Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    160s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/10/2023, 06:26

General

  • Target

    9cd351491ae286a5e72b3fbb7a370a1c924bb138970b2ac1e6d52b90ea634fab.exe

  • Size

    1.9MB

  • MD5

    5fabaccd5ac598116338a20c7a73594a

  • SHA1

    8737cce7b8dd1f1c5141aa40cf77556373069842

  • SHA256

    9cd351491ae286a5e72b3fbb7a370a1c924bb138970b2ac1e6d52b90ea634fab

  • SHA512

    4d8f228f2cb8e55b37278950de2a07784709b47c3d7716442a162396499e7f7655d67f0da9b03e55729c5b4b72af7c3781c251b59129b8a436c51dcdd36101d8

  • SSDEEP

    49152:k1QBsSmVbQ0dYeMqVRI8nEzWbONMVfJzcjpzHiUfoi:k1FSmm0d4qw8wWy+awUf/

Score
10/10

Malware Config

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Attributes
  • payload_urls

    http://167.88.170.23/w993.exe

    http://167.88.170.23/s101.exe,http://167.88.170.23/101.exe,http://167.88.170.23/R101.exe

Signatures

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9cd351491ae286a5e72b3fbb7a370a1c924bb138970b2ac1e6d52b90ea634fab.exe
    "C:\Users\Admin\AppData\Local\Temp\9cd351491ae286a5e72b3fbb7a370a1c924bb138970b2ac1e6d52b90ea634fab.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3604
    • C:\Users\Admin\AppData\Local\Temp\01.SSE NT Salary Payroll Statement Apr 21.exe
      "C:\Users\Admin\AppData\Local\Temp\01.SSE NT Salary Payroll Statement Apr 21.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Users\Admin\AppData\Local\Temp\01.SSE NT Salary Payroll Statement Apr 21.exe
        "{path}"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2596
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "01.SSE NT Salary Payroll Statement Apr 21" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\01.SSE NT Salary Payroll Statement Apr 21.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\01.SSE NT Salary Payroll Statement Apr 21.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\01.SSE NT Salary Payroll Statement Apr 21.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1836
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            5⤵
              PID:4800
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1
              5⤵
              • Runs ping.exe
              PID:180
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "01.SSE NT Salary Payroll Statement Apr 21" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\01.SSE NT Salary Payroll Statement Apr 21.exe" /rl HIGHEST /f
              5⤵
              • Creates scheduled task(s)
              PID:1688
            • C:\Users\Admin\AppData\Local\ServiceHub\01.SSE NT Salary Payroll Statement Apr 21.exe
              "C:\Users\Admin\AppData\Local\ServiceHub\01.SSE NT Salary Payroll Statement Apr 21.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1876
              • C:\Users\Admin\AppData\Local\ServiceHub\01.SSE NT Salary Payroll Statement Apr 21.exe
                "{path}"
                6⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:5020
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe "C:\Users\Admin\AppData\Local\ServiceHub\01.SSE"
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3632

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\01.SSE NT Salary Payroll Statement Apr 21.exe.log

      Filesize

      1KB

      MD5

      84e77a587d94307c0ac1357eb4d3d46f

      SHA1

      83cc900f9401f43d181207d64c5adba7a85edc1e

      SHA256

      e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99

      SHA512

      aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691

    • C:\Users\Admin\AppData\Local\ServiceHub\01.SSE NT Salary Payroll Statement Apr 21.exe

      Filesize

      1.8MB

      MD5

      68d348019229f619929995cf7f7dfa4d

      SHA1

      9e2f888c42d51f91c900bec478e703fe145e1a54

      SHA256

      6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

      SHA512

      31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    • C:\Users\Admin\AppData\Local\ServiceHub\01.SSE NT Salary Payroll Statement Apr 21.exe

      Filesize

      1.8MB

      MD5

      68d348019229f619929995cf7f7dfa4d

      SHA1

      9e2f888c42d51f91c900bec478e703fe145e1a54

      SHA256

      6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

      SHA512

      31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    • C:\Users\Admin\AppData\Local\ServiceHub\01.SSE NT Salary Payroll Statement Apr 21.exe

      Filesize

      1.8MB

      MD5

      68d348019229f619929995cf7f7dfa4d

      SHA1

      9e2f888c42d51f91c900bec478e703fe145e1a54

      SHA256

      6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

      SHA512

      31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    • C:\Users\Admin\AppData\Local\Temp\01.SSE NT Salary Payroll Statement Apr 21.exe

      Filesize

      1.8MB

      MD5

      68d348019229f619929995cf7f7dfa4d

      SHA1

      9e2f888c42d51f91c900bec478e703fe145e1a54

      SHA256

      6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

      SHA512

      31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    • C:\Users\Admin\AppData\Local\Temp\01.SSE NT Salary Payroll Statement Apr 21.exe

