eternity | 07ad17755db73a41a93d25bb227e412e062721a60b0541f3510ac7cbd57aa3ed

Analysis

max time kernel
158s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-06-2022 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07ad17755db73a41a93d25bb227e412e062721a60b0541f3510ac7cbd57aa3ed.exe
Size

1.4MB
MD5

f9239135c900503cbb97d33146afe019
SHA1

dac78606808613f8c1d7274c0b56c93759cc56ee
SHA256

07ad17755db73a41a93d25bb227e412e062721a60b0541f3510ac7cbd57aa3ed
SHA512

94543d890ff45a9f2b642f0220b7b14dfbf7ab4a6d9315270a35823669ee7477e48296247417f57032aa985cfede0f654c44f2c76f1f43aeeae8ef0594d33126

Score

10^/10

eternity

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1928 3088 WerFault.exe 07ad17755db73a41a93d25bb227e412e062721a60b0541f3510ac7cbd57aa3ed.exe

pid	pid_target	process	target process
1928	3088	WerFault.exe	07ad17755db73a41a93d25bb227e412e062721a60b0541f3510ac7cbd57aa3ed.exe

C:\Users\Admin\AppData\Local\Temp\07ad17755db73a41a93d25bb227e412e062721a60b0541f3510ac7cbd57aa3ed.exe
"C:\Users\Admin\AppData\Local\Temp\07ad17755db73a41a93d25bb227e412e062721a60b0541f3510ac7cbd57aa3ed.exe"
1⤵
PID:3088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 1252
2⤵
- Program crash
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3088 -ip 3088
1⤵
PID:4804

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3088-130-0x0000000000B60000-0x0000000000CC4000-memory.dmp

Filesize
1.4MB

Download