eternity | hxxps://eternitypr[.]net/Eternity[.]zip?

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
18-02-2025 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://eternitypr.net/Eternity.zip?

Score

10^/10

eternity growtopia discovery stealer

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Eternity family
eternity
Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
Growtopia family
growtopia

Downloads MZ/PE file 1 IoCs

flow	pid	Process
33	5252	Eternity.exe

Loads dropped DLL 1 IoCs

pid	Process
5252	Eternity.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eternity.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1408376509-1621642251-2666462513-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1408376509-1621642251-2666462513-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Eternity.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5300	msedge.exe
5300	msedge.exe
5868	msedge.exe
5868	msedge.exe
5948	identity_helper.exe
5948	identity_helper.exe
3772	msedge.exe
3772	msedge.exe
4088	msedge.exe
4088	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5252	Eternity.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5252	Eternity.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2616	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5868 wrote to memory of 4980	5868	msedge.exe	78
PID 5868 wrote to memory of 4980	5868	msedge.exe	78
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 3672	5868	msedge.exe	79
PID 5868 wrote to memory of 5300	5868	msedge.exe	80
PID 5868 wrote to memory of 5300	5868	msedge.exe	80
PID 5868 wrote to memory of 2876	5868	msedge.exe	81
PID 5868 wrote to memory of 2876	5868	msedge.exe	81
PID 5868 wrote to memory of 2876	5868	msedge.exe	81
PID 5868 wrote to memory of 2876	5868	msedge.exe	81
PID 5868 wrote to memory of 2876	5868	msedge.exe	81
PID 5868 wrote to memory of 2876	5868	msedge.exe	81
PID 5868 wrote to memory of 2876	5868	msedge.exe	81
PID 5868 wrote to memory of 2876	5868	msedge.exe	81
PID 5868 wrote to memory of 2876	5868	msedge.exe	81
PID 5868 wrote to memory of 2876	5868	msedge.exe	81
PID 5868 wrote to memory of 2876	5868	msedge.exe	81
PID 5868 wrote to memory of 2876	5868	msedge.exe	81
PID 5868 wrote to memory of 2876	5868	msedge.exe	81
PID 5868 wrote to memory of 2876	5868	msedge.exe	81
PID 5868 wrote to memory of 2876	5868	msedge.exe	81
PID 5868 wrote to memory of 2876	5868	msedge.exe	81
PID 5868 wrote to memory of 2876	5868	msedge.exe	81
PID 5868 wrote to memory of 2876	5868	msedge.exe	81
PID 5868 wrote to memory of 2876	5868	msedge.exe	81
PID 5868 wrote to memory of 2876	5868	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://eternitypr.net/Eternity.zip?
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff92443cb8,0x7fff92443cc8,0x7fff92443cd8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,1993927162468523049,13217110696532507165,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,1993927162468523049,13217110696532507165,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,1993927162468523049,13217110696532507165,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1993927162468523049,13217110696532507165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1993927162468523049,13217110696532507165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1993927162468523049,13217110696532507165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1993927162468523049,13217110696532507165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1993927162468523049,13217110696532507165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,1993927162468523049,13217110696532507165,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,1993927162468523049,13217110696532507165,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1932,1993927162468523049,13217110696532507165,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1993927162468523049,13217110696532507165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1993927162468523049,13217110696532507165,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1993927162468523049,13217110696532507165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1993927162468523049,13217110696532507165,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1993927162468523049,13217110696532507165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1932,1993927162468523049,13217110696532507165,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,1993927162468523049,13217110696532507165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,1993927162468523049,13217110696532507165,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:884

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3012

C:\Users\Admin\Downloads\Eternity\Eternity.exe
"C:\Users\Admin\Downloads\Eternity\Eternity.exe"
1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://eternitypr.net/register
  2⤵
  PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fff92443cb8,0x7fff92443cc8,0x7fff92443cd8
    3⤵
    PID:5104

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46ec2d399c9d10a0545cb514e47de14e

SHA1
98fc6f3f34f4082b8d81cc50dc571ec06eb454ca

SHA256
f50fff32b15e4b61c3cb18655c3daf46a83556aef1f3ff8d9ed074f298f247a5

SHA512
993b723da7b0ffcaa731a1f06057bf2ebdc2fd518ef8765b4f625b9fd0094cc6abdccfe998d0e6cb760a3e5d6c411b197a47e67c1de5a6ec4315d017a552a2be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a1ea058d6231b47f5bb8557adba13351

SHA1
111dbb6ffff6517e11719a20683fd7f4ef0579d2

SHA256
f5a91a0770c54a1601557b8babfcc7813972275da171c384cc8929d2910a851f

SHA512
e613f481c50b5a7022a763d13ac1b1ebb6a9d4d973de95108d95d23844d9d526d8c90f391493f043e86e22e9a5abd8a3a4cab5f2def248033d0eb9421091889b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
28a0195c30db60cc66bbf6e37c7d8bf4

