eternity | 05821994caa06407e84a713aa141667d2b22f83318721a1edaed49c07fc273b3

Analysis

max time kernel
103s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-06-2022 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05821994caa06407e84a713aa141667d2b22f83318721a1edaed49c07fc273b3.exe
Size

3.4MB
MD5

2e4de9ef1804c3616638a00344425e45
SHA1

5ee95d0a73e42a343afcd65f5f62c5fba58d7f82
SHA256

05821994caa06407e84a713aa141667d2b22f83318721a1edaed49c07fc273b3
SHA512

4f696e07d49f5ab9d0e70b5d0be6db71169c3608889bb105a32113acfac603d63ffa904f5c74a33151aa6d469a9bf166519f0607a66191cb68932ce392d91323

Score

10^/10

eternity

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3136 1736 WerFault.exe 05821994caa06407e84a713aa141667d2b22f83318721a1edaed49c07fc273b3.exe

pid	pid_target	process	target process
3136	1736	WerFault.exe	05821994caa06407e84a713aa141667d2b22f83318721a1edaed49c07fc273b3.exe

C:\Users\Admin\AppData\Local\Temp\05821994caa06407e84a713aa141667d2b22f83318721a1edaed49c07fc273b3.exe
"C:\Users\Admin\AppData\Local\Temp\05821994caa06407e84a713aa141667d2b22f83318721a1edaed49c07fc273b3.exe"
1⤵
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 1272
2⤵
- Program crash
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1736 -ip 1736
1⤵
PID:1984

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-130-0x0000000000CD0000-0x0000000001040000-memory.dmp

Filesize
3.4MB

Download