Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
17-05-2022 11:36
Static task
static1
Behavioral task
behavioral1
Sample
00618ca52d7c0025466be5d8e3ca79bb3fb388178b937a54a2411a0cd1d79eee.exe
Resource
win7-20220414-en
General
-
Target
00618ca52d7c0025466be5d8e3ca79bb3fb388178b937a54a2411a0cd1d79eee.exe
-
Size
1.3MB
-
MD5
2cfd0272114a3158b904ea8fec66545b
-
SHA1
79cae9eb69877b6ad9fb947a7edfc01427ac4b89
-
SHA256
00618ca52d7c0025466be5d8e3ca79bb3fb388178b937a54a2411a0cd1d79eee
-
SHA512
b37b0b82bf4c5eae81efc7284efb3a1fc25e790fce7cfc2735a769eae010d2cfa6633a5b6def5107ef88d684cd0dfdfe8f8c402e177a9786bbbed51a4e5d79fe
Malware Config
Signatures
-
Detects Eternity worm 11 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\PIVFAGEAAV.exe eternity_worm C:\Users\Admin\AppData\Local\Temp\PIVFAGEAAV.exe eternity_worm C:\Users\Admin\AppData\Local\Temp\PIVFAGEAAV.exe eternity_worm behavioral1/memory/2024-63-0x00000000011A0000-0x00000000012F6000-memory.dmp eternity_worm \Users\Admin\AppData\Local\ServiceHub\PIVFAGEAAV.exe eternity_worm C:\Users\Admin\AppData\Local\ServiceHub\PIVFAGEAAV.exe eternity_worm C:\Users\Admin\AppData\Local\ServiceHub\PIVFAGEAAV.exe eternity_worm behavioral1/memory/1924-73-0x0000000001070000-0x00000000011C6000-memory.dmp eternity_worm C:\Users\Admin\AppData\Local\ServiceHub\PIVFAGEAAV.exe eternity_worm C:\Users\Admin\AppData\Local\ServiceHub\PIVFAGEAAV.exe eternity_worm behavioral1/memory/1992-79-0x0000000001070000-0x00000000011C6000-memory.dmp eternity_worm -
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Executes dropped EXE 4 IoCs
Processes:
PIVFAGEAAV.exePIVFAGEAAV.exePIVFAGEAAV.exePIVFAGEAAV.exepid process 2024 PIVFAGEAAV.exe 1924 PIVFAGEAAV.exe 800 PIVFAGEAAV.exe 1992 PIVFAGEAAV.exe -
Loads dropped DLL 2 IoCs
Processes:
00618ca52d7c0025466be5d8e3ca79bb3fb388178b937a54a2411a0cd1d79eee.execmd.exepid process 548 00618ca52d7c0025466be5d8e3ca79bb3fb388178b937a54a2411a0cd1d79eee.exe 1896 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PIVFAGEAAV.exePIVFAGEAAV.exedescription pid process Token: SeDebugPrivilege 1924 PIVFAGEAAV.exe Token: SeDebugPrivilege 1992 PIVFAGEAAV.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid process 2044 AcroRd32.exe 2044 AcroRd32.exe 2044 AcroRd32.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
00618ca52d7c0025466be5d8e3ca79bb3fb388178b937a54a2411a0cd1d79eee.exePIVFAGEAAV.execmd.exetaskeng.exedescription pid process target process PID 548 wrote to memory of 2044 548 00618ca52d7c0025466be5d8e3ca79bb3fb388178b937a54a2411a0cd1d79eee.exe AcroRd32.exe PID 548 wrote to memory of 2044 548 00618ca52d7c0025466be5d8e3ca79bb3fb388178b937a54a2411a0cd1d79eee.exe AcroRd32.exe PID 548 wrote to memory of 2044 548 00618ca52d7c0025466be5d8e3ca79bb3fb388178b937a54a2411a0cd1d79eee.exe AcroRd32.exe PID 548 wrote to memory of 2044 548 00618ca52d7c0025466be5d8e3ca79bb3fb388178b937a54a2411a0cd1d79eee.exe AcroRd32.exe PID 548 wrote to memory of 2024 548 00618ca52d7c0025466be5d8e3ca79bb3fb388178b937a54a2411a0cd1d79eee.exe PIVFAGEAAV.exe PID 548 wrote to memory of 2024 548 00618ca52d7c0025466be5d8e3ca79bb3fb388178b937a54a2411a0cd1d79eee.exe PIVFAGEAAV.exe PID 548 wrote to memory of 2024 548 00618ca52d7c0025466be5d8e3ca79bb3fb388178b937a54a2411a0cd1d79eee.exe PIVFAGEAAV.exe PID 548 wrote to memory of 2024 548 00618ca52d7c0025466be5d8e3ca79bb3fb388178b937a54a2411a0cd1d79eee.exe PIVFAGEAAV.exe PID 2024 wrote to memory of 1896 2024 PIVFAGEAAV.exe cmd.exe PID 2024 wrote to memory of 