      Filesize

      1.8MB

      MD5

      68d348019229f619929995cf7f7dfa4d

      SHA1

      9e2f888c42d51f91c900bec478e703fe145e1a54

      SHA256

      6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

      SHA512

      31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    • C:\Users\Admin\AppData\Local\Temp\01.SSE NT Salary Payroll Statement Apr 21.exe

      Filesize

      1.8MB

      MD5

      68d348019229f619929995cf7f7dfa4d

      SHA1

      9e2f888c42d51f91c900bec478e703fe145e1a54

      SHA256

      6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

      SHA512

      31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    • C:\Users\Admin\AppData\Local\Temp\01.SSE NT Salary Payroll Statement Apr 21.exe

      Filesize

      1.8MB

      MD5

      68d348019229f619929995cf7f7dfa4d

      SHA1

      9e2f888c42d51f91c900bec478e703fe145e1a54

      SHA256

      6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

      SHA512

      31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    • memory/1876-44-0x0000000005BE0000-0x0000000005BF0000-memory.dmp

      Filesize

      64KB

    • memory/1876-43-0x0000000074D40000-0x00000000754F0000-memory.dmp

      Filesize

      7.7MB

    • memory/1876-42-0x0000000005D30000-0x0000000005D42000-memory.dmp

      Filesize

      72KB

    • memory/1876-41-0x0000000005BE0000-0x0000000005BF0000-memory.dmp

      Filesize

      64KB

    • memory/1876-40-0x0000000074D40000-0x00000000754F0000-memory.dmp

      Filesize

      7.7MB

    • memory/1876-50-0x0000000074D40000-0x00000000754F0000-memory.dmp

      Filesize

      7.7MB

    • memory/2596-28-0x0000000000400000-0x0000000000552000-memory.dmp

      Filesize

      1.3MB

    • memory/2596-36-0x0000000074D40000-0x00000000754F0000-memory.dmp

      Filesize

      7.7MB

    • memory/2596-33-0x0000000074D40000-0x00000000754F0000-memory.dmp

      Filesize

      7.7MB

    • memory/2692-18-0x0000000005F60000-0x0000000006504000-memory.dmp

      Filesize

      5.6MB

    • memory/2692-20-0x0000000005B90000-0x0000000005C2C000-memory.dmp

      Filesize

      624KB

    • memory/2692-26-0x0000000008950000-0x0000000008AF4000-memory.dmp

      Filesize

      1.6MB

    • memory/2692-25-0x0000000005CE0000-0x0000000005CF0000-memory.dmp

      Filesize

      64KB

    • memory/2692-24-0x0000000074D40000-0x00000000754F0000-memory.dmp

      Filesize

      7.7MB

    • memory/2692-32-0x0000000074D40000-0x00000000754F0000-memory.dmp

      Filesize

      7.7MB

    • memory/2692-23-0x0000000005CA0000-0x0000000005CB2000-memory.dmp

      Filesize

      72KB

    • memory/2692-22-0x0000000005B10000-0x0000000005B1A000-memory.dmp

      Filesize

      40KB

    • memory/2692-21-0x0000000005CE0000-0x0000000005CF0000-memory.dmp

      Filesize

      64KB

    • memory/2692-27-0x000000000C060000-0x000000000C1B2000-memory.dmp

      Filesize

      1.3MB

    • memory/2692-19-0x0000000005A50000-0x0000000005AE2000-memory.dmp

      Filesize

      584KB

    • memory/2692-16-0x0000000000FB0000-0x000000000118E000-memory.dmp

      Filesize

      1.9MB

    • memory/2692-15-0x0000000074D40000-0x00000000754F0000-memory.dmp

      Filesize

      7.7MB

    • memory/3604-17-0x0000000074D40000-0x00000000754F0000-memory.dmp

      Filesize

      7.7MB

    • memory/3604-0-0x0000000000140000-0x0000000000320000-memory.dmp

      Filesize

      1.9MB

    • memory/3604-2-0x0000000004D40000-0x0000000004D50000-memory.dmp

      Filesize

      64KB

    • memory/3604-1-0x0000000074D40000-0x00000000754F0000-memory.dmp

      Filesize

      7.7MB

    • memory/5020-48-0x0000000074D40000-0x00000000754F0000-memory.dmp

      Filesize

      7.7MB

    • memory/5020-49-0x0000000005520000-0x0000000005530000-memory.dmp

      Filesize

      64KB

    • memory/5020-51-0x0000000074D40000-0x00000000754F0000-memory.dmp

      Filesize

      7.7MB