eternity | 17f6063bb270cd10ece9002bedb90c84711b6efe6a1a66b52d254b4532264202

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 20:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

17f6063bb270cd10ece9002bedb90c84711b6efe6a1a66b52d254b4532264202.exe
Size

70KB
MD5

d7d06a5643291ff48ed602b773264f25
SHA1

86a43422686cedc96fdcf739ade018f7c0d8a054
SHA256

17f6063bb270cd10ece9002bedb90c84711b6efe6a1a66b52d254b4532264202
SHA512

2a76a73774c5dc6486444506ca980b6ff4c4bf03fcd77023ac6c1e77e50cd5b1bd9fcf8318971d22cd5866d45c9719db35cf3c6e0322ba2cfcb4923ede3eb957
SSDEEP

384:mIvRBy67ui/aDK+8zfP4mCxFkEL68DDkJsl38dDnaxg679Poww4glQhgLU07kRI1:jvciiDK+8DyNTcJ+s9naW+9SLf

Score

10^/10

eternity

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2612	2848	WerFault.exe	27

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2872	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2872	2848	17f6063bb270cd10ece9002bedb90c84711b6efe6a1a66b52d254b4532264202.exe	28
PID 2848 wrote to memory of 2872	2848	17f6063bb270cd10ece9002bedb90c84711b6efe6a1a66b52d254b4532264202.exe	28
PID 2848 wrote to memory of 2872	2848	17f6063bb270cd10ece9002bedb90c84711b6efe6a1a66b52d254b4532264202.exe	28
PID 2848 wrote to memory of 2872	2848	17f6063bb270cd10ece9002bedb90c84711b6efe6a1a66b52d254b4532264202.exe	28
PID 2848 wrote to memory of 2612	2848	17f6063bb270cd10ece9002bedb90c84711b6efe6a1a66b52d254b4532264202.exe	29
PID 2848 wrote to memory of 2612	2848	17f6063bb270cd10ece9002bedb90c84711b6efe6a1a66b52d254b4532264202.exe	29
PID 2848 wrote to memory of 2612	2848	17f6063bb270cd10ece9002bedb90c84711b6efe6a1a66b52d254b4532264202.exe	29
PID 2848 wrote to memory of 2612	2848	17f6063bb270cd10ece9002bedb90c84711b6efe6a1a66b52d254b4532264202.exe	29

C:\Users\Admin\AppData\Local\Temp\17f6063bb270cd10ece9002bedb90c84711b6efe6a1a66b52d254b4532264202.exe
"C:\Users\Admin\AppData\Local\Temp\17f6063bb270cd10ece9002bedb90c84711b6efe6a1a66b52d254b4532264202.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Dialog.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 920
  2⤵
  - Program crash
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Dialog.txt

Filesize
4KB

MD5
1a9eeb355c464755c06d26042c545ca6

SHA1
9d0dda756fdc6fc64de06675529d976c12637723

SHA256
6ea4dad6a2e4cdbcf2f2ee09aebe2b90d966725979e7c9d268a7ffe658381d5b

SHA512
93cef6bfa3fe50e4b42b78ad40d751edbc90abdd41534696cfe01cb1cb068dcad6eba2ddb782d2eb6a7eb7e07aef4bb91e2feca4f44da28e892cca50e6739296

Download Submit
memory/2848-0-0x000000007465E000-0x000000007465F000-memory.dmp

Filesize
4KB

Download
memory/2848-1-0x0000000001300000-0x0000000001316000-memory.dmp

Filesize
88KB

Download
memory/2848-3-0x0000000074650000-0x0000000074D3E000-memory.dmp

Filesize
6.9MB

Download
memory/2848-8-0x0000000074650000-0x0000000074D3E000-memory.dmp

Filesize
6.9MB

Download