eternity | dfa8a3136cdf32e554997545432c51b3c8c712500b857140f6d7f9ad1b1789d6

Analysis

max time kernel
142s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 11:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58a640b0c8d5935fa229131b64aa80ac.exe
Size

1.9MB
MD5

58a640b0c8d5935fa229131b64aa80ac
SHA1

4feba21e86b44b5f27cda4376d0f3a7ddc33b63b
SHA256

dfa8a3136cdf32e554997545432c51b3c8c712500b857140f6d7f9ad1b1789d6
SHA512

9d46b05dae64436c5327354162c43b08d02fdeef9f864917cca1dc407e43cbfc55a0fb782565d6cd8f7e5536577bcc68201dfbcbb9f7e67e6ec21fff7aaf758a
SSDEEP

49152:yfZwCTG65aYImGBMIBW2jX66ws6ij48N2w:Cw8JImGB7k2jXTLnAw

Score

10^/10

eternity

Malware Config

Extracted

Family

eternity

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Attributes

payload_urls
http://167.88.170.23/w993.exe
http://167.88.170.23/s101.exe,http://167.88.170.23/101.exe,http://167.88.170.23/R101.exe

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Executes dropped EXE 8 IoCs

Processes:

Pasta2.exePasta2.exePasta2.exePasta2.exePasta2.exePasta2.exePasta2.exePasta2.exe

pid process

1520 Pasta2.exe
536 Pasta2.exe
732 Pasta2.exe
1776 Pasta2.exe
1364 Pasta2.exe
932 Pasta2.exe
1320 Pasta2.exe
1900 Pasta2.exe
Loads dropped DLL 3 IoCs

Processes:

58a640b0c8d5935fa229131b64aa80ac.exePasta2.execmd.exe

pid process

1092 58a640b0c8d5935fa229131b64aa80ac.exe
1520 Pasta2.exe
468 cmd.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Pasta2.exe

description pid process target process

PID 1520 set thread context of 536 1520 Pasta2.exe Pasta2.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

648 schtasks.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

pid	process
1520	Pasta2.exe
536	Pasta2.exe
732	Pasta2.exe
1776	Pasta2.exe
1364	Pasta2.exe
932	Pasta2.exe
1320	Pasta2.exe
1900	Pasta2.exe

pid	process
1092	58a640b0c8d5935fa229131b64aa80ac.exe
1520	Pasta2.exe
468	cmd.exe

description	pid	process	target process
PID 1520 set thread context of 536	1520	Pasta2.exe	Pasta2.exe

pid	process
648	schtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	EXCEL.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1500 PING.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1148 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Pasta2.exe

pid process

732 Pasta2.exe
732 Pasta2.exe
732 Pasta2.exe
732 Pasta2.exe
732 Pasta2.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Pasta2.exe

description pid process

Token: SeDebugPrivilege 732 Pasta2.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1148 EXCEL.EXE
1148 EXCEL.EXE
1148 EXCEL.EXE

pid	process
1500	PING.EXE

pid	process
1148	EXCEL.EXE

pid	process
732	Pasta2.exe
732	Pasta2.exe
732	Pasta2.exe
732	Pasta2.exe
732	Pasta2.exe

description	pid	process
Token: SeDebugPrivilege	732	Pasta2.exe

pid	process
1148	EXCEL.EXE
1148	EXCEL.EXE
1148	EXCEL.EXE

Suspicious use of WriteProcessMemory 62 IoCs

Processes:

