eternity | 7cb637e7b9fd78267742aeddc3c40aa5d4b77b3210bf24cf71cb021046591a37

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e0c2b0be4b7176df83b2123f21618a0_JaffaCakes118.exe
Size

183KB
MD5

4e0c2b0be4b7176df83b2123f21618a0
SHA1

5b27e3ee25e574d5b53d6afadc57ef1441d86bed
SHA256

7cb637e7b9fd78267742aeddc3c40aa5d4b77b3210bf24cf71cb021046591a37
SHA512

c6ec7732e099958c4a504a15a0c94a63732a9a9a97729e70ae6837f951566ead8edb38fb7924c55b57be429ec39eb9ad3198a50b99cd9781bc8b0b39afd6eb34
SSDEEP

3072:MCduld6RDPgu7pIov+ZeONmgm0BIm6OzrV0NoVMF4seX8quHuzQU128jF:M/l8cCpIyFOIxzyruNWe4seXIH4t

Score

10^/10

eternity

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Executes dropped EXE 2 IoCs

pid	Process
2096	NSudo_x64.exe
1120	Process not Found

Loads dropped DLL 1 IoCs

pid	Process
2080	4e0c2b0be4b7176df83b2123f21618a0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2628	2080	WerFault.exe	27

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2096	2080	4e0c2b0be4b7176df83b2123f21618a0_JaffaCakes118.exe	28
PID 2080 wrote to memory of 2096	2080	4e0c2b0be4b7176df83b2123f21618a0_JaffaCakes118.exe	28
PID 2080 wrote to memory of 2096	2080	4e0c2b0be4b7176df83b2123f21618a0_JaffaCakes118.exe	28
PID 2080 wrote to memory of 2096	2080	4e0c2b0be4b7176df83b2123f21618a0_JaffaCakes118.exe	28
PID 2080 wrote to memory of 2628	2080	4e0c2b0be4b7176df83b2123f21618a0_JaffaCakes118.exe	29
PID 2080 wrote to memory of 2628	2080	4e0c2b0be4b7176df83b2123f21618a0_JaffaCakes118.exe	29
PID 2080 wrote to memory of 2628	2080	4e0c2b0be4b7176df83b2123f21618a0_JaffaCakes118.exe	29
PID 2080 wrote to memory of 2628	2080	4e0c2b0be4b7176df83b2123f21618a0_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\4e0c2b0be4b7176df83b2123f21618a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4e0c2b0be4b7176df83b2123f21618a0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\NSudo_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\NSudo_x64.exe"
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 924
  2⤵
  - Program crash
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NSudo_x64.exe

Filesize
156KB

MD5
7aacfd85b8dff0aa6867bede82cfd147

SHA1
e783f6d4b754ea8424699203b8831bdc9cbdd4e6

SHA256
871e4f28fe39bcad8d295ae46e148be458778c0195ed660b7db18eb595d00bd8

SHA512
59cce358c125368dc5735a28960ddb7ee49835ca19f44255a7ae858ddd8a2db68c72c3f6818eca3678d989041043876e339f9fafe1d81d26001286494a8014f0

Download Submit
memory/2080-0-0x00000000742CE000-0x00000000742CF000-memory.dmp

Filesize
4KB

Download
memory/2080-1-0x0000000000CC0000-0x0000000000CF4000-memory.dmp

Filesize
208KB

Download
memory/2080-3-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/2080-13-0x00000000742CE000-0x00000000742CF000-memory.dmp

Filesize
4KB

Download
memory/2080-14-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/2096-9-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download