Overview
overview
10Static
static
100811cf7c27...de.exe
windows7-x64
90dd0b31f05...24.exe
windows7-x64
71ad888606f...e0.exe
windows7-x64
31c77a07e45...95.exe
windows7-x64
1023f1c183af...bc.exe
windows7-x64
1038e891599d...90.exe
windows7-x64
103a13e092e9...db.exe
windows7-x64
43b9dabd99d...82.exe
windows7-x64
358fe9776f3...06.exe
windows7-x64
105ab93bd422...11.exe
windows7-x64
36b06c25fc6...43.exe
windows7-x64
106cc8001c9b...07.exe
windows7-x64
173ca5dd6d4...3f.exe
windows7-x64
107b931d48ea...f0.exe
windows7-x64
107d6892645b...0f.exe
windows7-x64
109036aeb570...7e.exe
windows7-x64
39b6289a8bf...2b.exe
windows7-x64
8acf2b76704...a7.exe
windows7-x64
3af2f191f8d...53.exe
windows7-x64
10cc7045d9fe...ab.dll
windows7-x64
10d1a6bd542d...a8.exe
windows7-x64
10efe947e0a8...69.exe
windows7-x64
10f13edd0b86...9f.exe
windows7-x64
10Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-11-2024 13:29
Behavioral task
behavioral1
Sample
0811cf7c2702af79720305f03bb4945d63bd4052d4d6df4aa4cf8e6418e5d9de.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
0dd0b31f05bd8036791494372275f393714ac18bae0f8d26a808387a0fcfe224.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral3
Sample
1ad888606f448d0d04c37ba11348b4c7d06f22b1cb3e8c217a21a5674bf29ce0.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral5
Sample
23f1c183af6a0322746465beeb83e79c30ba8f497cd52d60e2ed544bb7b39ebc.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
38e891599dad5b84356bad13b154ef7e26bb07aa651809a00369e52a54adc890.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral7
Sample
3a13e092e9c857702ad930dbd32ff7e4819151b0eab88be26d0229d95a74b6db.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral8
Sample
3b9dabd99dc58a5242616cb6d1d876bca3046119a9b150c7d7868bf02202ea82.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral9
Sample
58fe9776f33628fd965d1bcc442ec8dc5bfae0c648dcaec400f6090633484806.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral10
Sample
5ab93bd4225586706037be1870f84d4bd124b38df01f78de5648e3e0f30b8911.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
6b06c25fc6181adf110e8109550698897836b5c429fe9b013b2e51a3abc05343.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral12
Sample
6cc8001c9b61f55dc390743a9a6adfe2de01efd983f68599b288d39d3bfb7207.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral13
Sample
73ca5dd6d49b4c296ee1304aaac2e5fde01156800b538354fd27366df5b9323f.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
7b931d48eafa703a99ca7f104daf9a7343b6f1161d49073b86f5a4700864d3f0.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral15
Sample
7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
9036aeb570b22497c0f937e7edcef624800426011f0193a2b78c7f124e3a4c7e.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral17
Sample
9b6289a8bf3eab91297cc6d01215b06f4d979a81656eb80bc0ae6d3b7e8b112b.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral18
Sample
acf2b767040e546b689b4f1724569fd9992189ba2035654cfbf866b933e5b1a7.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral19
Sample
af2f191f8d2199d74867e9b1b9071e677c91b24d529d17b83ff04d0f03098a53.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral20
Sample
cc7045d9fe77c4aa4cb646d01fb4700008a34f58f49358d0b0b0997d21016aab.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
d1a6bd542d3570297f37ef478a638a2c7e04645cfb66fef1abe8210aa41c48a8.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
efe947e0a8842997d152af946ef0293a972cc11662f3c62a8461bc4a07427669.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral23
Sample
f13edd0b86c095dfb681e8bf08d7df0d53d9fb4301f2ba65ae9706a0aaeefe9f.exe
Resource
win7-20240903-en
windows7-x64
General
-
Target
1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe
-
Size
114KB
-
MD5
e534402738b11f52fd1991e2c63f816f
-
SHA1
5b166f3f830a9f6a3b2e581321c6541819c31771
-
SHA256
1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695
-
SHA512
b8c8c91c9846e54843098654f6ff52907c58424a8002a67cfe89af1b0905e4ac9c31afa3d407947acff14bc7aa42715f1dba2fb9f11d8e4728cf3823f831858d
-
SSDEEP
3072:Rg3cVWuLhZtblN5w1/zE5Id0bpeoXErZju:RdVWsfzO1gY0b7XErZ
Malware Config
Signatures
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Eternity family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Disables Task Manager via registry modification
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.execmd.exechcp.comvssadmin.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid Process 1112 vssadmin.exe -
Modifies registry class 5 IoCs
Processes:
1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.ecrp\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe %1" 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.ecrp 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.ecrp\shell\open\command 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.ecrp\shell 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.ecrp\shell\open 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exepid Process 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exevssvc.exedescription pid Process Token: SeDebugPrivilege 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe Token: SeBackupPrivilege 2760 vssvc.exe Token: SeRestorePrivilege 2760 vssvc.exe Token: SeAuditPrivilege 2760 vssvc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.execmd.exedescription pid Process procid_target PID 1044 wrote to memory of 588 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 32 PID 1044 wrote to memory of 588 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 32 PID 1044 wrote to memory of 588 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 32 PID 1044 wrote to memory of 588 1044 1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe 32 PID 588 wrote to memory of 808 588 cmd.exe 34 PID 588 wrote to memory of 808 588 cmd.exe 34 PID 588 wrote to memory of 808 588 cmd.exe 34 PID 588 wrote to memory of 808 588 cmd.exe 34 PID 588 wrote to memory of 1112 588 cmd.exe 35 PID 588 wrote to memory of 1112 588 cmd.exe 35 PID 588 wrote to memory of 1112 588 cmd.exe 35 PID 588 wrote to memory of 1112 588 cmd.exe 35 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe"C:\Users\Admin\AppData\Local\Temp\1c77a07e45b4f3e7f2b756c76df58a9d0f78785aa0f9e154074503398203c695.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
PID:808
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:1112
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2760