58a640b0c8d5935fa229131b64aa80ac.exePasta2.exePasta2.execmd.exePasta2.exe

description	pid	process	target process
PID 1092 wrote to memory of 1148	1092	58a640b0c8d5935fa229131b64aa80ac.exe	EXCEL.EXE
PID 1092 wrote to memory of 1148	1092	58a640b0c8d5935fa229131b64aa80ac.exe	EXCEL.EXE
PID 1092 wrote to memory of 1148	1092	58a640b0c8d5935fa229131b64aa80ac.exe	EXCEL.EXE
PID 1092 wrote to memory of 1148	1092	58a640b0c8d5935fa229131b64aa80ac.exe	EXCEL.EXE
PID 1092 wrote to memory of 1148	1092	58a640b0c8d5935fa229131b64aa80ac.exe	EXCEL.EXE
PID 1092 wrote to memory of 1148	1092	58a640b0c8d5935fa229131b64aa80ac.exe	EXCEL.EXE
PID 1092 wrote to memory of 1148	1092	58a640b0c8d5935fa229131b64aa80ac.exe	EXCEL.EXE
PID 1092 wrote to memory of 1148	1092	58a640b0c8d5935fa229131b64aa80ac.exe	EXCEL.EXE
PID 1092 wrote to memory of 1148	1092	58a640b0c8d5935fa229131b64aa80ac.exe	EXCEL.EXE
PID 1092 wrote to memory of 1520	1092	58a640b0c8d5935fa229131b64aa80ac.exe	Pasta2.exe
PID 1092 wrote to memory of 1520	1092	58a640b0c8d5935fa229131b64aa80ac.exe	Pasta2.exe
PID 1092 wrote to memory of 1520	1092	58a640b0c8d5935fa229131b64aa80ac.exe	Pasta2.exe
PID 1092 wrote to memory of 1520	1092	58a640b0c8d5935fa229131b64aa80ac.exe	Pasta2.exe
PID 1520 wrote to memory of 536	1520	Pasta2.exe	Pasta2.exe
PID 1520 wrote to memory of 536	1520	Pasta2.exe	Pasta2.exe
PID 1520 wrote to memory of 536	1520	Pasta2.exe	Pasta2.exe
PID 1520 wrote to memory of 536	1520	Pasta2.exe	Pasta2.exe
PID 1520 wrote to memory of 536	1520	Pasta2.exe	Pasta2.exe
PID 1520 wrote to memory of 536	1520	Pasta2.exe	Pasta2.exe
PID 1520 wrote to memory of 536	1520	Pasta2.exe	Pasta2.exe
PID 1520 wrote to memory of 536	1520	Pasta2.exe	Pasta2.exe
PID 1520 wrote to memory of 536	1520	Pasta2.exe	Pasta2.exe
PID 536 wrote to memory of 468	536	Pasta2.exe	cmd.exe
PID 536 wrote to memory of 468	536	Pasta2.exe	cmd.exe
PID 536 wrote to memory of 468	536	Pasta2.exe	cmd.exe
PID 536 wrote to memory of 468	536	Pasta2.exe	cmd.exe
PID 468 wrote to memory of 1076	468	cmd.exe	chcp.com
PID 468 wrote to memory of 1076	468	cmd.exe	chcp.com
PID 468 wrote to memory of 1076	468	cmd.exe	chcp.com
PID 468 wrote to memory of 1076	468	cmd.exe	chcp.com
PID 468 wrote to memory of 1500	468	cmd.exe	PING.EXE
PID 468 wrote to memory of 1500	468	cmd.exe	PING.EXE
PID 468 wrote to memory of 1500	468	cmd.exe	PING.EXE
PID 468 wrote to memory of 1500	468	cmd.exe	PING.EXE
PID 468 wrote to memory of 648	468	cmd.exe	schtasks.exe
PID 468 wrote to memory of 648	468	cmd.exe	schtasks.exe
PID 468 wrote to memory of 648	468	cmd.exe	schtasks.exe
PID 468 wrote to memory of 648	468	cmd.exe	schtasks.exe
PID 468 wrote to memory of 732	468	cmd.exe	Pasta2.exe
PID 468 wrote to memory of 732	468	cmd.exe	Pasta2.exe
PID 468 wrote to memory of 732	468	cmd.exe	Pasta2.exe
PID 468 wrote to memory of 732	468	cmd.exe	Pasta2.exe
PID 732 wrote to memory of 1776	732	Pasta2.exe	Pasta2.exe
PID 732 wrote to memory of 1776	732	Pasta2.exe	Pasta2.exe
PID 732 wrote to memory of 1776	732	Pasta2.exe	Pasta2.exe
PID 732 wrote to memory of 1776	732	Pasta2.exe	Pasta2.exe
PID 732 wrote to memory of 1364	732	Pasta2.exe	Pasta2.exe
PID 732 wrote to memory of 1364	732	Pasta2.exe	Pasta2.exe
PID 732 wrote to memory of 1364	732	Pasta2.exe	Pasta2.exe
PID 732 wrote to memory of 1364	732	Pasta2.exe	Pasta2.exe
PID 732 wrote to memory of 932	732	Pasta2.exe	Pasta2.exe
PID 732 wrote to memory of 932	732	Pasta2.exe	Pasta2.exe
PID 732 wrote to memory of 932	732	Pasta2.exe	Pasta2.exe
PID 732 wrote to memory of 932	732	Pasta2.exe	Pasta2.exe
PID 732 wrote to memory of 1320	732	Pasta2.exe	Pasta2.exe
PID 732 wrote to memory of 1320	732	Pasta2.exe	Pasta2.exe
PID 732 wrote to memory of 1320	732	Pasta2.exe	Pasta2.exe
PID 732 wrote to memory of 1320	732	Pasta2.exe	Pasta2.exe
PID 732 wrote to memory of 1900	732	Pasta2.exe	Pasta2.exe
PID 732 wrote to memory of 1900	732	Pasta2.exe	Pasta2.exe
PID 732 wrote to memory of 1900	732	Pasta2.exe	Pasta2.exe
PID 732 wrote to memory of 1900	732	Pasta2.exe	Pasta2.exe

C:\Users\Admin\AppData\Local\Temp\58a640b0c8d5935fa229131b64aa80ac.exe
"C:\Users\Admin\AppData\Local\Temp\58a640b0c8d5935fa229131b64aa80ac.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1092

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde
2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1148

C:\Users\Admin\AppData\Local\Temp\Pasta2.exe
"C:\Users\Admin\AppData\Local\Temp\Pasta2.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1520

C:\Users\Admin\AppData\Local\Temp\Pasta2.exe
"{path}"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "Pasta2" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\Pasta2.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe"
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:468

C:\Windows\SysWOW64\chcp.com
chcp 65001
5⤵
PID:1076

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
5⤵
- Runs ping.exe
PID:1500

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "Pasta2" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:648

C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe
"C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:732

C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe
"{path}"
6⤵
- Executes dropped EXE
PID:1776

C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe
"{path}"
6⤵
- Executes dropped EXE
PID:1364

C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe
"{path}"
6⤵
- Executes dropped EXE
PID:932

C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe
"{path}"
6⤵
- Executes dropped EXE
PID:1320

C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe
"{path}"
6⤵
- Executes dropped EXE
PID:1900

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe
Filesize
1.8MB

MD5
68d348019229f619929995cf7f7dfa4d

SHA1
9e2f888c42d51f91c900bec478e703fe145e1a54

SHA256
6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

SHA512
31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe
Filesize
1.8MB

MD5
68d348019229f619929995cf7f7dfa4d

SHA1
9e2f888c42d51f91c900bec478e703fe145e1a54

SHA256
6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

SHA512
31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe
Filesize
1.8MB

MD5
68d348019229f619929995cf7f7dfa4d

SHA1
9e2f888c42d51f91c900bec478e703fe145e1a54

SHA256
6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

SHA512
31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe
Filesize
1.8MB

MD5
68d348019229f619929995cf7f7dfa4d

SHA1
9e2f888c42d51f91c900bec478e703fe145e1a54

SHA256
6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

SHA512
31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe
Filesize
1.8MB

MD5
68d348019229f619929995cf7f7dfa4d

SHA1
9e2f888c42d51f91c900bec478e703fe145e1a54

SHA256
6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

SHA512
31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe
Filesize
1.8MB

MD5
68d348019229f619929995cf7f7dfa4d

SHA1
9e2f888c42d51f91c900bec478e703fe145e1a54

SHA256
6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

SHA512
31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe
Filesize
1.8MB

MD5
68d348019229f619929995cf7f7dfa4d

SHA1
9e2f888c42d51f91c900bec478e703fe145e1a54

SHA256
6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

SHA512
31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pasta2.exe
Filesize
1.8MB

