eternity | 032911e0a222a0e4862c2aa023ec29907ea7fe8228b78fb36afafe991d61436b

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-06-2022 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

032911e0a222a0e4862c2aa023ec29907ea7fe8228b78fb36afafe991d61436b.exe
Size

1.4MB
MD5

90874ebf82d294580f7e47427bccb738
SHA1

00fa1a1c93da4f85b2d8cffe39e9ccbcd90d9256
SHA256

032911e0a222a0e4862c2aa023ec29907ea7fe8228b78fb36afafe991d61436b
SHA512

ec5af911b1f5be0ad2b8a10182eac760bafafb5f073ed3aa253f0298059bd9f7357745b0c9c8ab6838b65d7ad6d60d3ffc04e79076d33bf0ffadaeaa127ef56b

Score

10^/10

eternity

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3724 2076 WerFault.exe 032911e0a222a0e4862c2aa023ec29907ea7fe8228b78fb36afafe991d61436b.exe

pid	pid_target	process	target process
3724	2076	WerFault.exe	032911e0a222a0e4862c2aa023ec29907ea7fe8228b78fb36afafe991d61436b.exe

C:\Users\Admin\AppData\Local\Temp\032911e0a222a0e4862c2aa023ec29907ea7fe8228b78fb36afafe991d61436b.exe
"C:\Users\Admin\AppData\Local\Temp\032911e0a222a0e4862c2aa023ec29907ea7fe8228b78fb36afafe991d61436b.exe"
1⤵
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 1256
2⤵
- Program crash
PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 2076 -ip 2076
1⤵
PID:3032

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-130-0x0000000000B60000-0x0000000000CCA000-memory.dmp

Filesize
1.4MB

Download