SHA1
98503073804370bf078df9320e40606da64075de

SHA256
d36e9e26dba7f25517b34282e6f76146c4f0c200889e83de21615490d89f4425

SHA512
0a5e37ed66d030a34d99245fd76c491f4754829b0eae861a3dcb6ce0cbc486845118a81158d3be85131bdf1f4ec1b1a1268493483a9aa2a417e4fb44b0bcc451

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
df9ca62d6661d2abd01e015c38c218b6

SHA1
f090f1c522b26b0bf278e6c195bb36b050a389c0

SHA256
49b12ee8776f04486f3e98cf56114a13592efddebe1105935e21c73869a75663

SHA512
eb5de735b3f58e7a7c899cbba853ed91a4b714b6ea59a5ce4d46d92836a2fe663ebb12a8baa46b6f8c7ee7e7635bb2d0fa3f191dfad50fbf147c49a191492f1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
025d8a77339193e2ad7e16ca68199956

SHA1
79229a057bb5052077d441a59d4ff4972398833f

SHA256
8f3f3589ecff5f94c358ec570c15f93c9c488e5fe31f2488a90d67693838c901

SHA512
bea0b570eb5e9bbb7f629c73564671c7ab75663cc4850239de94955a80463074ac5e6883dd663e04f4ebbc8d776394b13c249e104f874b47347db13615d9b74d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
02d1c5a742bf1bded0eb160196348d97

SHA1
a012e2e7af7198b6874f5164f5be16828a96f92e

SHA256
a1ed54852e40292033612c90d7849c264c3659c9cf5a489ada35bc6afe9cc08e

SHA512
e2baec46881a7f3923bf8eea4f8d728ef53f91d1ea0f94481b9c81c29f55183fec39348edbc37b63bc38690e375d8c4055ca107e24855819a91f50722b8259e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd9f7efd52103950fb71b207ddd6ef24

SHA1
4b608b694e4172da6dd78377222f004a9df9ca9d

SHA256
59ea5799bf1f358411726e8481e3ca002305651c0fd5d2e7aec96bf3c2326c6f

SHA512
fccce44517cbea3f599cb424a26f9b5314a38c5f73b19a26a77ffc1ed067d947828373e107a9a511b7817844bf639d5f3f289fd0405cae3993356eba0a28a3fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c0bb9299a1411467afa7edca050b523

SHA1
b326b24a1491fd5bbcf8fcb3c207b9782cd9ed20

SHA256
a943f11810a66ae9ea433525d45a47e944e45c860938096698c738fde3e0ddc0

SHA512
6b5eac871b56cbfbe413f6529d71f218e31861bc6d698a73b7a3ba7836c5fd666a57ee8a9e1d8246a32f18dedbd6d7ffc52b4ad6f843bf25bb634b1af857a3a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
352e969848b676510fe5c11645a66d48

SHA1
ce54e084ed6fa7818385b1aa6066a94338ea1385

SHA256
622c12d99e1f6d3312ea4351d09a7614591a56507d80f8039afc31140a3f0524

SHA512
154262d037d228cef4d357774cd739b535120fbcc6542db8083af22d501c2b691479b815c3cdb2a4e3e7efed9ca15ca798fcb9db35670c0ff6e2abfe50c94949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f714a781f400f35f0bbf718828ad9b07

SHA1
5cd13c88850873c5373311bd1418dc89229ab06a

SHA256
be02353d9592b98dd36f4b2ba0f2216b59ed06a587274e37e78a66f1109807c2

SHA512
30b0eac237e7b40141b85a0e303267ec20493ac5f8f72321efe2437320270eb603531b43046d4cde63ef9aeec74c31346d2a9ae514f828f37204a62d210d9fdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f49d089ef771006685c7bb78afb2f26f

SHA1
6bb68483267372dc1e81f1c0123163988e4124bc

SHA256
d5af091d800160bd8cbcd1e47ab71b2e230dbb1c5cdf5932e6e0b861c449c8bf

SHA512
3c1ca27e1dcb743b69056fe60d19921731e63db7d57f67131e5784472eaf74c521f5df92ff2caebdc57406caa87a401163e3d8063f17bb04cd1aa2aa0fbd8c02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
309c1cfebddb23bbe74211652abc6ff0

SHA1
aa7f2c358ab88cadf3525e88e6e54d1eacac869f

SHA256
549acc39d1ed64cd19d36b3ff93d1677efb7491cfd756f3cf1a2513fb4c2dae2

SHA512
a4588d1134064422e9da41ec96ac663ebe165a1d23a1b69a7417ed60094136157a1362e8fe7f5c72ceb5ec9137d20c9cb176246bf3501116136719f95c0cf729

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
42c989604ec3dbdfeabf971926cef560

SHA1
983c61d87c98669653e185096276223bb42b22a6

SHA256
cc1d1084ee6df4babe8afad0b7a4746f643d9c0a59880be94ee448f79c4ada06

SHA512
5e2a68a16f6519b833ffdc7c941137bef4e65f2cec24a2c56679e86f0fb004cf0ff52765c7c62e18abff0878c5bc317e42eb22db11facb69d7fcbcb69c6b3d5b

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
23KB

MD5
203b2ca5a2fe1d3878718d1bb3773c8c

SHA1
c93a804898f610a9cc2f0381662861fc4b29aa19

SHA256
15d0f55e1c46a3c7f596c74c720763d650e93ce8b17bcda04ece3e1a1d9f0709

SHA512
d927ab3fb0e8073510bec19270f6c162597906455ab8852b28191e8b7e3535924ac8968afd24d8afa00a262165a93637387d164a366837507ef09fb64964516b

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
23KB

MD5
b7ba1387f6cc063a62920459e03c4ef7

SHA1
1720ee0079c3b2deba2445a392504fc8883d1291

SHA256
90729d09ec2a6b70d547430de246f65ce9c754668d3c80cb8b3dae0b80b89481

SHA512
dd1278cefc1b064ba74609a2f025890160ac3c3ba5774c8ffb98538e2b2868f0d9d59d52eda7674b0a5993ea4f6261a462fdf152d3a2e9a682b586630f959c75

Download Submit
C:\Users\Admin\AppData\Local\Temp\enet_managed_resource\enet-win32-x86.dll

Filesize
39KB

MD5
e13ef136485a33c8a5b719d75b0312df

SHA1
fb692915b0a73e796c5904e05d37f963baef88dd

SHA256
9d2d83667ab5c391fbb60a1249078d0e2b031573a72dc07b67b610178ee94e78

SHA512
b3d58a11fc17925316f437e67d4b394bb9b5749e92064fe87eda3e12962f3970416e180cd40c61419651ec611eae0ee9f91a795199689cdd4743678bb6d3dca2

Download Submit
C:\Users\Admin\Downloads\Eternity.zip

Filesize
35.0MB

MD5
087e21b251a1567c10526376837a4bbc

SHA1
802ca49bfb4fa037608cc210344479e26c92a9fe

SHA256
a22b363a7dce6163c6338ece398265d8d166bc232466619c9a3e45f4530600b8

SHA512
733b9ba11aeb8d089665dc018bba0b6f9723b5a215a8fc77ac748bbf3af3dd77d114f984d821824d16d28a8be014bc781146e43d05e84fb23c9c1a033cb54424

Download Submit
C:\Users\Admin\Downloads\Eternity.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Eternity\Eternity.ini

Filesize
84B

MD5
e258ab06989517a03f343a876d22bb89

SHA1
3aec1243da80a289cb0d06183dcf76cd88d1ec96

SHA256
7e8a3a78939ee00715f2e0d456061fa6bcca1627623ebcefe77528af4dac9c28

SHA512
1767f5373ffafa8b984e39464ab4deb77179c7be0de13d3a87d297ea8401120c6ee646bc01efc645cb8d930883375fedad7dbb78eb279b4b1c0981c52eff0531

Download Submit
memory/5252-122-0x0000000008250000-0x0000000008290000-memory.dmp

Filesize
256KB

Download
memory/5252-192-0x0000000009A90000-0x0000000009DE7000-memory.dmp

Filesize
3.3MB

Download
memory/5252-153-0x000000006EFC0000-0x000000006EFD2000-memory.dmp

Filesize
72KB

Download
memory/5252-114-0x000000000B690000-0x000000000B698000-memory.dmp

Filesize
32KB

Download
memory/5252-112-0x000000000B6D0000-0x000000000B762000-memory.dmp

Filesize
584KB

Download
memory/5252-111-0x000000000BBA0000-0x000000000C146000-memory.dmp

Filesize
5.6MB

Download
memory/5252-191-0x0000000008E90000-0x0000000008EB2000-memory.dmp

Filesize
136KB

Download
memory/5252-113-0x000000000B850000-0x000000000B926000-memory.dmp

Filesize
856KB

Download
memory/5252-110-0x000000000A250000-0x000000000B5F0000-memory.dmp

Filesize
19.6MB

Download
memory/5252-121-0x00000000081F0000-0x00000000081FA000-memory.dmp

Filesize
40KB

Download
memory/5252-109-0x0000000000A80000-0x0000000003310000-memory.dmp

Filesize
40.6MB

Download
memory/5252-269-0x000000006EFC0000-0x000000006EFD2000-memory.dmp

Filesize
72KB

Download
memory/5252-120-0x000000000C210000-0x000000000C2C2000-memory.dmp

Filesize
712KB

Download
memory/5252-119-0x000000000B800000-0x000000000B81A000-memory.dmp

Filesize
104KB

Download