Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1482s -
max time network
1509s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
27/02/2024, 17:16
Static task
static1
Behavioral task
behavioral1
Sample
Sig.exe
Resource
win11-20240221-en
General
-
Target
Sig.exe
-
Size
7.2MB
-
MD5
0c702acbc7d30c865839dcb8a94a4a86
-
SHA1
06186c0bace78cf632d1bf31566d3e6479ab329c
-
SHA256
f3c880591e06396f588d5b45c599ba6aef1aae4065d0d55b3560e3547242b697
-
SHA512
5de2485877995cfe5b74385ed68df580c0ca8105a9089ecd9255c0e273a1677899157d73817f689af667b50da6510a8561c56309937dc32dca408fd5b2f2af7c
-
SSDEEP
98304:VXoFOv7y5Wm9647jfOzEa+yF0tznDOrq50oE7kwKSRPAb2Zpbq6+QYa:9E647jfOzCyCtL75YRPAkFvZX
Malware Config
Extracted
eternity
http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion
Signatures
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vbc.exe Key opened \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vbc.exe Key opened \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vbc.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 1 pastebin.com 5 pastebin.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2356 set thread context of 4936 2356 Sig.exe 77 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 vbc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier vbc.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3024 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4936 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4936 vbc.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2356 wrote to memory of 4936 2356 Sig.exe 77 PID 2356 wrote to memory of 4936 2356 Sig.exe 77 PID 2356 wrote to memory of 4936 2356 Sig.exe 77 PID 2356 wrote to memory of 4936 2356 Sig.exe 77 PID 2356 wrote to memory of 4936 2356 Sig.exe 77 PID 4936 wrote to memory of 2696 4936 vbc.exe 80 PID 4936 wrote to memory of 2696 4936 vbc.exe 80 PID 4936 wrote to memory of 2696 4936 vbc.exe 80 PID 2696 wrote to memory of 2832 2696 cmd.exe 81 PID 2696 wrote to memory of 2832 2696 cmd.exe 81 PID 2696 wrote to memory of 2832 2696 cmd.exe 81 PID 2696 wrote to memory of 3484 2696 cmd.exe 82 PID 2696 wrote to memory of 3484 2696 cmd.exe 82 PID 2696 wrote to memory of 3484 2696 cmd.exe 82 PID 2696 wrote to memory of 1724 2696 cmd.exe 83 PID 2696 wrote to memory of 1724 2696 cmd.exe 83 PID 2696 wrote to memory of 1724 2696 cmd.exe 83 PID 4936 wrote to memory of 3920 4936 vbc.exe 84 PID 4936 wrote to memory of 3920 4936 vbc.exe 84 PID 4936 wrote to memory of 3920 4936 vbc.exe 84 PID 3920 wrote to memory of 3128 3920 cmd.exe 86 PID 3920 wrote to memory of 3128 3920 cmd.exe 86 PID 3920 wrote to memory of 3128 3920 cmd.exe 86 PID 3920 wrote to memory of 4616 3920 cmd.exe 87 PID 3920 wrote to memory of 4616 3920 cmd.exe 87 PID 3920 wrote to memory of 4616 3920 cmd.exe 87 PID 3920 wrote to memory of 4492 3920 cmd.exe 88 PID 3920 wrote to memory of 4492 3920 cmd.exe 88 PID 3920 wrote to memory of 4492 3920 cmd.exe 88 PID 4936 wrote to memory of 2904 4936 vbc.exe 89 PID 4936 wrote to memory of 2904 4936 vbc.exe 89 PID 4936 wrote to memory of 2904 4936 vbc.exe 89 PID 2904 wrote to memory of 2140 2904 cmd.exe 91 PID 2904 wrote to memory of 2140 2904 cmd.exe 91 PID 2904 wrote to memory of 2140 2904 cmd.exe 91 PID 2904 wrote to memory of 3024 2904 cmd.exe 92 PID 2904 wrote to memory of 3024 2904 cmd.exe 92 PID 2904 wrote to memory of 3024 2904 cmd.exe 92 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vbc.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sig.exe"C:\Users\Admin\AppData\Local\Temp\Sig.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4936 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All3⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵PID:2832
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile4⤵PID:3484
-
-
C:\Windows\SysWOW64\findstr.exefindstr All4⤵PID:1724
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key3⤵
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵PID:3128
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile name="65001" key=clear4⤵PID:4616
-
-
C:\Windows\SysWOW64\findstr.exefindstr Key4⤵PID:4492
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵PID:2140
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
PID:3024
-
-
-