eternity | 07ad17755db73a41a93d25bb227e412e062721a60b0541f3510ac7cbd57aa3ed | Triage

Analysis

max time kernel
158s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-06-2022 08:15

Sharing

Report Analysis Logs

General

Target

07ad17755db73a41a93d25bb227e412e062721a60b0541f3510ac7cbd57aa3ed.exe
Size

1.4MB
MD5

f9239135c900503cbb97d33146afe019
SHA1

dac78606808613f8c1d7274c0b56c93759cc56ee
SHA256

07ad17755db73a41a93d25bb227e412e062721a60b0541f3510ac7cbd57aa3ed
SHA512

94543d890ff45a9f2b642f0220b7b14dfbf7ab4a6d9315270a35823669ee7477e48296247417f57032aa985cfede0f654c44f2c76f1f43aeeae8ef0594d33126

Score

10^/10

eternity

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1928	3088	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\07ad17755db73a41a93d25bb227e412e062721a60b0541f3510ac7cbd57aa3ed.exe
"C:\Users\Admin\AppData\Local\Temp\07ad17755db73a41a93d25bb227e412e062721a60b0541f3510ac7cbd57aa3ed.exe"
1⤵
PID:3088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 1252
  2⤵
  - Program crash
  PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3088 -ip 3088
1⤵
PID:4804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3088-130-0x0000000000B60000-0x0000000000CC4000-memory.dmp

Filesize
1.4MB

Download