Analysis
-
max time kernel
157s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
22-11-2022 07:33
General
-
Target
966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe
-
Size
111KB
-
MD5
27063953e8334bc1d395274a3ff8e66f
-
SHA1
c99c0c640f2cf83d15a5d77851b01f46351925db
-
SHA256
966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352
-
SHA512
c55dab437eeef8a533361e3c406011b2bcee256ba05e654d27ccbb7acdfe739bdb62ca20cc0130b01ccb3c718424e26ca6bcb3c5260b633741105a137459e331
-
SSDEEP
1536:zK5oJuznccI1E2POyocnQZZZZZZZZZonfnGiA1kMb7cSt6gCYU4dZji:zKdccI1E2POyoUfY1kMb7c86g9DZji
Malware Config
Signatures
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Disables Task Manager via registry modification
-
Executes dropped EXE 3 IoCs
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 6 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe"C:\Users\Admin\AppData\Local\Temp\966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\ServiceHub\966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe"C:\Users\Admin\AppData\Local\ServiceHub\966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe"3⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\ServiceHub\966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exeC:\Users\Admin\AppData\Local\ServiceHub\966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\ServiceHub\966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exeC:\Users\Admin\AppData\Local\ServiceHub\966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe.logFilesize
609B
MD5d12b2202c8663de63120a7239216f4c9
SHA1f0263381d735e0d3a029378de06e6c49f386bb4f
SHA256a1523cbbb1efe7eaed779caf6077a067519945accb1ab61a4c39323fffea6e5d
SHA512942e728bb334cd3a7c634617c04cc2848124505a7a5b3f3081e5d46334e313b1f6fbf854e94d4f44dd51692c39cd19d239b15de3f0aa443ebd8d60db2868ab80
-
C:\Users\Admin\AppData\Local\ServiceHub\966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exeFilesize
111KB
MD527063953e8334bc1d395274a3ff8e66f
SHA1c99c0c640f2cf83d15a5d77851b01f46351925db
SHA256966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352
SHA512c55dab437eeef8a533361e3c406011b2bcee256ba05e654d27ccbb7acdfe739bdb62ca20cc0130b01ccb3c718424e26ca6bcb3c5260b633741105a137459e331
-
C:\Users\Admin\AppData\Local\ServiceHub\966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exeFilesize
111KB
MD527063953e8334bc1d395274a3ff8e66f
SHA1c99c0c640f2cf83d15a5d77851b01f46351925db
SHA256966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352
SHA512c55dab437eeef8a533361e3c406011b2bcee256ba05e654d27ccbb7acdfe739bdb62ca20cc0130b01ccb3c718424e26ca6bcb3c5260b633741105a137459e331
-
C:\Users\Admin\AppData\Local\ServiceHub\966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exeFilesize
111KB
MD527063953e8334bc1d395274a3ff8e66f
SHA1c99c0c640f2cf83d15a5d77851b01f46351925db
SHA256966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352
SHA512c55dab437eeef8a533361e3c406011b2bcee256ba05e654d27ccbb7acdfe739bdb62ca20cc0130b01ccb3c718424e26ca6bcb3c5260b633741105a137459e331
-
C:\Users\Admin\AppData\Local\ServiceHub\966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exeFilesize
111KB
MD527063953e8334bc1d395274a3ff8e66f
SHA1c99c0c640f2cf83d15a5d77851b01f46351925db
SHA256966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352
SHA512c55dab437eeef8a533361e3c406011b2bcee256ba05e654d27ccbb7acdfe739bdb62ca20cc0130b01ccb3c718424e26ca6bcb3c5260b633741105a137459e331
-
memory/1052-149-0x0000000000000000-mapping.dmp
-
memory/1828-146-0x0000000000000000-mapping.dmp
-
memory/2072-148-0x0000000000000000-mapping.dmp
-
memory/3132-132-0x00000000008A0000-0x00000000008C2000-memory.dmpFilesize
136KB
-
memory/3132-134-0x00000000052C0000-0x0000000005352000-memory.dmpFilesize
584KB
-
memory/3132-133-0x0000000005870000-0x0000000005E14000-memory.dmpFilesize
5.6MB
-
memory/3148-145-0x0000000000000000-mapping.dmp
-
memory/3468-143-0x0000000005140000-0x00000000051A6000-memory.dmpFilesize
408KB
-
memory/3468-139-0x0000000000000000-mapping.dmp
-
memory/3824-137-0x0000000000000000-mapping.dmp
-
memory/3952-138-0x0000000000000000-mapping.dmp
-
memory/4624-135-0x0000000000000000-mapping.dmp
-
memory/4900-136-0x0000000000000000-mapping.dmp