Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
09-03-2023 19:16
Behavioral task
behavioral1
Sample
3de35e7b319c69cbc465bb97b8684d22.exe
Resource
win7-20230220-en
General
-
Target
3de35e7b319c69cbc465bb97b8684d22.exe
-
Size
328KB
-
MD5
3de35e7b319c69cbc465bb97b8684d22
-
SHA1
9392dc690cde034ae8c957d793feed0b51c0f353
-
SHA256
c8f009a16c673aa03ccc98e574f146bb358507684977a5c9645b0fff7ba2c40f
-
SHA512
3d6b368c47e88aecaca2f56f59f120543b7212dd3795c230180b1e3fff7ab5dcbbf25915ae943545a78de5d77d5e641f66670e79199c7599531ffd07d52c7be9
-
SSDEEP
6144:gp5T7GLVfqagP4tid/ijocghwL5jPZgzCrzLZ0Nmj4tDhO14Aue:gb7GLJ9Ad6jokgzC7m64Yue
Malware Config
Signatures
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Executes dropped EXE 2 IoCs
Processes:
Microsoft.AAD.BrokerPlugin.exetmp1522.tmp.exepid process 620 Microsoft.AAD.BrokerPlugin.exe 872 tmp1522.tmp.exe -
Loads dropped DLL 3 IoCs
Processes:
3de35e7b319c69cbc465bb97b8684d22.exepid process 912 3de35e7b319c69cbc465bb97b8684d22.exe 912 3de35e7b319c69cbc465bb97b8684d22.exe 912 3de35e7b319c69cbc465bb97b8684d22.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
tmp1522.tmp.exedescription pid process Token: SeDebugPrivilege 872 tmp1522.tmp.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
3de35e7b319c69cbc465bb97b8684d22.exedescription pid process target process PID 912 wrote to memory of 620 912 3de35e7b319c69cbc465bb97b8684d22.exe Microsoft.AAD.BrokerPlugin.exe PID 912 wrote to memory of 620 912 3de35e7b319c69cbc465bb97b8684d22.exe Microsoft.AAD.BrokerPlugin.exe PID 912 wrote to memory of 620 912 3de35e7b319c69cbc465bb97b8684d22.exe Microsoft.AAD.BrokerPlugin.exe PID 912 wrote to memory of 620 912 3de35e7b319c69cbc465bb97b8684d22.exe Microsoft.AAD.BrokerPlugin.exe PID 912 wrote to memory of 872 912 3de35e7b319c69cbc465bb97b8684d22.exe tmp1522.tmp.exe PID 912 wrote to memory of 872 912 3de35e7b319c69cbc465bb97b8684d22.exe tmp1522.tmp.exe PID 912 wrote to memory of 872 912 3de35e7b319c69cbc465bb97b8684d22.exe tmp1522.tmp.exe PID 912 wrote to memory of 872 912 3de35e7b319c69cbc465bb97b8684d22.exe tmp1522.tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3de35e7b319c69cbc465bb97b8684d22.exe"C:\Users\Admin\AppData\Local\Temp\3de35e7b319c69cbc465bb97b8684d22.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Microsoft.AAD.BrokerPlugin.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft.AAD.BrokerPlugin.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp1522.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1522.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Microsoft.AAD.BrokerPlugin.exeFilesize
232KB
MD5c0f5ba80cf39ba6cd88707fbb81d7153
SHA14b3bd8624477dab4836806d21de5982421654bec
SHA256f3bc209067ba31bac2084524af85e575439c265cb7a42ebc8ef28ccecb7ec85d
SHA512e3c2cb1c031760d36ea491875e010fbd231f73c273214aa1b27ced0bc4a574df2517ce3fe178acbaca0458de73ba0b371e2174f6a1a854432d9ed79c89159102
-
C:\Users\Admin\AppData\Local\Temp\Microsoft.AAD.BrokerPlugin.exeFilesize
232KB
MD5c0f5ba80cf39ba6cd88707fbb81d7153
SHA14b3bd8624477dab4836806d21de5982421654bec
SHA256f3bc209067ba31bac2084524af85e575439c265cb7a42ebc8ef28ccecb7ec85d
SHA512e3c2cb1c031760d36ea491875e010fbd231f73c273214aa1b27ced0bc4a574df2517ce3fe178acbaca0458de73ba0b371e2174f6a1a854432d9ed79c89159102
-
C:\Users\Admin\AppData\Local\Temp\tmp1522.tmp.exeFilesize
76KB
MD5dbb92d6b3c324f8871bc508830b05c14
SHA14507d24c7d78a24fe5d92f916ed972709529ced0
SHA256376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8
SHA512d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a
-
C:\Users\Admin\AppData\Local\Temp\tmp1522.tmp.exeFilesize
76KB
MD5dbb92d6b3c324f8871bc508830b05c14
SHA14507d24c7d78a24fe5d92f916ed972709529ced0
SHA256376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8
SHA512d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a
-
\Users\Admin\AppData\Local\Temp\Microsoft.AAD.BrokerPlugin.exeFilesize
232KB
MD5c0f5ba80cf39ba6cd88707fbb81d7153
SHA14b3bd8624477dab4836806d21de5982421654bec
SHA256f3bc209067ba31bac2084524af85e575439c265cb7a42ebc8ef28ccecb7ec85d
SHA512e3c2cb1c031760d36ea491875e010fbd231f73c273214aa1b27ced0bc4a574df2517ce3fe178acbaca0458de73ba0b371e2174f6a1a854432d9ed79c89159102
-
\Users\Admin\AppData\Local\Temp\Microsoft.AAD.BrokerPlugin.exeFilesize
232KB
MD5c0f5ba80cf39ba6cd88707fbb81d7153
SHA14b3bd8624477dab4836806d21de5982421654bec
SHA256f3bc209067ba31bac2084524af85e575439c265cb7a42ebc8ef28ccecb7ec85d
SHA512e3c2cb1c031760d36ea491875e010fbd231f73c273214aa1b27ced0bc4a574df2517ce3fe178acbaca0458de73ba0b371e2174f6a1a854432d9ed79c89159102
-
\Users\Admin\AppData\Local\Temp\tmp1522.tmp.exeFilesize
76KB
MD5dbb92d6b3c324f8871bc508830b05c14
SHA14507d24c7d78a24fe5d92f916ed972709529ced0
SHA256376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8
SHA512d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a
-
memory/872-71-0x00000000013E0000-0x00000000013FA000-memory.dmpFilesize
104KB
-
memory/872-72-0x0000000000560000-0x00000000005A0000-memory.dmpFilesize
256KB
-
memory/872-73-0x0000000000560000-0x00000000005A0000-memory.dmpFilesize
256KB
-
memory/912-54-0x00000000008B0000-0x0000000000908000-memory.dmpFilesize
352KB
-
memory/912-56-0x0000000000570000-0x00000000005B0000-memory.dmpFilesize
256KB