eternity | 0d9d7074738a5834395b2e64c5336839c1affa0ea4ecc18c6d1c8a96e531c8f1

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-04-2024 03:02

Target

65d83adb8b8cb3a42034cecb9c8725b6_JaffaCakes118.exe
Size

881KB
MD5

65d83adb8b8cb3a42034cecb9c8725b6
SHA1

d435fb62337dd566572d3b94be0c4831b3e80d16
SHA256

0d9d7074738a5834395b2e64c5336839c1affa0ea4ecc18c6d1c8a96e531c8f1
SHA512

0da6f24fbd40310a4da757b4ffff8c0b14d1b25180c789f98ea70883e448c892e460776b36acf36a588f3ac71cabc156670ee7c4803532f67e70650835745680
SSDEEP

12288:DTEYAsROAsrt/uxduo1jB0Y96qja0wk2Rqrk5M8PXAUOVXOwVPcgnWfLpF8fGi1P:DwT7rC6qJF8vZOVfSjLX/TGmAOe

Score

10^/10

eternity stealer

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/1708-0-0x0000000000D50000-0x0000000000E34000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\65d83adb8b8cb3a42034cecb9c8725b6_JaffaCakes118.exe	65d83adb8b8cb3a42034cecb9c8725b6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\65d83adb8b8cb3a42034cecb9c8725b6_JaffaCakes118.exe	65d83adb8b8cb3a42034cecb9c8725b6_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	65d83adb8b8cb3a42034cecb9c8725b6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2812	1708	65d83adb8b8cb3a42034cecb9c8725b6_JaffaCakes118.exe	28
PID 1708 wrote to memory of 2812	1708	65d83adb8b8cb3a42034cecb9c8725b6_JaffaCakes118.exe	28
PID 1708 wrote to memory of 2812	1708	65d83adb8b8cb3a42034cecb9c8725b6_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\65d83adb8b8cb3a42034cecb9c8725b6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65d83adb8b8cb3a42034cecb9c8725b6_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1708 -s 760
  2⤵
  PID:2812

memory/1708-0-0x0000000000D50000-0x0000000000E34000-memory.dmp

Filesize
912KB

Download
memory/1708-1-0x000007FEF4E40000-0x000007FEF582C000-memory.dmp

Filesize
9.9MB

Download
memory/1708-2-0x000007FEF4E40000-0x000007FEF582C000-memory.dmp

Filesize
9.9MB

Download
memory/1708-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1708-4-0x000000001AF80000-0x000000001B000000-memory.dmp

Filesize
512KB

Download
memory/1708-5-0x00000000002F0000-0x000000000032E000-memory.dmp

Filesize
248KB

Download
memory/1708-7-0x000000001AF80000-0x000000001B000000-memory.dmp

Filesize
512KB

Download
memory/1708-6-0x000000001AF80000-0x000000001B000000-memory.dmp

Filesize
512KB

Download
memory/1708-10-0x000007FEF4E40000-0x000007FEF582C000-memory.dmp

Filesize
9.9MB

Download
memory/1708-11-0x000000001AF80000-0x000000001B000000-memory.dmp

Filesize
512KB

Download
memory/1708-12-0x000000001AF80000-0x000000001B000000-memory.dmp

Filesize
512KB

Download
memory/1708-13-0x000000001AF80000-0x000000001B000000-memory.dmp

Filesize
512KB

Download