eternity | 55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91

General

Target

55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe
Size

64KB
MD5

76c5b877fb931ed728df30c002bf8823
SHA1

16a8a21ef1a30849bedc514e42286de7676db5af
SHA256

55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91
SHA512

3ed1568c7650f536b91bea3de2afaf0e01f81d986c2968d012622fc542c06d536bf5b17e615ecbab0c89dafb600f1f245c84a9f13f45e8e03481a2d51e20728c

Score

10^/10

eternity persistence ransomware

Malware Config

Signatures

Detects Eternity ransomware 1 IoCs

ransomware

Processes:

resource	yara_rule
behavioral2/memory/1008-130-0x0000000000320000-0x0000000000336000-memory.dmp	eternity_ransomware

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\AssertSet.tiff	55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe
File opened for modification	C:\Users\Admin\Pictures\ConfirmMerge.tiff	55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe
File opened for modification	C:\Users\Admin\Pictures\MoveBackup.tiff	55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Eternity = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe\""	55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

vssvc.exe55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe

description	pid	process
Token: SeBackupPrivilege	1360	vssvc.exe
Token: SeRestorePrivilege	1360	vssvc.exe
Token: SeAuditPrivilege	1360	vssvc.exe
Token: SeDebugPrivilege	1008	55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe

pid process

1008 55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe

pid	process
1008	55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe

C:\Users\Admin\AppData\Local\Temp\55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe
"C:\Users\Admin\AppData\Local\Temp\55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1008

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1008-130-0x0000000000320000-0x0000000000336000-memory.dmp

Filesize
88KB

Download
memory/1008-131-0x0000000005390000-0x0000000005934000-memory.dmp

Filesize
5.6MB

Download
memory/1008-132-0x0000000004EC0000-0x0000000004F52000-memory.dmp

Filesize
584KB

Download
memory/1008-133-0x0000000005190000-0x00000000051F6000-memory.dmp

Filesize
408KB

Download
memory/1008-134-0x0000000005B40000-0x0000000005B4A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads