Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 10:50
Behavioral task
behavioral1
Sample
2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe
-
Size
360KB
-
MD5
de416346446ad09a6a9a60eb98387522
-
SHA1
c2acb162955d1c1b74b06fad737ba390b66aa246
-
SHA256
5cd719f68a6ba607c63803855b41085a927987bff2687f7d96e5b156dbd747ea
-
SHA512
2024e0349cfdcd5dfee1c8813dfc31f0d2c6b16120565bdf476dc79b49ac3ea763a0adbebfbc7b747d14a40dd06ecf521914f6da8861c7ed7455e3afffb25f75
-
SSDEEP
6144:FnHUgeKAv/oozzzkfuauSOqF2G9M6myoGnPfFYgNVNVIB+wDI9N6bKYA2:FnHUgeKAv/oonM9NmyoG3FYgNVPwc9Ng
Malware Config
Extracted
eternity
http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion
Signatures
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe Key opened \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe Key opened \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 27 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 232 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2520 2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2520 2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2600 2520 2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe 97 PID 2520 wrote to memory of 2600 2520 2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe 97 PID 2600 wrote to memory of 3952 2600 cmd.exe 99 PID 2600 wrote to memory of 3952 2600 cmd.exe 99 PID 2600 wrote to memory of 4348 2600 cmd.exe 100 PID 2600 wrote to memory of 4348 2600 cmd.exe 100 PID 2600 wrote to memory of 3436 2600 cmd.exe 101 PID 2600 wrote to memory of 3436 2600 cmd.exe 101 PID 2520 wrote to memory of 4440 2520 2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe 102 PID 2520 wrote to memory of 4440 2520 2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe 102 PID 4440 wrote to memory of 3348 4440 cmd.exe 104 PID 4440 wrote to memory of 3348 4440 cmd.exe 104 PID 4440 wrote to memory of 2620 4440 cmd.exe 105 PID 4440 wrote to memory of 2620 4440 cmd.exe 105 PID 4440 wrote to memory of 2168 4440 cmd.exe 106 PID 4440 wrote to memory of 2168 4440 cmd.exe 106 PID 2520 wrote to memory of 1212 2520 2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe 108 PID 2520 wrote to memory of 1212 2520 2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe 108 PID 1212 wrote to memory of 1492 1212 cmd.exe 110 PID 1212 wrote to memory of 1492 1212 cmd.exe 110 PID 1212 wrote to memory of 232 1212 cmd.exe 111 PID 1212 wrote to memory of 232 1212 cmd.exe 111 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe"C:\Users\Admin\AppData\Local\Temp\2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe"1⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2520 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:3952
-
-
C:\Windows\system32\netsh.exenetsh wlan show profile3⤵PID:4348
-
-
C:\Windows\system32\findstr.exefindstr All3⤵PID:3436
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key2⤵
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:3348
-
-
C:\Windows\system32\netsh.exenetsh wlan show profile name="65001" key=clear3⤵PID:2620
-
-
C:\Windows\system32\findstr.exefindstr Key3⤵PID:2168
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\2140-44-0x0000000016D00000-0x0000000016D5A000-memory.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:1492
-
-
C:\Windows\system32\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:232
-
-