoft\outlook\nomail.srsbinary
MD5:25DCE7A37A5842C14077E6B6D6DFF7E7
SHA256:B12044B56D965DBE7DEC03B4BD220150EB6C4B49A0111ED9D81A88E874193B4B
1924cerber.exeC:\users\admin\appdata\roaming\microsoft\onenote\14.0\_R_E_A_D___T_H_I_S___BEMKED05_.htahtml
MD5:FFB6FBCD5B7F244899DDE1A693288D52
SHA256:953A492599A15A0BFFB885F207F0E1C65E79F28AC01D8BC0240D65FDC0FC278D
1924cerber.exeC:\Users\admin\AppData\Roaming\Microsoft\Outlook\Fk6vLgftIK.b58dbinary
MD5:47576DE54BA52A3B1923E9B386871CBC
SHA256:3317430DDFE9F9A5017A612CCCB1DF25B04870E76641C200DA69B2F3372D1DB5
1924cerber.exeC:\users\admin\appdata\roaming\microsoft\onenote\14.0\_R_E_A_D___T_H_I_S___B24B4_.txttext
MD5:958C73CD8395B5FCE1ACDEC7DFB96AD4
SHA256:2AE9F856CB6CD4D1561D11E9E67FCB3CFCEEC0062A35723154E0BBFB12475BA4
1924cerber.exeC:\users\admin\appdata\roaming\microsoft\outlook\_R_E_A_D___T_H_I_S___MQF7P_.htahtml
MD5:FFB6FBCD5B7F244899DDE1A693288D52
SHA256:953A492599A15A0BFFB885F207F0E1C65E79F28AC01D8BC0240D65FDC0FC278D
1924cerber.exeC:\Users\admin\AppData\Local\Temp\90059c37\1320.tmpbinary
MD5:1211043A9B65C4011753F24532B43F42
SHA256:8329BC658217C173F7A7A426A584D2E16F0A353F468E29DD9992AC709147B589
1924cerber.exeC:\Users\admin\AppData\Roaming\Microsoft\Outlook\1TWnHteFii.b58dbinary
MD5:25DCE7A37A5842C14077E6B6D6DFF7E7
SHA256:B12044B56D965DBE7DEC03B4BD220150EB6C4B49A0111ED9D81A88E874193B4B
1924cerber.exeC:\users\admin\documents\averagedesigned.rtftext
MD5:1A468464E5633D86448EA042AEFAB1B2
SHA256:5DEDA7BAA1241F697AB5D26FFDB7728436F7523183B5C78F3338CDF028135240
1924cerber.exeC:\Users\admin\AppData\Roaming\Microsoft\Outlook\o-7qDnp-Ti.b58dbinary
MD5:1F1F50D936D4EC492E25DB24FC9C0D38
SHA256:05938C8D5F8386262F33D2B456A449D95DEBB93C15F392A574867387BF887229
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2 182
DNS requests
2
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1924
cerber.exe
178.33.158.1:6893
—
—
—
unknown
1924
cerber.exe
178.33.158.7:6893
—
—
—
unknown
1924
cerber.exe
178.33.158.3:6893
—
—
—
unknown
1924
cerber.exe
178.33.158.0:6893
—
—
—
unknown
1924
cerber.exe
178.33.158.4:6893
—
—
—
unknown
1924
cerber.exe
178.33.158.2:6893
—
—
—
unknown

DNS requests

Domain
IP
Reputation
api.blockcypher.com
  • 172.67.2.88
  • 104.20.21.251
  • 104.20.20.251
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
1924
cerber.exe
Malware Command and Control Activity Detected
ET MALWARE Ransomware/Cerber Checkin M3 (2)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Ransomware.Cerber.zip