Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    09-03-2023 19:16

General

  • Target

    3de35e7b319c69cbc465bb97b8684d22.exe

  • Size

    328KB

  • MD5

    3de35e7b319c69cbc465bb97b8684d22

  • SHA1

    9392dc690cde034ae8c957d793feed0b51c0f353

  • SHA256

    c8f009a16c673aa03ccc98e574f146bb358507684977a5c9645b0fff7ba2c40f

  • SHA512

    3d6b368c47e88aecaca2f56f59f120543b7212dd3795c230180b1e3fff7ab5dcbbf25915ae943545a78de5d77d5e641f66670e79199c7599531ffd07d52c7be9

  • SSDEEP

    6144:gp5T7GLVfqagP4tid/ijocghwL5jPZgzCrzLZ0Nmj4tDhO14Aue:gb7GLJ9Ad6jokgzC7m64Yue

Score
10/10

Malware Config

Signatures

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3de35e7b319c69cbc465bb97b8684d22.exe
    "C:\Users\Admin\AppData\Local\Temp\3de35e7b319c69cbc465bb97b8684d22.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:912
    • C:\Users\Admin\AppData\Local\Temp\Microsoft.AAD.BrokerPlugin.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft.AAD.BrokerPlugin.exe"
      2⤵
      • Executes dropped EXE
      PID:620
    • C:\Users\Admin\AppData\Local\Temp\tmp1522.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp1522.tmp.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:872

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Network Service Scanning

1
T1046

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Microsoft.AAD.BrokerPlugin.exe
    Filesize

    232KB

    MD5

    c0f5ba80cf39ba6cd88707fbb81d7153

    SHA1

    4b3bd8624477dab4836806d21de5982421654bec

    SHA256

    f3bc209067ba31bac2084524af85e575439c265cb7a42ebc8ef28ccecb7ec85d

    SHA512

    e3c2cb1c031760d36ea491875e010fbd231f73c273214aa1b27ced0bc4a574df2517ce3fe178acbaca0458de73ba0b371e2174f6a1a854432d9ed79c89159102

  • C:\Users\Admin\AppData\Local\Temp\Microsoft.AAD.BrokerPlugin.exe
    Filesize

    232KB

    MD5

    c0f5ba80cf39ba6cd88707fbb81d7153

    SHA1

    4b3bd8624477dab4836806d21de5982421654bec

    SHA256

    f3bc209067ba31bac2084524af85e575439c265cb7a42ebc8ef28ccecb7ec85d

    SHA512

    e3c2cb1c031760d36ea491875e010fbd231f73c273214aa1b27ced0bc4a574df2517ce3fe178acbaca0458de73ba0b371e2174f6a1a854432d9ed79c89159102

  • C:\Users\Admin\AppData\Local\Temp\tmp1522.tmp.exe
    Filesize

    76KB

    MD5

    dbb92d6b3c324f8871bc508830b05c14

    SHA1

    4507d24c7d78a24fe5d92f916ed972709529ced0

    SHA256

    376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8

    SHA512

    d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a

  • C:\Users\Admin\AppData\Local\Temp\tmp1522.tmp.exe
    Filesize

    76KB

    MD5

    dbb92d6b3c324f8871bc508830b05c14

    SHA1

    4507d24c7d78a24fe5d92f916ed972709529ced0

    SHA256

    376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8

    SHA512

    d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a

  • \Users\Admin\AppData\Local\Temp\Microsoft.AAD.BrokerPlugin.exe
    Filesize

    232KB

    MD5

    c0f5ba80cf39ba6cd88707fbb81d7153

    SHA1

    4b3bd8624477dab4836806d21de5982421654bec

    SHA256

    f3bc209067ba31bac2084524af85e575439c265cb7a42ebc8ef28ccecb7ec85d

    SHA512

    e3c2cb1c031760d36ea491875e010fbd231f73c273214aa1b27ced0bc4a574df2517ce3fe178acbaca0458de73ba0b371e2174f6a1a854432d9ed79c89159102

  • \Users\Admin\AppData\Local\Temp\Microsoft.AAD.BrokerPlugin.exe
    Filesize

    232KB

    MD5

    c0f5ba80cf39ba6cd88707fbb81d7153

    SHA1

    4b3bd8624477dab4836806d21de5982421654bec

    SHA256

    f3bc209067ba31bac2084524af85e575439c265cb7a42ebc8ef28ccecb7ec85d

    SHA512

    e3c2cb1c031760d36ea491875e010fbd231f73c273214aa1b27ced0bc4a574df2517ce3fe178acbaca0458de73ba0b371e2174f6a1a854432d9ed79c89159102

  • \Users\Admin\AppData\Local\Temp\tmp1522.tmp.exe
    Filesize

    76KB

    MD5

    dbb92d6b3c324f8871bc508830b05c14

    SHA1

    4507d24c7d78a24fe5d92f916ed972709529ced0

    SHA256

    376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8

    SHA512

    d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a

  • memory/872-71-0x00000000013E0000-0x00000000013FA000-memory.dmp
    Filesize

    104KB

  • memory/872-72-0x0000000000560000-0x00000000005A0000-memory.dmp
    Filesize

    256KB

  • memory/872-73-0x0000000000560000-0x00000000005A0000-memory.dmp
    Filesize

    256KB

  • memory/912-54-0x00000000008B0000-0x0000000000908000-memory.dmp
    Filesize

    352KB

  • memory/912-56-0x0000000000570000-0x00000000005B0000-memory.dmp
    Filesize

    256KB