Overview

overview

10

Static

static

10

adc58a2e5e...2a.exe

windows7-x64

10

adc58a2e5e...2a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/01/2023, 19:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    adc58a2e5e4ee12e37210bb1ce44e92a.exe

  • Size

    112KB

  • MD5

    adc58a2e5e4ee12e37210bb1ce44e92a

  • SHA1

    1f88297c23d085b4c9fa8491c3769b66ac75b28e

  • SHA256

    f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f

  • SHA512

    9cac4f661e541f2033ac7a5a7ae1d82738e693478dc59c2236c368229782da568d9b574d38193c784404a5a9d862957a203962d8ebfdbb4fa44655a6813518be

  • SSDEEP

    3072:awEBEGyAUxgnLEKKph6bSBrIbznbKLkcYloZji:acAUxgnLIh6mJIbbGYloZ

Score
10/10
eternityevasionransomware

Malware Config

Signatures

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    eternity
  • Disables Task Manager via registry modification
    evasion
  • Executes dropped EXE 2 IoCs
  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 6 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\adc58a2e5e4ee12e37210bb1ce44e92a.exe
    "C:\Users\Admin\AppData\Local\Temp\adc58a2e5e4ee12e37210bb1ce44e92a.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4196
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "adc58a2e5e4ee12e37210bb1ce44e92a" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\adc58a2e5e4ee12e37210bb1ce44e92a.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\adc58a2e5e4ee12e37210bb1ce44e92a.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\adc58a2e5e4ee12e37210bb1ce44e92a.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5000
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
          PID:4584
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:444
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "adc58a2e5e4ee12e37210bb1ce44e92a" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\adc58a2e5e4ee12e37210bb1ce44e92a.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:4772
        • C:\Users\Admin\AppData\Local\ServiceHub\adc58a2e5e4ee12e37210bb1ce44e92a.exe
          "C:\Users\Admin\AppData\Local\ServiceHub\adc58a2e5e4ee12e37210bb1ce44e92a.exe"
          3⤵
          • Executes dropped EXE
          • Modifies extensions of user files
          • Checks computer location settings
          • Drops desktop.ini file(s)
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4884
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4912
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              5⤵
                PID:2016
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:844
      • C:\Users\Admin\AppData\Local\ServiceHub\adc58a2e5e4ee12e37210bb1ce44e92a.exe
        C:\Users\Admin\AppData\Local\ServiceHub\adc58a2e5e4ee12e37210bb1ce44e92a.exe
        1⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Drops desktop.ini file(s)
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4268
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3836
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            3⤵
              PID:3212

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\adc58a2e5e4ee12e37210bb1ce44e92a.exe.log
          Filesize

          609B

          MD5

          d12b2202c8663de63120a7239216f4c9

          SHA1

          f0263381d735e0d3a029378de06e6c49f386bb4f

          SHA256

          a1523cbbb1efe7eaed779caf6077a067519945accb1ab61a4c39323fffea6e5d

          SHA512

          942e728bb334cd3a7c634617c04cc2848124505a7a5b3f3081e5d46334e313b1f6fbf854e94d4f44dd51692c39cd19d239b15de3f0aa443ebd8d60db2868ab80

          Download Submit

        • C:\Users\Admin\AppData\Local\ServiceHub\adc58a2e5e4ee12e37210bb1ce44e92a.exe
          Filesize

          112KB

          MD5

          adc58a2e5e4ee12e37210bb1ce44e92a

          SHA1

          1f88297c23d085b4c9fa8491c3769b66ac75b28e

          SHA256

          f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f

          SHA512

          9cac4f661e541f2033ac7a5a7ae1d82738e693478dc59c2236c368229782da568d9b574d38193c784404a5a9d862957a203962d8ebfdbb4fa44655a6813518be

          Download Submit

        • C:\Users\Admin\AppData\Local\ServiceHub\adc58a2e5e4ee12e37210bb1ce44e92a.exe
          Filesize

          112KB

          MD5

          adc58a2e5e4ee12e37210bb1ce44e92a

          SHA1

          1f88297c23d085b4c9fa8491c3769b66ac75b28e

          SHA256

          f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f

          SHA512

          9cac4f661e541f2033ac7a5a7ae1d82738e693478dc59c2236c368229782da568d9b574d38193c784404a5a9d862957a203962d8ebfdbb4fa44655a6813518be

          Download Submit

        • C:\Users\Admin\AppData\Local\ServiceHub\adc58a2e5e4ee12e37210bb1ce44e92a.exe
          Filesize

          112KB

          MD5

          adc58a2e5e4ee12e37210bb1ce44e92a

          SHA1

          1f88297c23d085b4c9fa8491c3769b66ac75b28e

          SHA256

          f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f

          SHA512

          9cac4f661e541f2033ac7a5a7ae1d82738e693478dc59c2236c368229782da568d9b574d38193c784404a5a9d862957a203962d8ebfdbb4fa44655a6813518be

          Download Submit

        • memory/4196-133-0x0000000005C00000-0x00000000061A4000-memory.dmp

          Filesize

          5.6MB

          Download

        • memory/4196-134-0x00000000054F0000-0x0000000005582000-memory.dmp

          Filesize

          584KB

          Download

        • memory/4196-132-0x0000000000AD0000-0x0000000000AF2000-memory.dmp

          Filesize

          136KB

          Download

        • memory/4884-143-0x0000000004D90000-0x0000000004DF6000-memory.dmp

          Filesize

          408KB

          Download

        • memory/4884-146-0x0000000002610000-0x000000000261A000-memory.dmp

          Filesize

          40KB

          Download