Overview

overview

10

Static

static

3cded3354f...af.exe

windows7-x64

10

3cded3354f...af.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    25/01/2023, 20:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe

  • Size

    347KB

  • MD5

    dafc8e7ccd381af36f19267a2a9b3f9b

  • SHA1

    742c9021f4f0fb264c32a59a66e3ac514b8e166b

  • SHA256

    3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf

  • SHA512

    70779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e

  • SSDEEP

    6144:58CS6KWJ0XJWcPZ1PiqbeiS8XDMs9HHCUA:KC9IgWrPiN0YEHHFA

Score
10/10
eternityevasionransomware

Malware Config

Signatures

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    eternity
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Executes dropped EXE 4 IoCs
  • Modifies extensions of user files 13 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Loads dropped DLL 3 IoCs
  • Drops desktop.ini file(s) 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 5 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe
    "C:\Users\Admin\AppData\Local\Temp\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Users\Admin\AppData\Local\Temp\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe
      "C:\Users\Admin\AppData\Local\Temp\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1996
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1940
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          4⤵
            PID:584
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1
            4⤵
            • Runs ping.exe
            PID:112
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe" /rl HIGHEST /f
            4⤵
            • Creates scheduled task(s)
            PID:1868
          • C:\Users\Admin\AppData\Local\ServiceHub\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe
            "C:\Users\Admin\AppData\Local\ServiceHub\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1740
            • C:\Users\Admin\AppData\Local\ServiceHub\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe
              "C:\Users\Admin\AppData\Local\ServiceHub\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe"
              5⤵
              • Executes dropped EXE
              • Modifies extensions of user files
              • Drops desktop.ini file(s)
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2044
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:1380
                • C:\Windows\SysWOW64\chcp.com
                  chcp 65001
                  7⤵
                    PID:1868
                  • C:\Windows\SysWOW64\vssadmin.exe
                    vssadmin delete shadows /all /quiet
                    7⤵
                    • Interacts with shadow copies
                    PID:1940
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1076
      • C:\Windows\system32\taskeng.exe
        taskeng.exe {5D8DCA77-5EE7-425E-B5C3-737CE0FDF4BE} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:1552
        • C:\Users\Admin\AppData\Local\ServiceHub\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe
          C:\Users\Admin\AppData\Local\ServiceHub\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1824
          • C:\Users\Admin\AppData\Local\ServiceHub\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe
            "C:\Users\Admin\AppData\Local\ServiceHub\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe"
            3⤵
            • Executes dropped EXE
            PID:788

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\ServiceHub\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe
        Filesize

        347KB

        MD5

        dafc8e7ccd381af36f19267a2a9b3f9b

        SHA1

        742c9021f4f0fb264c32a59a66e3ac514b8e166b

        SHA256

        3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf

        SHA512

        70779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e

        Download Submit

      • C:\Users\Admin\AppData\Local\ServiceHub\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe
        Filesize

        347KB

        MD5

        dafc8e7ccd381af36f19267a2a9b3f9b

        SHA1

        742c9021f4f0fb264c32a59a66e3ac514b8e166b

        SHA256

        3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf

        SHA512

        70779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e

        Download Submit

      • C:\Users\Admin\AppData\Local\ServiceHub\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe
        Filesize

        347KB

        MD5

        dafc8e7ccd381af36f19267a2a9b3f9b

        SHA1

        742c9021f4f0fb264c32a59a66e3ac514b8e166b

        SHA256

        3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf

        SHA512

        70779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e

        Download Submit

      • C:\Users\Admin\AppData\Local\ServiceHub\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe
        Filesize

        347KB

        MD5

        dafc8e7ccd381af36f19267a2a9b3f9b

        SHA1

        742c9021f4f0fb264c32a59a66e3ac514b8e166b

        SHA256

        3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf

        SHA512

        70779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e

        Download Submit

      • C:\Users\Admin\AppData\Local\ServiceHub\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe
        Filesize

        347KB

        MD5

        dafc8e7ccd381af36f19267a2a9b3f9b

        SHA1

        742c9021f4f0fb264c32a59a66e3ac514b8e166b

        SHA256

        3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf

        SHA512

        70779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e

        Download Submit

      • \Users\Admin\AppData\Local\ServiceHub\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe
        Filesize

        347KB

        MD5

        dafc8e7ccd381af36f19267a2a9b3f9b

        SHA1

        742c9021f4f0fb264c32a59a66e3ac514b8e166b

        SHA256

        3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf

        SHA512

        70779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e

        Download Submit

      • \Users\Admin\AppData\Local\ServiceHub\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe
        Filesize

        347KB

        MD5

        dafc8e7ccd381af36f19267a2a9b3f9b

        SHA1

        742c9021f4f0fb264c32a59a66e3ac514b8e166b

        SHA256

        3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf

        SHA512

        70779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e

        Download Submit

      • \Users\Admin\AppData\Local\ServiceHub\3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf.exe
        Filesize

        347KB

        MD5

        dafc8e7ccd381af36f19267a2a9b3f9b

        SHA1

        742c9021f4f0fb264c32a59a66e3ac514b8e166b

        SHA256

        3cded3354fbcfaad7112c599b3622680a632e601602ea4f5faa07a6bcc8cbeaf

        SHA512

        70779917d042e4dc65dbac4fda2f521721f9deb42e67e4cfe3eb3a82ff508da3303b96e71bff37b2e95f51d8be7fc6e8987bb0244bd6d2be857c0e0bd44bfa4e

        Download Submit

      • memory/1708-54-0x0000000000C90000-0x0000000000CEC000-memory.dmp

        Filesize

        368KB

        Download

      • memory/1708-55-0x0000000076121000-0x0000000076123000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1740-77-0x0000000000BA0000-0x0000000000BFC000-memory.dmp

        Filesize

        368KB

        Download

      • memory/1996-67-0x0000000000400000-0x0000000000422000-memory.dmp

        Filesize

        136KB

        Download

      • memory/1996-65-0x0000000000400000-0x0000000000422000-memory.dmp

        Filesize

        136KB

        Download

      • memory/1996-62-0x0000000000400000-0x0000000000422000-memory.dmp

        Filesize

        136KB

        Download

      • memory/1996-61-0x0000000000400000-0x0000000000422000-memory.dmp

        Filesize

        136KB

        Download

      • memory/1996-59-0x0000000000400000-0x0000000000422000-memory.dmp

        Filesize

        136KB

        Download

      • memory/1996-57-0x0000000000400000-0x0000000000422000-memory.dmp

        Filesize

        136KB

        Download

      • memory/1996-56-0x0000000000400000-0x0000000000422000-memory.dmp

        Filesize

        136KB

        Download

      • memory/2044-101-0x0000000002376000-0x0000000002387000-memory.dmp

        Filesize

        68KB

        Download