| download: | Cerber%205.zip |
| Full analysis: | https://app.any.run/tasks/604d34e7-909d-4e4c-bb8d-179c47a8cc5b |
| Verdict: | Malicious activity |
| Threats: | Cerber is a Ransomware-as-a-Service (RaaS) that appeared in 2016, spread quickly and has been evolving since. It became well-known for its file encryption, offline capabilities, and sophisticated evasion techniques. It primarily targets enterprises, financial institutions, and government entities, encrypting their data and demanding ransom payments in Bitcoin. It also targets everyday users encrypting personal files (photos, documents) with the risk of their permanent loss. |
| Analysis date: | November 29, 2020, 21:57:05 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | 10D74DE972A374BB9B35944901556F5F |
| SHA1: | 593F11E2AA70A1508D5E58EA65BEC0AE04B68D64 |
| SHA256: | AB9F6AC4A669E6CBD9CFB7F7A53F8D2393CD9753CC1B1F0953F8655D80A4A1DF |
| SSDEEP: | 3072:1rdfCdJA9AZODSf1MIH34E8Ylcg16hK1z0mZiPS6weJ2vbYEzoN:LfuA2D1MIHl8Ylt151z0mZiPSM2vbY7 |
MALICIOUS
Connects to CnC server
- Endermanch@Cerber5.exe (PID: 3816)
CERBER was detected
- Endermanch@Cerber5.exe (PID: 3816)
Actions looks like stealing of personal data
- Endermanch@Cerber5.exe (PID: 3816)
Application was dropped or rewritten from another process
- Endermanch@Cerber5.exe (PID: 3816)
Runs PING.EXE for delay simulation
- cmd.exe (PID: 2504)
SUSPICIOUS
Executable content was dropped or overwritten
- WinRAR.exe (PID: 2460)
Creates a directory in Program Files
- Endermanch@Cerber5.exe (PID: 3816)
Creates files in the user directory
- Endermanch@Cerber5.exe (PID: 3816)
Creates files like Ransomware instruction
- Endermanch@Cerber5.exe (PID: 3816)
Starts MSHTA.EXE for opening HTA or HTMLS files
- Endermanch@Cerber5.exe (PID: 3816)
Starts CMD.EXE for commands execution
- Endermanch@Cerber5.exe (PID: 3816)
Uses TASKKILL.EXE to kill process
- cmd.exe (PID: 2504)
Starts CMD.EXE for self-deleting
- Endermanch@Cerber5.exe (PID: 3816)
INFO
Manual execution by user
- Endermanch@Cerber5.exe (PID: 3816)
- taskmgr.exe (PID: 524)
Dropped object may contain TOR URL's
- Endermanch@Cerber5.exe (PID: 3816)
Dropped object may contain URL to Tor Browser
- Endermanch@Cerber5.exe (PID: 3816)
Dropped object may contain Bitcoin addresses
- Endermanch@Cerber5.exe (PID: 3816)
Reads internet explorer settings
- mshta.exe (PID: 2680)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0001 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2017:07:21 19:32:01 |
| ZipCRC: | 0x5a9c3957 |
| ZipCompressedSize: | 185442 |
| ZipUncompressedSize: | 320760 |
| ZipFileName: | Endermanch@Cerber5.exe |
Total processes
46
Monitored processes
8
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 524 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\system32\taskmgr.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1300 | ping -n 1 127.0.0.1 | C:\Windows\system32\PING.EXE | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2460 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\61ef82af-6d37-4bb4-8a5d-b1ff03ed9ad6.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 2504 | "C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "E" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit | C:\Windows\system32\cmd.exe | — | Endermanch@Cerber5.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2680 | "C:\Windows\System32\mshta.exe" "C:\Users\admin\Desktop\_R_E_A_D___T_H_I_S___W46J_.hta" | C:\Windows\System32\mshta.exe | — | Endermanch@Cerber5.