Analysis Overview
SHA256
8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d
Threat Level: Known bad
The file 8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d was found to be: Known bad.
Malicious Activity Summary
Eternity
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
outlook_office_path
Suspicious use of SetWindowsHookEx
outlook_win_path
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Runs ping.exe
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-09-08 22:16
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-09-08 22:16
Reported
2022-09-08 22:21
Platform
win7-20220812-en
Max time kernel
293s
Max time network
40s
Command Line
Signatures
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe
"C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | pastebin.pl | udp |
| PL | 185.157.81.233:443 | pastebin.pl | tcp |
Files
memory/1192-54-0x0000000076701000-0x0000000076703000-memory.dmp
memory/1192-55-0x0000000000CD0000-0x0000000000CD2000-memory.dmp
memory/1192-56-0x0000000000CD0000-0x00000000016F2000-memory.dmp
memory/1192-57-0x00000000FFBD0000-0x00000000FFFA1000-memory.dmp
memory/1192-58-0x0000000000CD0000-0x00000000016F2000-memory.dmp
memory/1192-59-0x0000000000CD0000-0x00000000016F2000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-09-08 22:16
Reported
2022-09-08 22:22
Platform
win10-20220812-en
Max time kernel
70s
Max time network
143s
Command Line
Signatures
Eternity
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4820 set thread context of 4000 | N/A | C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
Runs ping.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\PING.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe
"C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
C:\Windows\SysWOW64\chcp.com
chcp 65001
C:\Windows\SysWOW64\netsh.exe
netsh wlan show profile
C:\Windows\SysWOW64\findstr.exe
findstr All
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key
C:\Windows\SysWOW64\chcp.com
chcp 65001
C:\Windows\SysWOW64\netsh.exe
netsh wlan show profile name="65001" key=clear
C:\Windows\SysWOW64\findstr.exe
findstr Key
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
C:\Windows\SysWOW64\chcp.com
chcp 65001
C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | pastebin.pl | udp |
| PL | 185.157.81.233:443 | pastebin.pl | tcp |
| FR | 40.79.150.121:443 | tcp | |
| US | 209.197.3.8:80 | tcp | |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| NL | 104.144.69.143:6015 | 104.144.69.143 | tcp |
| US | 93.184.220.29:80 | tcp |
Files
memory/4820-116-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-117-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-118-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-119-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-120-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-121-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-122-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-123-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-124-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-125-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-126-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-127-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-128-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-130-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-129-0x0000000000910000-0x0000000001332000-memory.dmp
memory/4820-131-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-132-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-133-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-134-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-135-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-136-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-137-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-138-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-139-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-140-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-141-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-142-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-143-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-144-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-145-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-146-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-147-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-149-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-148-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-150-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-151-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-152-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-153-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-156-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-155-0x0000000000910000-0x0000000000912000-memory.dmp
memory/4820-154-0x00000000FE360000-0x00000000FE731000-memory.dmp
memory/4820-157-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-158-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-159-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-160-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-161-0x0000000000910000-0x0000000001332000-memory.dmp
memory/4820-162-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-163-0x0000000003C00000-0x0000000003C9C000-memory.dmp
memory/4820-164-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-166-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-165-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-167-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-169-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-171-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-173-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-174-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-172-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-170-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-175-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-176-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-168-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-177-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-179-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-182-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-183-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-181-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-180-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-178-0x0000000077200000-0x000000007738E000-memory.dmp
memory/4820-198-0x0000000000910000-0x0000000001332000-memory.dmp
memory/4820-201-0x0000000003750000-0x000000000378C000-memory.dmp
memory/4820-202-0x00000000037C0000-0x00000000037C6000-memory.dmp
memory/4820-204-0x000000000D2F0000-0x000000000D382000-memory.dmp
memory/4820-203-0x000000000D7F0000-0x000000000DCEE000-memory.dmp
memory/4820-206-0x0000000003CE0000-0x0000000003CEA000-memory.dmp
memory/4820-211-0x00000000FE360000-0x00000000FE731000-memory.dmp
memory/4820-212-0x000000000D520000-0x000000000D53A000-memory.dmp
memory/4820-213-0x000000000D540000-0x000000000D546000-memory.dmp
memory/4000-215-0x000000000045502E-mapping.dmp
memory/4820-223-0x0000000000910000-0x0000000001332000-memory.dmp
memory/4000-248-0x0000000000400000-0x000000000045A000-memory.dmp
memory/4000-282-0x0000000005D30000-0x0000000005D96000-memory.dmp
memory/4000-293-0x00000000062E0000-0x0000000006330000-memory.dmp
memory/1196-292-0x0000000000000000-mapping.dmp
memory/1664-302-0x0000000000000000-mapping.dmp
memory/1916-310-0x0000000000000000-mapping.dmp
memory/2116-312-0x0000000000000000-mapping.dmp
memory/2900-502-0x0000000000000000-mapping.dmp
memory/3420-508-0x0000000000000000-mapping.dmp
memory/4092-516-0x0000000000000000-mapping.dmp
memory/3128-518-0x0000000000000000-mapping.dmp
memory/5048-719-0x0000000000000000-mapping.dmp
memory/2692-725-0x0000000000000000-mapping.dmp
memory/2312-733-0x0000000000000000-mapping.dmp