1896 2024 PIVFAGEAAV.exe cmd.exe PID 2024 wrote to memory of 1896 2024 PIVFAGEAAV.exe cmd.exe PID 2024 wrote to memory of 1896 2024 PIVFAGEAAV.exe cmd.exe PID 1896 wrote to memory of 660 1896 cmd.exe chcp.com PID 1896 wrote to memory of 660 1896 cmd.exe chcp.com PID 1896 wrote to memory of 660 1896 cmd.exe chcp.com PID 1896 wrote to memory of 660 1896 cmd.exe chcp.com PID 1896 wrote to memory of 1888 1896 cmd.exe PING.EXE PID 1896 wrote to memory of 1888 1896 cmd.exe PING.EXE PID 1896 wrote to memory of 1888 1896 cmd.exe PING.EXE PID 1896 wrote to memory of 1888 1896 cmd.exe PING.EXE PID 1896 wrote to memory of 1212 1896 cmd.exe schtasks.exe PID 1896 wrote to memory of 1212 1896 cmd.exe schtasks.exe PID 1896 wrote to memory of 1212 1896 cmd.exe schtasks.exe PID 1896 wrote to memory of 1212 1896 cmd.exe schtasks.exe PID 1896 wrote to memory of 1924 1896 cmd.exe PIVFAGEAAV.exe PID 1896 wrote to memory of 1924 1896 cmd.exe PIVFAGEAAV.exe PID 1896 wrote to memory of 1924 1896 cmd.exe PIVFAGEAAV.exe PID 1896 wrote to memory of 1924 1896 cmd.exe PIVFAGEAAV.exe PID 1916 wrote to memory of 800 1916 taskeng.exe PIVFAGEAAV.exe PID 1916 wrote to memory of 800 1916 taskeng.exe PIVFAGEAAV.exe PID 1916 wrote to memory of 800 1916 taskeng.exe PIVFAGEAAV.exe PID 1916 wrote to memory of 800 1916 taskeng.exe PIVFAGEAAV.exe PID 1916 wrote to memory of 1992 1916 taskeng.exe PIVFAGEAAV.exe PID 1916 wrote to memory of 1992 1916 taskeng.exe PIVFAGEAAV.exe PID 1916 wrote to memory of 1992 1916 taskeng.exe PIVFAGEAAV.exe PID 1916 wrote to memory of 1992 1916 taskeng.exe PIVFAGEAAV.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00618ca52d7c0025466be5d8e3ca79bb3fb388178b937a54a2411a0cd1d79eee.exe"C:\Users\Admin\AppData\Local\Temp\00618ca52d7c0025466be5d8e3ca79bb3fb388178b937a54a2411a0cd1d79eee.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PIVFAGEAAV.pdf"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\PIVFAGEAAV.exe"C:\Users\Admin\AppData\Local\Temp\PIVFAGEAAV.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "PIVFAGEAAV" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\PIVFAGEAAV.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\PIVFAGEAAV.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\PIVFAGEAAV.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "PIVFAGEAAV" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\PIVFAGEAAV.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\ServiceHub\PIVFAGEAAV.exe"C:\Users\Admin\AppData\Local\ServiceHub\PIVFAGEAAV.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {9705EE1F-83E4-42D3-B22F-3D15DC70CD8A} S-1-5-21-790309383-526510583-3802439154-1000:TVHJCWMH\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ServiceHub\PIVFAGEAAV.exeC:\Users\Admin\AppData\Local\ServiceHub\PIVFAGEAAV.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\ServiceHub\PIVFAGEAAV.exeC:\Users\Admin\AppData\Local\ServiceHub\PIVFAGEAAV.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\ServiceHub\PIVFAGEAAV.exeFilesize
1.3MB
MD5c8d852fb1561658cae72fa498777bfbd
SHA1ea689804b69e9e7611059d11eff2fdadd656e6fb
SHA256757eb1dc48fc181b770984905c3ec14c7be9c8f9bdf813108417e318479051f5
SHA5127b7df94405cb28d26993eaf1e18cec5ab2b695ae280d4c31c65c80ce19a87a3ac6187c259fa3ae8339a2c33f64c6448655b2e02c74f90ff19284f4c92485a13a
-
C:\Users\Admin\AppData\Local\ServiceHub\PIVFAGEAAV.exeFilesize
1.3MB
MD5c8d852fb1561658cae72fa498777bfbd
SHA1ea689804b69e9e7611059d11eff2fdadd656e6fb
