Analysis
-
max time kernel
71s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 12:23
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20221111-en
General
-
Target
tmp.exe
-
Size
1.8MB
-
MD5
44effc7911d5d30eee8046847b5e51a0
-
SHA1
9f056d46778af4c12965b6da6adf7e8bd4c1e801
-
SHA256
6d46c2fe42b53385f98f417e5e79b56ee12a3153ad7304a334bc2b4541d84e81
-
SHA512
f929769ba14b0564a8f5ad8d9604d8d9106233e459ab4556cfa22d9d2257318b84dc4a1854401e410b65ef612bca8de36830736f14bcb5a2940d3f492126e575
-
SSDEEP
49152:IBJ5w3gdZHOAWxTAwslyNIlS7PFO9KP142cgXWef:yw38R5pY0EQx2hGk
Malware Config
Extracted
eternity
http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion
Signatures
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Executes dropped EXE 2 IoCs
Processes:
wrmuac.exeSkype.exepid process 4332 wrmuac.exe 3748 Skype.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation tmp.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Skype.exedescription pid process target process PID 3748 set thread context of 4704 3748 Skype.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4896 4704 WerFault.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
wrmuac.exeSkype.exedescription pid process Token: SeDebugPrivilege 4332 wrmuac.exe Token: SeDebugPrivilege 3748 Skype.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
tmp.exeSkype.execmd.exedescription pid process target process PID 2960 wrote to memory of 4332 2960 tmp.exe wrmuac.exe PID 2960 wrote to memory of 4332 2960 tmp.exe wrmuac.exe PID 3748 wrote to memory of 4704 3748 Skype.exe RegAsm.exe PID 3748 wrote to memory of 4704 3748 Skype.exe RegAsm.exe PID 3748 wrote to memory of 4704 3748 Skype.exe RegAsm.exe PID 3748 wrote to memory of 4704 3748 Skype.exe RegAsm.exe PID 3748 wrote to memory of 4704 3748 Skype.exe RegAsm.exe PID 3748 wrote to memory of 4704 3748 Skype.exe RegAsm.exe PID 3748 wrote to memory of 4704 3748 Skype.exe RegAsm.exe PID 3748 wrote to memory of 4704 3748 Skype.exe RegAsm.exe PID 3748 wrote to memory of 4580 3748 Skype.exe cmd.exe PID 3748 wrote to memory of 4580 3748 Skype.exe cmd.exe PID 3748 wrote to memory of 4720 3748 Skype.exe cmd.exe PID 3748 wrote to memory of 4720 3748 Skype.exe cmd.exe PID 3748 wrote to memory of 3064 3748 Skype.exe cmd.exe PID 3748 wrote to memory of 3064 3748 Skype.exe cmd.exe PID 4720 wrote to memory of 2420 4720 cmd.exe schtasks.exe PID 4720 wrote to memory of 2420 4720 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wrmuac.exe"C:\Users\Admin\AppData\Local\Temp\wrmuac.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Skype.exeC:\Users\Admin\AppData\Local\Temp\Skype.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 9763⤵
- Program crash
-
C:\Windows\system32\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\maxaudios"2⤵
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\maxaudios\maxaudios.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\maxaudios\maxaudios.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\Skype.exe" "C:\Users\Admin\AppData\Roaming\maxaudios\maxaudios.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4704 -ip 47041⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Skype.exeFilesize
351.9MB
MD5348a1648bc820cb9ba555a15c389db1e
SHA18f4b62278e7bbb108e0f30aab3a353f0ec580313
SHA256a0490f3ddd866066089b308d892d3a8de67b86e6cd82c0babd55efd13e345a5b
SHA512f379d54c93aa731714d7926fe6c5809be4abecb71b74e78e1213934ecaf51618f2d40159930d08f3dd71544257d3e2ef6916614762ec8945019ca72effc23606
-
C:\Users\Admin\AppData\Local\Temp\Skype.exeFilesize
348.4MB
MD5d5581cdfe2285028b8a1e80ccc1964fe
SHA105c7fdafe69439c07d53dfc4bbadc493d394c8c3
SHA256669d332bd79cfe3a24d4546d5670d3161ef485c308ca9af49040307bfccdf3f5
SHA51217534f55d1282fea90519b8e03fc6a5f7df103719687bbfb1a29234196ce0b2e81823395d85e2320fc9d30835b5a065b7f4780943e482b22460b4b624c68e215
-
C:\Users\Admin\AppData\Local\Temp\wrmuac.exeFilesize
428.0MB
MD51f1b30093f17dbc1f3c714d89fc48da5
SHA1782b87546c0cc7f0bddcdd41f8150abb493a60ca
SHA2562f357985579518723811e3a09a20d78fa7fcf8af6eb733750a55bddf0d071622
SHA5122891a03bb24eeb769f9042d77cad28074f5804c5a323d10606d451d6158c1d2c7315bace0008da849c1bcde9abd5c8168a3680122a79fde2712daa23bd27091b
-
C:\Users\Admin\AppData\Local\Temp\wrmuac.exeFilesize
426.8MB
MD538ea8d9508d7dc196142c40a1ef2e305
SHA12efc6fc2001e9416afbadbcec1b194ba6bf4ec98
SHA25698a6e23dda0bfcf165ed421ac6b92a107b992a36292f7dcca84808649581804a
SHA512111c3b77b52a31003766c237f17e038216216bb048b0b156926642f6fbc5510828c29e56a686a2f49c5c69fe24faf0e9cfffb660fc8d5ce6207a3aed2887515f
-
memory/2420-148-0x0000000000000000-mapping.dmp
-
memory/3064-147-0x0000000000000000-mapping.dmp
-
memory/3748-141-0x00007FF82D760000-0x00007FF82E221000-memory.dmpFilesize
10.8MB
-
memory/3748-142-0x00007FF82D760000-0x00007FF82E221000-memory.dmpFilesize
10.8MB
-
memory/4332-139-0x00007FF82D760000-0x00007FF82E221000-memory.dmpFilesize
10.8MB
-
memory/4332-132-0x0000000000000000-mapping.dmp
-
memory/4332-137-0x00007FF82D760000-0x00007FF82E221000-memory.dmpFilesize
10.8MB
-
memory/4332-136-0x0000000000510000-0x0000000001510000-memory.dmpFilesize
16.0MB
-
memory/4332-135-0x00007FF82D760000-0x00007FF82E221000-memory.dmpFilesize
10.8MB
-
memory/4580-145-0x0000000000000000-mapping.dmp
-
memory/4704-144-0x000000000054C05E-mapping.dmp
-
memory/4704-143-0x0000000000400000-0x0000000000552000-memory.dmpFilesize
1.3MB
-
memory/4704-149-0x0000000005660000-0x0000000005C04000-memory.dmpFilesize
5.6MB
-
memory/4720-146-0x0000000000000000-mapping.dmp