eternity | 7cb637e7b9fd78267742aeddc3c40aa5d4b77b3210bf24cf71cb021046591a37

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e0c2b0be4b7176df83b2123f21618a0_JaffaCakes118.exe
Size

183KB
MD5

4e0c2b0be4b7176df83b2123f21618a0
SHA1

5b27e3ee25e574d5b53d6afadc57ef1441d86bed
SHA256

7cb637e7b9fd78267742aeddc3c40aa5d4b77b3210bf24cf71cb021046591a37
SHA512

c6ec7732e099958c4a504a15a0c94a63732a9a9a97729e70ae6837f951566ead8edb38fb7924c55b57be429ec39eb9ad3198a50b99cd9781bc8b0b39afd6eb34
SSDEEP

3072:MCduld6RDPgu7pIov+ZeONmgm0BIm6OzrV0NoVMF4seX8quHuzQU128jF:M/l8cCpIyFOIxzyruNWe4seXIH4t

Score

10^/10

eternity

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	4e0c2b0be4b7176df83b2123f21618a0_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2568	NSudo_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1296	3940	WerFault.exe	84

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 2568	3940	4e0c2b0be4b7176df83b2123f21618a0_JaffaCakes118.exe	88
PID 3940 wrote to memory of 2568	3940	4e0c2b0be4b7176df83b2123f21618a0_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\4e0c2b0be4b7176df83b2123f21618a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4e0c2b0be4b7176df83b2123f21618a0_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Users\Admin\AppData\Local\Temp\NSudo_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\NSudo_x64.exe"
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 1236
  2⤵
  - Program crash
  PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3940 -ip 3940
1⤵
PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NSudo_x64.exe

Filesize
156KB

MD5
7aacfd85b8dff0aa6867bede82cfd147

SHA1
e783f6d4b754ea8424699203b8831bdc9cbdd4e6

SHA256
871e4f28fe39bcad8d295ae46e148be458778c0195ed660b7db18eb595d00bd8

SHA512
59cce358c125368dc5735a28960ddb7ee49835ca19f44255a7ae858ddd8a2db68c72c3f6818eca3678d989041043876e339f9fafe1d81d26001286494a8014f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp26C8.tmp.exe

Filesize
5KB

MD5
24c482e9a8094deba0e5d2e85046727c

SHA1
1882cca51c567bc9bd7504a2555e6c366cbe80fa

SHA256
91e823c85cebafefd6ca98759234f1dca7a3585d7d0fbafe4463664197d9d8e5

SHA512
877158427e3fa8a3539d64f0b9994409d3c3a2c6920823827c6b11fa52001f1ef69999bafafbee6a63a0ab38ed94b0a03ae71994f4fdb78e223156fee1ac0cd8

Download Submit
memory/3940-0-0x00000000749FE000-0x00000000749FF000-memory.dmp

Filesize
4KB

Download
memory/3940-1-0x0000000000CF0000-0x0000000000D24000-memory.dmp

Filesize
208KB

Download
memory/3940-3-0x00000000749F0000-0x00000000751A0000-memory.dmp

Filesize
7.7MB

Download
memory/3940-22-0x00000000749F0000-0x00000000751A0000-memory.dmp

Filesize
7.7MB

Download