eternity | 1aa3321c7e05114a5e58a78fdd743d46e32b09769ee53b487bd0c3a6193386e3

General

Target

INVOICE-7141.JPEG.vbs
Size

448KB
MD5

6b706c27af192877a7a5c18e5d5333ed
SHA1

9e495be0251a70a66b2aa9d1343894662e0870da
SHA256

1aa3321c7e05114a5e58a78fdd743d46e32b09769ee53b487bd0c3a6193386e3
SHA512

28c99beb920653bdc33247f6084d52c403819606f5550dc2f16960107756705313b03ec3a0207bd73bc33df4801786e891c97da960bdb43d4e776baeaac8772b
SSDEEP

6144:nF6Fv7Z2YncQOPd6sb38ZCpzCC5vrBEtRqG22BgA7EDfXDcmW7EFUBB:nFSncQMb8MwoNEtgG22BgA4bzcmOlB

Score

10^/10

eternity collection spyware stealer

Malware Config

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe

Executes dropped EXE 1 IoCs

pid	Process
5020	s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5116	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
5020	s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5020	s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4824	4756	WScript.exe	79
PID 4756 wrote to memory of 4824	4756	WScript.exe	79
PID 4756 wrote to memory of 5020	4756	WScript.exe	81
PID 4756 wrote to memory of 5020	4756	WScript.exe	81
PID 5020 wrote to memory of 4376	5020	s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe	82
PID 5020 wrote to memory of 4376	5020	s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe	82
PID 4376 wrote to memory of 1636	4376	cmd.exe	84
PID 4376 wrote to memory of 1636	4376	cmd.exe	84
PID 4376 wrote to memory of 1112	4376	cmd.exe	85
PID 4376 wrote to memory of 1112	4376	cmd.exe	85
PID 4376 wrote to memory of 4328	4376	cmd.exe	86
PID 4376 wrote to memory of 4328	4376	cmd.exe	86
PID 5020 wrote to memory of 1248	5020	s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe	87
PID 5020 wrote to memory of 1248	5020	s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe	87
PID 1248 wrote to memory of 1664	1248	cmd.exe	89
PID 1248 wrote to memory of 1664	1248	cmd.exe	89
PID 1248 wrote to memory of 1740	1248	cmd.exe	90
PID 1248 wrote to memory of 1740	1248	cmd.exe	90
PID 1248 wrote to memory of 2764	1248	cmd.exe	91
PID 1248 wrote to memory of 2764	1248	cmd.exe	91
PID 5020 wrote to memory of 5032	5020	s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe	92
PID 5020 wrote to memory of 5032	5020	s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe	92
PID 5032 wrote to memory of 4288	5032	cmd.exe	94
PID 5032 wrote to memory of 4288	5032	cmd.exe	94
PID 5032 wrote to memory of 5116	5032	cmd.exe	95
PID 5032 wrote to memory of 5116	5032	cmd.exe	95

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\INVOICE-7141.JPEG.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\System32\certutil.exe
  "C:\Windows\System32\certutil.exe" -decode C:\Users\Admin\AppData\Local\Temp\G97798c82ee8e889c30f8a7 C:\Users\Admin\AppData\Local\Temp\s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe
  2⤵
  PID:4824
- C:\Users\Admin\AppData\Local\Temp\s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe
  "C:\Users\Admin\AppData\Local\Temp\s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:5020
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1636
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      PID:1112
  - - C:\Windows\system32\findstr.exe
      findstr All
      4⤵
      PID:4328
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1248
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1664
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="65001" key=clear
      4⤵
      PID:1740
  - - C:\Windows\system32\findstr.exe
      findstr Key
      4⤵
      PID:2764
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4288
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

1

T1102

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\G97798c82ee8e889c30f8a7

Filesize
447KB

MD5
4c502684c2d3b705c40dacc52cb005ad

SHA1
e7227a5d2592398b09c73c2f087ec697e5f4c815

SHA256
0fb0f53ea8b7d80ca3ba34c06147d6314387d3ba005c1048ee192047999f9995

SHA512
7253944292eb6570143416cb1d09ef6958f9b9fe65001a7427691b9b14c73a52fd291d47e7378aaf53c17b7ddb9bb44e1833764a9eaa65c533f0fb7206289e69

Download Submit
C:\Users\Admin\AppData\Local\Temp\s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe

Filesize
335KB

MD5
5edb806bdb9c9722ef3e462c2de79387

SHA1
7f578ee428b4ea2a735c078db6ee0c567afe7d20

SHA256
a0bc1875cfc85a930f69f40d2c1b66b9de3d79382b2e2c47f5ad60759944335b

SHA512
b482726f968db6c966533737c1a996adbaceb231be8f08486ffa1607d5a65900e8a34e3781bc97a4a2b4055750a111265cc69ae366cad9d25cb8071223934b7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\s53a4a2b43e0fe695c72d119dfbb986a73c3b57.exe

Filesize
335KB

MD5
5edb806bdb9c9722ef3e462c2de79387

SHA1
7f578ee428b4ea2a735c078db6ee0c567afe7d20

SHA256
a0bc1875cfc85a930f69f40d2c1b66b9de3d79382b2e2c47f5ad60759944335b

SHA512
b482726f968db6c966533737c1a996adbaceb231be8f08486ffa1607d5a65900e8a34e3781bc97a4a2b4055750a111265cc69ae366cad9d25cb8071223934b7e

Download Submit
memory/5020-140-0x000002493A3C0000-0x000002493A410000-memory.dmp

Filesize
320KB

Download
memory/5020-137-0x000002491F240000-0x000002491F29A000-memory.dmp

Filesize
360KB

Download
memory/5020-138-0x00007FFB80490000-0x00007FFB80F51000-memory.dmp

Filesize
10.8MB

Download
memory/5020-148-0x00007FFB80490000-0x00007FFB80F51000-memory.dmp

Filesize
10.8MB

Download
memory/5020-152-0x00007FFB80490000-0x00007FFB80F51000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads