eternity | 55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
16-05-2022 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe
Size

64KB
MD5

76c5b877fb931ed728df30c002bf8823
SHA1

16a8a21ef1a30849bedc514e42286de7676db5af
SHA256

55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91
SHA512

3ed1568c7650f536b91bea3de2afaf0e01f81d986c2968d012622fc542c06d536bf5b17e615ecbab0c89dafb600f1f245c84a9f13f45e8e03481a2d51e20728c

Score

10^/10

eternity persistence ransomware

Malware Config

Signatures

Detects Eternity ransomware 1 IoCs

ransomware

Processes:

resource	yara_rule
behavioral1/memory/1948-54-0x00000000008A0000-0x00000000008B6000-memory.dmp	eternity_ransomware

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Eternity = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe\""	55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

vssvc.exe55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe

description	pid	process
Token: SeBackupPrivilege	652	vssvc.exe
Token: SeRestorePrivilege	652	vssvc.exe
Token: SeAuditPrivilege	652	vssvc.exe
Token: SeDebugPrivilege	1948	55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe

pid process

1948 55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe

pid	process
1948	55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe

C:\Users\Admin\AppData\Local\Temp\55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe
"C:\Users\Admin\AppData\Local\Temp\55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1948

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1948-54-0x00000000008A0000-0x00000000008B6000-memory.dmp

Filesize
88KB

Download
memory/1948-55-0x00000000754A1000-0x00000000754A3000-memory.dmp

Filesize
8KB

Download
memory/1948-56-0x0000000004716000-0x0000000004727000-memory.dmp

Filesize
68KB

Download