Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
16/03/2023, 06:56
General
-
Target
5f4b0475c50266443e5d50ed496912ef.exe
-
Size
114KB
-
MD5
5f4b0475c50266443e5d50ed496912ef
-
SHA1
6e97a7131a9285e3a182e739017e5bde4548f6dd
-
SHA256
d8f5f009931fd90779977cf627be88062fa857ec2c40d49d7a48fcf066e76aca
-
SHA512
c1b90ce4944aa6bf30ff1a873bc8ed54f02ea5d9a8e5719665ff38780ba7d29c8d5fb5a4c8caae6fd39f06dcd56aaebb47d9ae9276c8455b93d5f9f1c485412e
-
SSDEEP
3072:CYI6FRm+tAaSEpuCzUxkiVdwbCH5GzcZji:CrmttxnuCzuvdwbm5GzcZ
Malware Config
Signatures
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies Control Panel 4 IoCs
-
Modifies registry class 6 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f4b0475c50266443e5d50ed496912ef.exe"C:\Users\Admin\AppData\Local\Temp\5f4b0475c50266443e5d50ed496912ef.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "5f4b0475c50266443e5d50ed496912ef" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\5f4b0475c50266443e5d50ed496912ef.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\5f4b0475c50266443e5d50ed496912ef.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\5f4b0475c50266443e5d50ed496912ef.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "5f4b0475c50266443e5d50ed496912ef" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\5f4b0475c50266443e5d50ed496912ef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\ServiceHub\5f4b0475c50266443e5d50ed496912ef.exe"C:\Users\Admin\AppData\Local\ServiceHub\5f4b0475c50266443e5d50ed496912ef.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\ServiceHub\5f4b0475c50266443e5d50ed496912ef.exeC:\Users\Admin\AppData\Local\ServiceHub\5f4b0475c50266443e5d50ed496912ef.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
701B
MD51cfcc2ffa3019d3784f5852dd5547f84
SHA13fe48e46b1f9df2e3b4a5d8ddd6b1792d3ce7513
SHA256464a15de513b3da8a8d28732020c88a5b3d9e1b08c0d1d0b7248821999dae23a
SHA51276117b61890d2b4abd85a8aad98b8a2f65aeb885efee74206c0b83aa7f305f7b1b62c6ded58fa3042d06298310074f27849f54f52aabb805eb68e5a75eff55de
-
Filesize
114KB
MD55f4b0475c50266443e5d50ed496912ef
SHA16e97a7131a9285e3a182e739017e5bde4548f6dd
SHA256d8f5f009931fd90779977cf627be88062fa857ec2c40d49d7a48fcf066e76aca
SHA512c1b90ce4944aa6bf30ff1a873bc8ed54f02ea5d9a8e5719665ff38780ba7d29c8d5fb5a4c8caae6fd39f06dcd56aaebb47d9ae9276c8455b93d5f9f1c485412e
-
Filesize
114KB
MD55f4b0475c50266443e5d50ed496912ef
SHA16e97a7131a9285e3a182e739017e5bde4548f6dd
SHA256d8f5f009931fd90779977cf627be88062fa857ec2c40d49d7a48fcf066e76aca
SHA512c1b90ce4944aa6bf30ff1a873bc8ed54f02ea5d9a8e5719665ff38780ba7d29c8d5fb5a4c8caae6fd39f06dcd56aaebb47d9ae9276c8455b93d5f9f1c485412e
-
Filesize
114KB
MD55f4b0475c50266443e5d50ed496912ef
SHA16e97a7131a9285e3a182e739017e5bde4548f6dd
SHA256d8f5f009931fd90779977cf627be88062fa857ec2c40d49d7a48fcf066e76aca
SHA512c1b90ce4944aa6bf30ff1a873bc8ed54f02ea5d9a8e5719665ff38780ba7d29c8d5fb5a4c8caae6fd39f06dcd56aaebb47d9ae9276c8455b93d5f9f1c485412e
-
Filesize
675KB
MD513ab867699e7cc884f60afdcfe8d9540
SHA1fef6b65aa872021fbca0d193b892c5ecc9998e5f
SHA256bb5470f162bf1d78a7bb3e8eb42c235c1963625c6f56d1da6de39b942755065e
SHA5121f806b14bbe35768dc823ce000b742f243dfc400eaba953f9a639992ad74b5aea21f34257241f395ede118a9a2589d0541bf6810058f582d07aff325dbb3ceee
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