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) HTML Application host Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 2880 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\_R_E_A_D___T_H_I_S___W5U0J_.txt | C:\Windows\system32\NOTEPAD.EXE | — | Endermanch@Cerber5.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3444 | taskkill /f /im "E" | C:\Windows\system32\taskkill.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3816 | "C:\Users\admin\Desktop\61ef82af-6d37-4bb4-8a5d-b1ff03ed9ad6\Endermanch@Cerber5.exe" | C:\Users\admin\Desktop\61ef82af-6d37-4bb4-8a5d-b1ff03ed9ad6\Endermanch@Cerber5.exe | explorer.exe | ||||||||||||
User: admin Company: Acro Software Inc. Integrity Level: MEDIUM Description: PDF Writer Application Exit code: 0 Version: 2, 7, 7, 1 Modules
| |||||||||||||||
Total events
523
Read events
489
Write events
34
Delete events
0
Modification events
| (PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\61ef82af-6d37-4bb4-8a5d-b1ff03ed9ad6.zip | |||
| (PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\61ef82af-6d37-4bb4-8a5d-b1ff03ed9ad6 | |||
| (PID) Process: | (2460) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 0 | |||
Executable files
1
Suspicious files
5
Text files
28
Unknown types
7
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3816 | Endermanch@Cerber5.exe | C:\users\admin\appdata\roaming\microsoft\onenote\14.0\preferences.dat | — | |
MD5:— | SHA256:— | |||
| 3816 | Endermanch@Cerber5.exe | C:\users\admin\documents\communicationsuses.rtf | — | |
MD5:— | SHA256:— | |||
| 3816 | Endermanch@Cerber5.exe | C:\users\admin\appdata\roaming\microsoft\outlook\test.xml | — | |
MD5:— | SHA256:— | |||
| 3816 | Endermanch@Cerber5.exe | C:\users\admin\appdata\roaming\microsoft\outlook\test.srs | — | |
MD5:— | SHA256:— | |||
| 3816 | Endermanch@Cerber5.exe | C:\users\admin\appdata\roaming\microsoft\outlook\outlook.srs | — | |
MD5:— | SHA256:— | |||
| 3816 | Endermanch@Cerber5.exe | C:\users\admin\documents\difficultactual.rtf | — | |
MD5:— | SHA256:— | |||
| 3816 | Endermanch@Cerber5.exe | C:\users\admin\documents\georgiagame.rtf | — | |
MD5:— | SHA256:— | |||
| 3816 | Endermanch@Cerber5.exe | C:\users\admin\documents\onenote notebooks\personal\unfiled notes.one | — | |
MD5:— | SHA256:— | |||
| 3816 | Endermanch@Cerber5.exe | C:\users\admin\documents\outlook files\honey@pot.com.pst | — | |
MD5:— | SHA256:— | |||
| 3816 | Endermanch@Cerber5.exe | C:\users\admin\documents\outlook files\outlook data file - nomail.pst | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2 168
DNS requests
0
Threats
1
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 93.107.12.4:6893 | — | Vodafone Ireland Limited | IE | malicious |
— | — | 93.107.12.5:6893 | — | Vodafone Ireland Limited | IE | malicious |
3816 | Endermanch@Cerber5.exe | 93.107.12.0:6893 | — | Vodafone Ireland Limited | IE | malicious |
— | — | 93.107.12.1:6893 | — | Vodafone Ireland Limited | IE | malicious |
— | — | 93.107.12.6:6893 | — | Vodafone Ireland Limited | IE | malicious |
— | — | 93.107.12.7:6893 | — | Vodafone Ireland Limited | IE | malicious |
— | — | 93.107.12.9:6893 | — | Vodafone Ireland Limited | IE | unknown |
— | — | 93.107.12.8:6893 | — | Vodafone Ireland Limited | IE | malicious |
— | — | 93.107.12.10:6893 | — | Vodafone Ireland Limited | IE | unknown |
— | — | 93.107.12.11:6893 | — | Vodafone Ireland Limited | IE | malicious |
DNS requests
Threats
PID | Process | Class | Message |
|---|---|---|---|
3816 | Endermanch@Cerber5.exe | A Network Trojan was detected | ET TROJAN Ransomware/Cerber Checkin M3 (5) |