eternity | 3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf

Analysis

max time kernel
151s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
20/01/2023, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

347KB
MD5

dafc8e7ccd381af36f19267a2a9b3f9b
SHA1

742c9021f4f0fb264c32a59a66e3ac514b8e166b
SHA256

3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf
SHA512

70779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e
SSDEEP

6144:58CS6KWJ0XJWcPZ1PiqbeiS8XDMs9HHCUA:KC9IgWrPiN0YEHHFA

Score

10^/10

eternity evasion ransomware

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Disables Task Manager via registry modification
evasion

Executes dropped EXE 4 IoCs

pid	Process
228	tmp.exe
3868	tmp.exe
4544	tmp.exe
2544	tmp.exe

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\DisconnectPing.crw => C:\Users\Admin\Pictures\DisconnectPing.crw.ecrp	tmp.exe
File renamed	C:\Users\Admin\Pictures\SearchSelect.crw => C:\Users\Admin\Pictures\SearchSelect.crw.ecrp	tmp.exe
File opened for modification	C:\Users\Admin\Pictures\SelectResize.tiff	tmp.exe
File renamed	C:\Users\Admin\Pictures\SelectResize.tiff => C:\Users\Admin\Pictures\SelectResize.tiff.ecrp	tmp.exe
File opened for modification	C:\Users\Admin\Pictures\ShowClose.tiff	tmp.exe
File renamed	C:\Users\Admin\Pictures\ShowClose.tiff => C:\Users\Admin\Pictures\ShowClose.tiff.ecrp	tmp.exe
File renamed	C:\Users\Admin\Pictures\UpdateSave.png => C:\Users\Admin\Pictures\UpdateSave.png.ecrp	tmp.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	tmp.exe

Drops desktop.ini file(s) 10 IoCs

description	ioc	Process
File created	C:\Users\Admin\Desktop\desktop.ini	tmp.exe
File created	C:\Users\Admin\Pictures\desktop.ini	tmp.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	tmp.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	tmp.exe
File created	C:\Users\Admin\Desktop\desktop.ini	tmp.exe
File created	C:\Users\Admin\Downloads\desktop.ini	tmp.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	tmp.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	tmp.exe
File created	C:\Users\Admin\Downloads\desktop.ini	tmp.exe
File created	C:\Users\Admin\Pictures\desktop.ini	tmp.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2100 set thread context of 2800	2100	tmp.exe	81
PID 228 set thread context of 3868	228	tmp.exe	92
PID 4544 set thread context of 2544	4544	tmp.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1940	schtasks.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\.ecrp\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\ServiceHub\\tmp.exe %1"	tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\.ecrp	tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\.ecrp\shell\open\command	tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\.ecrp\shell	tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\.ecrp\shell\open	tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\.ecrp\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\ServiceHub\\tmp.exe %1"	tmp.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3524	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
3868	tmp.exe
2544	tmp.exe
3868	tmp.exe
2544	tmp.exe
3868	tmp.exe
2544	tmp.exe
3868	tmp.exe
2544	tmp.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3868	tmp.exe
Token: SeBackupPrivilege	4620	vssvc.exe
Token: SeRestorePrivilege	4620	vssvc.exe
Token: SeAuditPrivilege	4620	vssvc.exe
Token: SeDebugPrivilege	2544	tmp.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2800	2100	tmp.exe	81
PID 2100 wrote to memory of 2800	2100	tmp.exe	81
PID 2100 wrote to memory of 2800	2100	tmp.exe	81
PID 2100 wrote to memory of 2800	2100	tmp.exe	81
PID 2100 wrote to memory of 2800	2100	tmp.exe	81
PID 2100 wrote to memory of 2800	2100	tmp.exe	81
PID 2100 wrote to memory of 2800	2100	tmp.exe	81
PID 2100 wrote to memory of 2800	2100	tmp.exe	81
PID 2800 wrote to memory of 5028	2800	tmp.exe	84
PID 2800 wrote to memory of 5028	2800	tmp.exe	84
PID 2800 wrote to memory of 5028	2800	tmp.exe	84
PID 5028 wrote to memory of 1632	5028	cmd.exe	86
PID 5028 wrote to memory of 1632	5028	cmd.exe	86
PID 5028 wrote to memory of 1632	5028	cmd.exe	86
PID 5028 wrote to memory of 3524	5028	cmd.exe	87
PID 5028 wrote to memory of 3524	5028	cmd.exe	87
PID 5028 wrote to memory of 3524	5028	cmd.exe	87
PID 5028 wrote to memory of 1940	5028	cmd.exe	89
PID 5028 wrote to memory of 1940	5028	cmd.exe	89
PID 5028 wrote to memory of 1940	5028	cmd.exe	89
PID 5028 wrote to memory of 228	5028	cmd.exe	90
PID 5028 wrote to memory of 228	5028	cmd.exe	90
PID 5028 wrote to memory of 228	5028	cmd.exe	90
PID 228 wrote to memory of 3868	228	tmp.exe	92
PID 228 wrote to memory of 3868	228	tmp.exe	92
PID 228 wrote to memory of 3868	228	tmp.exe	92
PID 228 wrote to memory of 3868	228	tmp.exe	92
PID 228 wrote to memory of 3868	228	tmp.exe	92
PID 228 wrote to memory of 3868	228	tmp.exe	92
PID 228 wrote to memory of 3868	228	tmp.exe	92
PID 228 wrote to memory of 3868	228	tmp.exe	92
PID 3868 wrote to memory of 3424	3868	tmp.exe	96
PID 3868 wrote to memory of 3424	3868	tmp.exe	96
PID 3868 wrote to memory of 3424	3868	tmp.exe	96
PID 3424 wrote to memory of 1824	3424	cmd.exe	98
PID 3424 wrote to memory of 1824	3424	cmd.exe	98
PID 3424 wrote to memory of 1824	3424	cmd.exe	98
PID 4544 wrote to memory of 2544	4544	tmp.exe	106
PID 4544 wrote to memory of 2544	4544	tmp.exe	106
PID 4544 wrote to memory of 2544	4544	tmp.exe	106
PID 4544 wrote to memory of 2544	4544	tmp.exe	106
PID 4544 wrote to memory of 2544	4544	tmp.exe	106
PID 4544 wrote to memory of 2544	4544	tmp.exe	106
PID 4544 wrote to memory of 2544	4544	tmp.exe	106
PID 4544 wrote to memory of 2544	4544	tmp.exe	106
PID 2544 wrote to memory of 5112	2544	tmp.exe	108
PID 2544 wrote to memory of 5112	2544	tmp.exe	108
PID 2544 wrote to memory of 5112	2544	tmp.exe	108
PID 5112 wrote to memory of 2368	5112	cmd.exe	110
PID 5112 wrote to memory of 2368	5112	cmd.exe	110
PID 5112 wrote to memory of 2368	5112	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "tmp" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\tmp.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:1632
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3524
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "tmp" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:1940
  - - C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe
      "C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:228
    - - C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe
        
        "C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe"
        5⤵
        Executes dropped EXE
        Modifies extensions of user files
        Checks computer location settings
        Drops desktop.ini file(s)
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3868
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3424
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        7⤵
        
        PID:1824

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe
C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe
  "C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Drops desktop.ini file(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:2368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tmp.exe.log

Filesize
609B

MD5
d12b2202c8663de63120a7239216f4c9

SHA1
f0263381d735e0d3a029378de06e6c49f386bb4f

SHA256
a1523cbbb1efe7eaed779caf6077a067519945accb1ab61a4c39323fffea6e5d

SHA512
942e728bb334cd3a7c634617c04cc2848124505a7a5b3f3081e5d46334e313b1f6fbf854e94d4f44dd51692c39cd19d239b15de3f0aa443ebd8d60db2868ab80

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe

Filesize
347KB

MD5
dafc8e7ccd381af36f19267a2a9b3f9b

SHA1
742c9021f4f0fb264c32a59a66e3ac514b8e166b

SHA256
3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf

SHA512
70779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe

Filesize
347KB

MD5
dafc8e7ccd381af36f19267a2a9b3f9b

SHA1
742c9021f4f0fb264c32a59a66e3ac514b8e166b

SHA256
3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf

SHA512
70779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe

Filesize
347KB

MD5
dafc8e7ccd381af36f19267a2a9b3f9b

SHA1
742c9021f4f0fb264c32a59a66e3ac514b8e166b

SHA256
3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf

SHA512
70779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe

Filesize
347KB

MD5
dafc8e7ccd381af36f19267a2a9b3f9b

SHA1
742c9021f4f0fb264c32a59a66e3ac514b8e166b

SHA256
3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf

SHA512
70779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe

Filesize
347KB

MD5
dafc8e7ccd381af36f19267a2a9b3f9b

SHA1
742c9021f4f0fb264c32a59a66e3ac514b8e166b

SHA256
3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf

SHA512
70779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e

Download Submit
memory/2100-132-0x00000000000D0000-0x000000000012C000-memory.dmp

Filesize
368KB

Download
memory/2100-133-0x0000000004F80000-0x0000000005524000-memory.dmp

Filesize
5.6MB

Download
memory/2800-136-0x00000000056F0000-0x0000000005782000-memory.dmp

Filesize
584KB

Download
memory/2800-135-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3868-148-0x0000000005570000-0x00000000055D6000-memory.dmp

Filesize
408KB

Download
memory/3868-151-0x0000000006900000-0x000000000690A000-memory.dmp

Filesize
40KB

Download