File name:

HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.7z

Full analysis: https://app.any.run/tasks/e521c01f-7f8d-48b0-83c5-4ee7fc13085e
Verdict: Malicious activity
Threats:

Cerber is a Ransomware-as-a-Service (RaaS) that appeared in 2016, spread quickly and has been evolving since. It became well-known for its file encryption, offline capabilities, and sophisticated evasion techniques. It primarily targets enterprises, financial institutions, and government entities, encrypting their data and demanding ransom payments in Bitcoin. It also targets everyday users encrypting personal files (photos, documents) with the risk of their permanent loss.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 22:06:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
cerber
ransomware
evasion
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

2FD373CC9A80D11FB6A4E178753C41F0

SHA1:

1C80A30C4AF7F13D4EF2C5A77D972EC1442D4408

SHA256:

CF0C32C9E1BD90EF9F9EF7D1FC487BF6C2FA385B901ED6214D697D5555D923A2

SSDEEP:

3072:Y0vFtdgsgpKMAf9cebi3f7XtO7/fir9+ZoQR:jvzdgzA870/ax+Zo4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe (PID: 3376)
      • fc.exe (PID: 3140)

    • CERBER mutex has been found

      • fc.exe (PID: 3140)
      • HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe (PID: 3376)

    • Using BCDEDIT.EXE to modify recovery options

      • fc.exe (PID: 3140)

    • Starts CMD.EXE for self-deleting

      • HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe (PID: 3376)

    • The process uses screensaver hijack for persistence

      • fc.exe (PID: 3140)
      • HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe (PID: 3376)

    • Deletes shadow copies

      • fc.exe (PID: 3140)

    • Create files in the Startup directory

      • HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe (PID: 3376)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe (PID: 3376)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 3096)

    • Starts CMD.EXE for commands execution

      • HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe (PID: 3376)

    • Reads security settings of Internet Explorer

      • fc.exe (PID: 3140)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3096)

    • Reads the Internet Settings

      • WMIC.exe (PID: 3212)
      • fc.exe (PID: 3140)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3344)

    • Checks for external IP

      • fc.exe (PID: 3140)
      • svchost.exe (PID: 1080)

    • Hides command output

      • cmd.exe (PID: 3096)

    • Starts itself from another location

      • HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe (PID: 3376)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1224)

    • Reads the machine GUID from the registry

      • HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe (PID: 3376)
      • fc.exe (PID: 3140)

    • Manual execution by a user

      • HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe (PID: 3376)

    • Checks supported languages

      • HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe (PID: 3376)
      • fc.exe (PID: 3140)

    • Creates files or folders in the user directory

      • HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe (PID: 3376)
      • fc.exe (PID: 3140)

    • Reads the computer name

      • fc.exe (PID: 3140)
      • HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe (PID: 3376)

    • Checks proxy server information

      • fc.exe (PID: 3140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2017:07:07 21:58:04+00:00
ArchivedFileName: HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
12
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe #CERBER heur-trojan-ransom.win32.zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe #CERBER fc.exe cmd.exe no specs taskkill.exe no specs ping.exe no specs vssadmin.exe no specs vssvc.exe no specs wmic.exe no specs bcdedit.exe no specs bcdedit.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
704taskkill /t /f /im "HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe" C:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1080C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1224"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\e521c01f-7f8d-48b0-83c5-4ee7fc13085e.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2464ping -n 1 127.0.0.1 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
3096/d /c taskkill /t /f /im "HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe" > NULC:\Windows\System32\cmd.exe—HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3140"C:\Users\admin\AppData\Roaming\{6B977300-2501-F740-F2C0-799D6ACA21C2}\fc.exe"C:\Users\admin\AppData\Roaming\{6B977300-2501-F740-F2C0-799D6ACA21C2}\fc.exe
HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exe
User:
admin
Company:
Hottie Dec
Integrity Level:
HIGH
Description:
disprofit scotists
Version:
2.8
Modules
Images
c:\users\admin\appdata\roaming\{6b977300-2501-f740-f2c0-799d6aca21c2}\fc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mciseq.dll
3212"C:\Windows\system32\wbem\wmic.exe" shadowcopy deleteC:\Windows\System32\wbem\WMIC.exe—fc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
3248"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailuresC:\Windows\System32\bcdedit.exe—fc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3300"C:\Windows\system32\vssadmin.exe" delete shadows /all /quietC:\Windows\System32\vssadmin.exe—fc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3344C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 940
Read events
2 869
Write events
65
Delete events
6

Modification events

(PID) Process:(1224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1224) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\e521c01f-7f8d-48b0-83c5-4ee7fc13085e.7z
(PID) Process:(1224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
2
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3140fc.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\json[1].jsonbinary
MD5:E8CA874D7C05603FD1B83ED500DEDA78
SHA256:855FBBD29B5CE353307B5D66E6A0E0DD88DC59EA4FF4DC2AC702F78E0A8C18DC
3376HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fc.lnkbinary
MD5:BD929234285CD18AE8475FD1E341D176
SHA256:F39132F2708196D9F07797E590C67A4E11F33983D1FF80A0352F021E58A6AB3F
1224WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1224.21649\HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exeexecutable
MD5:9F69924870406BEB3EDAB0DA57C34611
SHA256:1A01FAA2B4305C864972AD1CD98BDEF35551430028FF9AB6D372F5A1AECBACB2
3376HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.exeC:\Users\admin\AppData\Roaming\{6B977300-2501-F740-F2C0-799D6ACA21C2}\fc.exeexecutable
MD5:9F69924870406BEB3EDAB0DA57C34611
SHA256:1A01FAA2B4305C864972AD1CD98BDEF35551430028FF9AB6D372F5A1AECBACB2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
13 320
DNS requests
2
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3140
fc.exe
GET
200
34.117.59.81:80
http://ipinfo.io/json
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3140
fc.exe
34.117.59.81:80
ipinfo.io
GOOGLE-CLOUD-PLATFORM
US
whitelisted
3140
fc.exe
85.93.0.2:6892
—
—
—
unknown
3140
fc.exe
85.93.0.1:6892
—
—
—
unknown
3140
fc.exe
85.93.0.0:6892
—
—
—
unknown
3140
fc.exe
85.93.0.7:6892
—
—
—
unknown
3140
fc.exe
85.93.0.8:6892
—
—
—
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
ipinfo.io
  • 34.117.59.81
whitelisted

Threats

PID
Process
Class
Message
3140
fc.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ipinfo.io
1080
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HEUR-Trojan-Ransom.Win32.Zerber.pef-1a01faa2b4305c864972ad1cd98bdef35551430028ff9ab6d372f5a1aecbacb2.7z