Overview

overview

10

Static

static

10

HEUR-Troja...52.exe

windows7-x64

10

HEUR-Troja...52.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/12/2022, 09:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    HEUR-Trojan.MSIL.DelShad.gen-966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe

  • Size

    111KB

  • MD5

    27063953e8334bc1d395274a3ff8e66f

  • SHA1

    c99c0c640f2cf83d15a5d77851b01f46351925db

  • SHA256

    966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352

  • SHA512

    c55dab437eeef8a533361e3c406011b2bcee256ba05e654d27ccbb7acdfe739bdb62ca20cc0130b01ccb3c718424e26ca6bcb3c5260b633741105a137459e331

  • SSDEEP

    1536:zK5oJuznccI1E2POyocnQZZZZZZZZZonfnGiA1kMb7cSt6gCYU4dZji:zKdccI1E2POyoUfY1kMb7c86g9DZji

Score
10/10
eternityevasionransomware

Malware Config

Signatures

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    eternity
  • Disables Task Manager via registry modification
    evasion
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies Control Panel 4 IoCs
    evasion
  • Modifies registry class 6 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.DelShad.gen-966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe
    "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.DelShad.gen-966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3676
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "HEUR-Trojan.MSIL.DelShad.gen-966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\HEUR-Trojan.MSIL.DelShad.gen-966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.DelShad.gen-966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\HEUR-Trojan.MSIL.DelShad.gen-966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5000
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
          PID:4584
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:3444
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "HEUR-Trojan.MSIL.DelShad.gen-966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\HEUR-Trojan.MSIL.DelShad.gen-966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:4900
        • C:\Users\Admin\AppData\Local\ServiceHub\HEUR-Trojan.MSIL.DelShad.gen-966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe
          "C:\Users\Admin\AppData\Local\ServiceHub\HEUR-Trojan.MSIL.DelShad.gen-966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe"
          3⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Sets desktop wallpaper using registry
          • Modifies Control Panel
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4856
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:768
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              5⤵
                PID:4620
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3480
      • C:\Users\Admin\AppData\Local\ServiceHub\HEUR-Trojan.MSIL.DelShad.gen-966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe
        C:\Users\Admin\AppData\Local\ServiceHub\HEUR-Trojan.MSIL.DelShad.gen-966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe
        1⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Sets desktop wallpaper using registry
        • Modifies Control Panel
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1748
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2756
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            3⤵
              PID:4000

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HEUR-Trojan.MSIL.DelShad.gen-966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe.log
                Filesize

                609B

                MD5

                d12b2202c8663de63120a7239216f4c9

                SHA1

                f0263381d735e0d3a029378de06e6c49f386bb4f

                SHA256

                a1523cbbb1efe7eaed779caf6077a067519945accb1ab61a4c39323fffea6e5d

                SHA512

                942e728bb334cd3a7c634617c04cc2848124505a7a5b3f3081e5d46334e313b1f6fbf854e94d4f44dd51692c39cd19d239b15de3f0aa443ebd8d60db2868ab80

                Download Submit

              • C:\Users\Admin\AppData\Local\ServiceHub\HEUR-Trojan.MSIL.DelShad.gen-966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe
                Filesize

                111KB

                MD5

                27063953e8334bc1d395274a3ff8e66f

                SHA1

                c99c0c640f2cf83d15a5d77851b01f46351925db

                SHA256

                966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352

                SHA512

                c55dab437eeef8a533361e3c406011b2bcee256ba05e654d27ccbb7acdfe739bdb62ca20cc0130b01ccb3c718424e26ca6bcb3c5260b633741105a137459e331

                Download Submit

              • C:\Users\Admin\AppData\Local\ServiceHub\HEUR-Trojan.MSIL.DelShad.gen-966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe
                Filesize

                111KB

                MD5

                27063953e8334bc1d395274a3ff8e66f

                SHA1

                c99c0c640f2cf83d15a5d77851b01f46351925db

                SHA256

                966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352

                SHA512

                c55dab437eeef8a533361e3c406011b2bcee256ba05e654d27ccbb7acdfe739bdb62ca20cc0130b01ccb3c718424e26ca6bcb3c5260b633741105a137459e331

                Download Submit

              • C:\Users\Admin\AppData\Local\ServiceHub\HEUR-Trojan.MSIL.DelShad.gen-966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352.exe
                Filesize

                111KB

                MD5

                27063953e8334bc1d395274a3ff8e66f

                SHA1

                c99c0c640f2cf83d15a5d77851b01f46351925db

                SHA256

                966d30370c36f1e4f75655756f96ee424e3402427b20cfce5c93d9f4238d6352

                SHA512

                c55dab437eeef8a533361e3c406011b2bcee256ba05e654d27ccbb7acdfe739bdb62ca20cc0130b01ccb3c718424e26ca6bcb3c5260b633741105a137459e331

                Download Submit

              • memory/3676-134-0x00000000054A0000-0x0000000005532000-memory.dmp

                Filesize

                584KB

                Download

              • memory/3676-132-0x0000000000AE0000-0x0000000000B02000-memory.dmp

                Filesize

                136KB

                Download

              • memory/3676-133-0x0000000005B00000-0x00000000060A4000-memory.dmp

                Filesize

                5.6MB

                Download

              • memory/4856-143-0x0000000005A60000-0x0000000005AC6000-memory.dmp

                Filesize

                408KB

                Download

              • memory/4856-146-0x0000000007910000-0x000000000791A000-memory.dmp

                Filesize

                40KB

                Download