SHA256757eb1dc48fc181b770984905c3ec14c7be9c8f9bdf813108417e318479051f5
SHA5127b7df94405cb28d26993eaf1e18cec5ab2b695ae280d4c31c65c80ce19a87a3ac6187c259fa3ae8339a2c33f64c6448655b2e02c74f90ff19284f4c92485a13a
-
C:\Users\Admin\AppData\Local\ServiceHub\PIVFAGEAAV.exeFilesize
1.3MB
MD5c8d852fb1561658cae72fa498777bfbd
SHA1ea689804b69e9e7611059d11eff2fdadd656e6fb
SHA256757eb1dc48fc181b770984905c3ec14c7be9c8f9bdf813108417e318479051f5
SHA5127b7df94405cb28d26993eaf1e18cec5ab2b695ae280d4c31c65c80ce19a87a3ac6187c259fa3ae8339a2c33f64c6448655b2e02c74f90ff19284f4c92485a13a
-
C:\Users\Admin\AppData\Local\ServiceHub\PIVFAGEAAV.exeFilesize
1.3MB
MD5c8d852fb1561658cae72fa498777bfbd
SHA1ea689804b69e9e7611059d11eff2fdadd656e6fb
SHA256757eb1dc48fc181b770984905c3ec14c7be9c8f9bdf813108417e318479051f5
SHA5127b7df94405cb28d26993eaf1e18cec5ab2b695ae280d4c31c65c80ce19a87a3ac6187c259fa3ae8339a2c33f64c6448655b2e02c74f90ff19284f4c92485a13a
-
C:\Users\Admin\AppData\Local\Temp\PIVFAGEAAV.exeFilesize
1.3MB
MD5c8d852fb1561658cae72fa498777bfbd
SHA1ea689804b69e9e7611059d11eff2fdadd656e6fb
SHA256757eb1dc48fc181b770984905c3ec14c7be9c8f9bdf813108417e318479051f5
SHA5127b7df94405cb28d26993eaf1e18cec5ab2b695ae280d4c31c65c80ce19a87a3ac6187c259fa3ae8339a2c33f64c6448655b2e02c74f90ff19284f4c92485a13a
-
C:\Users\Admin\AppData\Local\Temp\PIVFAGEAAV.exeFilesize
1.3MB
MD5c8d852fb1561658cae72fa498777bfbd
SHA1ea689804b69e9e7611059d11eff2fdadd656e6fb
SHA256757eb1dc48fc181b770984905c3ec14c7be9c8f9bdf813108417e318479051f5
SHA5127b7df94405cb28d26993eaf1e18cec5ab2b695ae280d4c31c65c80ce19a87a3ac6187c259fa3ae8339a2c33f64c6448655b2e02c74f90ff19284f4c92485a13a
-
C:\Users\Admin\AppData\Local\Temp\PIVFAGEAAV.pdfFilesize
1KB
MD53f6896a097f6b0ae6a2bf3826c813dfc
SHA1951214ab37dea766005dd981b0b3d61f936b035b
SHA256e6e3a92151eee0fcdf549a607ae9e421e9bb081d7b060015a60865e69a2a3d60
SHA512c7bd241f0e71dc29320cc051f649532fff471b5e617b648cc495413587c06c236afa4673a7bc77409e989260278cdef49bdaca38beb6af65fee74c563775b97c
-
\Users\Admin\AppData\Local\ServiceHub\PIVFAGEAAV.exeFilesize
1.3MB
MD5c8d852fb1561658cae72fa498777bfbd
SHA1ea689804b69e9e7611059d11eff2fdadd656e6fb
SHA256757eb1dc48fc181b770984905c3ec14c7be9c8f9bdf813108417e318479051f5
SHA5127b7df94405cb28d26993eaf1e18cec5ab2b695ae280d4c31c65c80ce19a87a3ac6187c259fa3ae8339a2c33f64c6448655b2e02c74f90ff19284f4c92485a13a
-
\Users\Admin\AppData\Local\Temp\PIVFAGEAAV.exeFilesize
1.3MB
MD5c8d852fb1561658cae72fa498777bfbd
SHA1ea689804b69e9e7611059d11eff2fdadd656e6fb
SHA256757eb1dc48fc181b770984905c3ec14c7be9c8f9bdf813108417e318479051f5
SHA5127b7df94405cb28d26993eaf1e18cec5ab2b695ae280d4c31c65c80ce19a87a3ac6187c259fa3ae8339a2c33f64c6448655b2e02c74f90ff19284f4c92485a13a
-
memory/548-55-0x0000000075D21000-0x0000000075D23000-memory.dmpFilesize
8KB
-
memory/548-54-0x0000000001160000-0x00000000012BC000-memory.dmpFilesize
1.4MB
-
memory/660-66-0x0000000000000000-mapping.dmp
-
memory/800-75-0x0000000000000000-mapping.dmp
-
memory/1212-68-0x0000000000000000-mapping.dmp
-
memory/1888-67-0x0000000000000000-mapping.dmp
-
memory/1896-65-0x0000000000000000-mapping.dmp
-
memory/1924-71-0x0000000000000000-mapping.dmp
-
memory/1924-73-0x0000000001070000-0x00000000011C6000-memory.dmpFilesize
1.3MB
-
memory/1992-77-0x0000000000000000-mapping.dmp
-
memory/1992-79-0x0000000001070000-0x00000000011C6000-memory.dmpFilesize
1.3MB
-
memory/2024-63-0x00000000011A0000-0x00000000012F6000-memory.dmpFilesize
1.3MB
-
memory/2024-60-0x0000000000000000-mapping.dmp
-
memory/2044-56-0x0000000000000000-mapping.dmp