Overview

overview

10

Static

static

10

b4865c2d9f...b6.exe

windows7-x64

10

b4865c2d9f...b6.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2022, 09:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b4865c2d9f23b7df972ab8a65e5e94b6.exe

  • Size

    117KB

  • MD5

    b4865c2d9f23b7df972ab8a65e5e94b6

  • SHA1

    bc3ecb00be5d812b72062be75ce7840bf1a5d9b3

  • SHA256

    ec5abef5fd32ab0f84ed7003eb6cc47b54ada0d1e8a06fd317cedfc06f5c1205

  • SHA512

    405cca6f4a69d2fb1f232f2e0762006d5f7fa9be8e01536562f2faf6b1725e280437a9b1d3294e689f3b9f718cb61a324b370581f2c45b560b833822a5c2c515

  • SSDEEP

    3072:oK1Xv0NEWNQG0a57pD8ytRb4ZVRxKUdmZji:oY8nQGFDgcRbYRxKUdmZ

Score
10/10
eternityevasionransomware

Malware Config

Signatures

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    eternity
  • Disables Task Manager via registry modification
    evasion
  • Executes dropped EXE 2 IoCs
  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 6 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4865c2d9f23b7df972ab8a65e5e94b6.exe
    "C:\Users\Admin\AppData\Local\Temp\b4865c2d9f23b7df972ab8a65e5e94b6.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4908
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "b4865c2d9f23b7df972ab8a65e5e94b6" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\b4865c2d9f23b7df972ab8a65e5e94b6.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\b4865c2d9f23b7df972ab8a65e5e94b6.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\b4865c2d9f23b7df972ab8a65e5e94b6.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2440
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
          PID:8
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:3188
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "b4865c2d9f23b7df972ab8a65e5e94b6" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\b4865c2d9f23b7df972ab8a65e5e94b6.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:4008
        • C:\Users\Admin\AppData\Local\ServiceHub\b4865c2d9f23b7df972ab8a65e5e94b6.exe
          "C:\Users\Admin\AppData\Local\ServiceHub\b4865c2d9f23b7df972ab8a65e5e94b6.exe"
          3⤵
          • Executes dropped EXE
          • Modifies extensions of user files
          • Checks computer location settings
          • Drops desktop.ini file(s)
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3352
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1284
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              5⤵
                PID:4012
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5104
      • C:\Users\Admin\AppData\Local\ServiceHub\b4865c2d9f23b7df972ab8a65e5e94b6.exe
        C:\Users\Admin\AppData\Local\ServiceHub\b4865c2d9f23b7df972ab8a65e5e94b6.exe
        1⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Drops desktop.ini file(s)
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4988
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2712
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            3⤵
              PID:2756

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\b4865c2d9f23b7df972ab8a65e5e94b6.exe.log
          Filesize

          701B

          MD5

          1cfcc2ffa3019d3784f5852dd5547f84

          SHA1

          3fe48e46b1f9df2e3b4a5d8ddd6b1792d3ce7513

          SHA256

          464a15de513b3da8a8d28732020c88a5b3d9e1b08c0d1d0b7248821999dae23a

          SHA512

          76117b61890d2b4abd85a8aad98b8a2f65aeb885efee74206c0b83aa7f305f7b1b62c6ded58fa3042d06298310074f27849f54f52aabb805eb68e5a75eff55de

          Download Submit

        • C:\Users\Admin\AppData\Local\ServiceHub\b4865c2d9f23b7df972ab8a65e5e94b6.exe
          Filesize

          117KB

          MD5

          b4865c2d9f23b7df972ab8a65e5e94b6

          SHA1

          bc3ecb00be5d812b72062be75ce7840bf1a5d9b3

          SHA256

          ec5abef5fd32ab0f84ed7003eb6cc47b54ada0d1e8a06fd317cedfc06f5c1205

          SHA512

          405cca6f4a69d2fb1f232f2e0762006d5f7fa9be8e01536562f2faf6b1725e280437a9b1d3294e689f3b9f718cb61a324b370581f2c45b560b833822a5c2c515

          Download Submit

        • C:\Users\Admin\AppData\Local\ServiceHub\b4865c2d9f23b7df972ab8a65e5e94b6.exe
          Filesize

          117KB

          MD5

          b4865c2d9f23b7df972ab8a65e5e94b6

          SHA1

          bc3ecb00be5d812b72062be75ce7840bf1a5d9b3

          SHA256

          ec5abef5fd32ab0f84ed7003eb6cc47b54ada0d1e8a06fd317cedfc06f5c1205

          SHA512

          405cca6f4a69d2fb1f232f2e0762006d5f7fa9be8e01536562f2faf6b1725e280437a9b1d3294e689f3b9f718cb61a324b370581f2c45b560b833822a5c2c515

          Download Submit

        • C:\Users\Admin\AppData\Local\ServiceHub\b4865c2d9f23b7df972ab8a65e5e94b6.exe
          Filesize

          117KB

          MD5

          b4865c2d9f23b7df972ab8a65e5e94b6

          SHA1

          bc3ecb00be5d812b72062be75ce7840bf1a5d9b3

          SHA256

          ec5abef5fd32ab0f84ed7003eb6cc47b54ada0d1e8a06fd317cedfc06f5c1205

          SHA512

          405cca6f4a69d2fb1f232f2e0762006d5f7fa9be8e01536562f2faf6b1725e280437a9b1d3294e689f3b9f718cb61a324b370581f2c45b560b833822a5c2c515

          Download Submit

        • memory/3352-146-0x0000000006930000-0x000000000693A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/4908-135-0x0000000005150000-0x00000000051B6000-memory.dmp

          Filesize

          408KB

          Download

        • memory/4908-134-0x00000000050B0000-0x0000000005142000-memory.dmp

          Filesize

          584KB

          Download

        • memory/4908-132-0x0000000000690000-0x00000000006B4000-memory.dmp

          Filesize

          144KB

          Download

        • memory/4908-133-0x00000000055C0000-0x0000000005B64000-memory.dmp

          Filesize

          5.6MB

          Download