Cerber Ransomware | VTI by Category

VTI Information

VTI Score 91 / 100
VTI Database Version	2.5
VTI Rule Match Count	14
VTI Rule Type	Default (PE, ...)

Detected Threats

	Anti Analysis
	Illegitimate API usage
	Internal API "CreateProcessInternalA" was used to start "C:\Windows\system32\netsh.exe advfirewall set allprofiles state on".
	Dynamic API usage
	Resolve above average number of APIs.
	File System
	Rename user files
	Rename multiple user files. This is an indicator for an encryption attempt.
	Injection
	Write into memory of a process running from a created or modified executable
	"c:\users\hjrd1koky ds8lujv\desktop\199a4a2585c9fc855c5a694df318d153cd74e47fe4b8c667f25a822bfbb22bc6.exe" modifies memory of "c:\users\hjrd1koky ds8lujv\desktop\199a4a2585c9fc855c5a694df318d153cd74e47fe4b8c667f25a822bfbb22bc6.exe"
	Modify control flow of a process running from a created or modified executable
	"c:\users\hjrd1koky ds8lujv\desktop\199a4a2585c9fc855c5a694df318d153cd74e47fe4b8c667f25a822bfbb22bc6.exe" alters context of "c:\users\hjrd1koky ds8lujv\desktop\199a4a2585c9fc855c5a694df318d153cd74e47fe4b8c667f25a822bfbb22bc6.exe"
	PE
	Drop PE file
	Drop file "c:\users\hjrd1k~1\appdata\local\temp\nsx1ae1.tmp\system.dll".
	Drop file "c:\users\hjrd1k~1\appdata\local\temp\underglaze.dll".
	Process
	Allocate a page with write and execute permissions
	Change the protection of a page from writable ("PAGE_READWRITE") to executable ("PAGE_EXECUTE_READWRITE").
	Allocate a page in a foreign process with "PAGE_EXECUTE_READWRITE" permissions, often used to dynamically unpack code.
	Create process with hidden window
	The process ""C:\Users\hJrD1KOKY DS8lUjv\Desktop\199a4a2585c9fc855c5a694df318d153cd74e47fe4b8c667f25a822bfbb22bc6.exe" " starts with hidden window.
	The process "C:\Windows\system32\netsh.exe advfirewall set allprofiles state on" starts with hidden window.
	Read from memory of an other process
	"c:\users\hjrd1koky ds8lujv\desktop\199a4a2585c9fc855c5a694df318d153cd74e47fe4b8c667f25a822bfbb22bc6.exe" reads from ""C:\Users\hJrD1KOKY DS8lUjv\Desktop\199a4a2585c9fc855c5a694df318d153cd74e47fe4b8c667f25a822bfbb22bc6.exe" ".
	Create system object
	Create mutex with name "shell.{0835FA03-68AC-09B6-0CE4-703246A746AB}".
	Create mutex with name "Local\!PrivacIE!SharedMemory!Mutex".
-	Browser
-	Device
-	Hide Tracks
-	Information Stealing
-	Kernel
-	Masquerade
-	Network
-	OS
-	Persistence
-	VBA Macro
-	YARA