MD5
68d348019229f619929995cf7f7dfa4d

SHA1
9e2f888c42d51f91c900bec478e703fe145e1a54

SHA256
6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

SHA512
31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pasta2.exe
Filesize
1.8MB

MD5
68d348019229f619929995cf7f7dfa4d

SHA1
9e2f888c42d51f91c900bec478e703fe145e1a54

SHA256
6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

SHA512
31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pasta2.exe
Filesize
1.8MB

MD5
68d348019229f619929995cf7f7dfa4d

SHA1
9e2f888c42d51f91c900bec478e703fe145e1a54

SHA256
6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

SHA512
31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pasta2.xlsx
Filesize
12KB

MD5
90aede484ae01d0cb78f0f299229d2cf

SHA1
b6f025ea1ac709a43674473d4d6fc212f427838c

SHA256
5db8a6228ada1b2c2ad6db0e9f722c20a7a181a1976408d00428e78fa13437a3

SHA512
fad8a105caf724e8c4321194e74f19f43a580aeacdae6426c6e77da19b7723d4cc23744721159b20573f28f16ec4399270b8512a88619793c4593c2744fa1374

Download Submit
\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe
Filesize
1.8MB

MD5
68d348019229f619929995cf7f7dfa4d

SHA1
9e2f888c42d51f91c900bec478e703fe145e1a54

SHA256
6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

SHA512
31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

Download Submit
\Users\Admin\AppData\Local\Temp\Pasta2.exe
Filesize
1.8MB

MD5
68d348019229f619929995cf7f7dfa4d

SHA1
9e2f888c42d51f91c900bec478e703fe145e1a54

SHA256
6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

SHA512
31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

Download Submit
\Users\Admin\AppData\Local\Temp\Pasta2.exe
Filesize
1.8MB

MD5
68d348019229f619929995cf7f7dfa4d

SHA1
9e2f888c42d51f91c900bec478e703fe145e1a54

SHA256
6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

SHA512
31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

Download Submit
memory/468-87-0x0000000000000000-mapping.dmp

Download
memory/536-79-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/536-80-0x000000000054C73E-mapping.dmp

Download
memory/536-74-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/536-75-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/536-77-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/536-78-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/536-85-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/536-83-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/648-90-0x0000000000000000-mapping.dmp

Download
memory/732-97-0x0000000000290000-0x000000000046E000-memory.dmp

Filesize
1.9MB

Download
memory/732-95-0x0000000000000000-mapping.dmp

Download
memory/732-99-0x00000000005B0000-0x00000000005C2000-memory.dmp

Filesize
72KB

Download
memory/1076-88-0x0000000000000000-mapping.dmp

Download
memory/1092-54-0x0000000000CA0000-0x0000000000E84000-memory.dmp

Filesize
1.9MB

Download
memory/1092-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1148-91-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1148-59-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1148-92-0x000000006F77D000-0x000000006F788000-memory.dmp

Filesize
44KB

Download
memory/1148-57-0x000000002F7D1000-0x000000002F7D4000-memory.dmp

Filesize
12KB

Download
memory/1148-63-0x000000006F77D000-0x000000006F788000-memory.dmp

Filesize
44KB

Download
memory/1148-56-0x0000000000000000-mapping.dmp

Download
memory/1148-60-0x000000006F77D000-0x000000006F788000-memory.dmp

Filesize
44KB

Download
memory/1148-58-0x000000006E791000-0x000000006E793000-memory.dmp

Filesize
8KB

Download
memory/1500-89-0x0000000000000000-mapping.dmp

Download
memory/1520-65-0x0000000000000000-mapping.dmp

Download
memory/1520-72-0x0000000006040000-0x0000000006192000-memory.dmp

Filesize
1.3MB

Download
memory/1520-70-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/1520-71-0x0000000008730000-0x00000000088D4000-memory.dmp

Filesize
1.6MB

Download
memory/1520-68-0x0000000000C00000-0x0000000000DDE000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads