eternity | f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2023, 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

112KB
MD5

adc58a2e5e4ee12e37210bb1ce44e92a
SHA1

1f88297c23d085b4c9fa8491c3769b66ac75b28e
SHA256

f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f
SHA512

9cac4f661e541f2033ac7a5a7ae1d82738e693478dc59c2236c368229782da568d9b574d38193c784404a5a9d862957a203962d8ebfdbb4fa44655a6813518be
SSDEEP

3072:awEBEGyAUxgnLEKKph6bSBrIbznbKLkcYloZji:acAUxgnLIh6mJIbbGYloZ

Score

10^/10

eternity evasion ransomware

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
2628	tmp.exe
3064	tmp.exe

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\RevokeExit.tif => C:\Users\Admin\Pictures\RevokeExit.tif.ecrp	tmp.exe
File renamed	C:\Users\Admin\Pictures\StartTest.raw => C:\Users\Admin\Pictures\StartTest.raw.ecrp	tmp.exe
File renamed	C:\Users\Admin\Pictures\UnblockRename.png => C:\Users\Admin\Pictures\UnblockRename.png.ecrp	tmp.exe
File renamed	C:\Users\Admin\Pictures\CloseNew.crw => C:\Users\Admin\Pictures\CloseNew.crw.ecrp	tmp.exe
File renamed	C:\Users\Admin\Pictures\EnterReset.crw => C:\Users\Admin\Pictures\EnterReset.crw.ecrp	tmp.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	tmp.exe

Drops desktop.ini file(s) 10 IoCs

description	ioc	Process
File created	C:\Users\Admin\Pictures\desktop.ini	tmp.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	tmp.exe
File created	C:\Users\Admin\Desktop\desktop.ini	tmp.exe
File created	C:\Users\Admin\Downloads\desktop.ini	tmp.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	tmp.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	tmp.exe
File created	C:\Users\Admin\Pictures\desktop.ini	tmp.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	tmp.exe
File created	C:\Users\Admin\Desktop\desktop.ini	tmp.exe
File created	C:\Users\Admin\Downloads\desktop.ini	tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1180	schtasks.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.ecrp\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\ServiceHub\\tmp.exe %1"	tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.ecrp	tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.ecrp\shell\open\command	tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.ecrp\shell	tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.ecrp\shell\open	tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\.ecrp\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\ServiceHub\\tmp.exe %1"	tmp.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1408	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
2628	tmp.exe
3064	tmp.exe
2628	tmp.exe
3064	tmp.exe
2628	tmp.exe
3064	tmp.exe
2628	tmp.exe
3064	tmp.exe
2628	tmp.exe
3064	tmp.exe
2628	tmp.exe
3064	tmp.exe
2628	tmp.exe
3064	tmp.exe
2628	tmp.exe
3064	tmp.exe
2628	tmp.exe
3064	tmp.exe
2628	tmp.exe
3064	tmp.exe
2628	tmp.exe
3064	tmp.exe
2628	tmp.exe
3064	tmp.exe
2628	tmp.exe
3064	tmp.exe
2628	tmp.exe
3064	tmp.exe
2628	tmp.exe
3064	tmp.exe
2628	tmp.exe
3064	tmp.exe
2628	tmp.exe
3064	tmp.exe
2628	tmp.exe
3064	tmp.exe
2628	tmp.exe
3064	tmp.exe
2628	tmp.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2628	tmp.exe
Token: SeBackupPrivilege	224	vssvc.exe
Token: SeRestorePrivilege	224	vssvc.exe
Token: SeAuditPrivilege	224	vssvc.exe
Token: SeDebugPrivilege	3064	tmp.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 2652	1532	tmp.exe	79
PID 1532 wrote to memory of 2652	1532	tmp.exe	79
PID 1532 wrote to memory of 2652	1532	tmp.exe	79
PID 2652 wrote to memory of 4328	2652	cmd.exe	81
PID 2652 wrote to memory of 4328	2652	cmd.exe	81
PID 2652 wrote to memory of 4328	2652	cmd.exe	81
PID 2652 wrote to memory of 1408	2652	cmd.exe	82
PID 2652 wrote to memory of 1408	2652	cmd.exe	82
PID 2652 wrote to memory of 1408	2652	cmd.exe	82
PID 2652 wrote to memory of 1180	2652	cmd.exe	86
PID 2652 wrote to memory of 1180	2652	cmd.exe	86
PID 2652 wrote to memory of 1180	2652	cmd.exe	86
PID 2652 wrote to memory of 2628	2652	cmd.exe	87
PID 2652 wrote to memory of 2628	2652	cmd.exe	87
PID 2652 wrote to memory of 2628	2652	cmd.exe	87
PID 2628 wrote to memory of 4756	2628	tmp.exe	91
PID 2628 wrote to memory of 4756	2628	tmp.exe	91
PID 2628 wrote to memory of 4756	2628	tmp.exe	91
PID 4756 wrote to memory of 4052	4756	cmd.exe	93
PID 4756 wrote to memory of 4052	4756	cmd.exe	93
PID 4756 wrote to memory of 4052	4756	cmd.exe	93
PID 3064 wrote to memory of 5092	3064	tmp.exe	104
PID 3064 wrote to memory of 5092	3064	tmp.exe	104
PID 3064 wrote to memory of 5092	3064	tmp.exe	104
PID 5092 wrote to memory of 1352	5092	cmd.exe	106
PID 5092 wrote to memory of 1352	5092	cmd.exe	106
PID 5092 wrote to memory of 1352	5092	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "tmp" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\tmp.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:4328
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "tmp" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1180
- - C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe
    "C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe"
    3⤵
    - Executes dropped EXE
    - Modifies extensions of user files
    - Checks computer location settings
    - Drops desktop.ini file(s)
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4756
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4052

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:224

C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe
C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:1352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tmp.exe.log

Filesize
609B

MD5
d12b2202c8663de63120a7239216f4c9

SHA1
f0263381d735e0d3a029378de06e6c49f386bb4f

SHA256
a1523cbbb1efe7eaed779caf6077a067519945accb1ab61a4c39323fffea6e5d

SHA512
942e728bb334cd3a7c634617c04cc2848124505a7a5b3f3081e5d46334e313b1f6fbf854e94d4f44dd51692c39cd19d239b15de3f0aa443ebd8d60db2868ab80

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe

Filesize
112KB

MD5
adc58a2e5e4ee12e37210bb1ce44e92a

SHA1
1f88297c23d085b4c9fa8491c3769b66ac75b28e

SHA256
f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f

SHA512
9cac4f661e541f2033ac7a5a7ae1d82738e693478dc59c2236c368229782da568d9b574d38193c784404a5a9d862957a203962d8ebfdbb4fa44655a6813518be

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe

Filesize
112KB

MD5
adc58a2e5e4ee12e37210bb1ce44e92a

SHA1
1f88297c23d085b4c9fa8491c3769b66ac75b28e

SHA256
f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f

SHA512
9cac4f661e541f2033ac7a5a7ae1d82738e693478dc59c2236c368229782da568d9b574d38193c784404a5a9d862957a203962d8ebfdbb4fa44655a6813518be

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\tmp.exe

Filesize
112KB

MD5
adc58a2e5e4ee12e37210bb1ce44e92a

SHA1
1f88297c23d085b4c9fa8491c3769b66ac75b28e

SHA256
f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f

SHA512
9cac4f661e541f2033ac7a5a7ae1d82738e693478dc59c2236c368229782da568d9b574d38193c784404a5a9d862957a203962d8ebfdbb4fa44655a6813518be

Download Submit
memory/1532-132-0x00000000008A0000-0x00000000008C2000-memory.dmp

Filesize
136KB

Download
memory/1532-134-0x00000000052F0000-0x0000000005382000-memory.dmp

Filesize
584KB

Download
memory/1532-133-0x00000000058A0000-0x0000000005E44000-memory.dmp

Filesize
5.6MB

Download
memory/2628-143-0x0000000005240000-0x00000000052A6000-memory.dmp

Filesize
408KB

Download
memory/2628-146-0x0000000006850000-0x000000000685A000-memory.dmp

Filesize
40KB

Download