eternity | afcc447467d954cf08e916789e7181a3c8b5fa9f49ec628574f43b17c2eee05d

Analysis

max time kernel
133s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
afcc447467d954cf08e916789e7181a3c8b5fa9f49ec628574f43b17c2eee05d.exe
Size 72KB
Sample240505-dpqglada7y
SHA256 afcc447467d954cf08e916789e7181a3c8b5fa9f49ec628574f43b17c2eee05d
MD5 b53922cd19d2f906148bd62f3e96caec
SHA1 6038d94acc9e943bce213c89d10686e4724dd99f
SHA512 902abe1feab7239f122b117001fbcff5c40e9c648b2ca72d4e9ed98604089f232f1ff42de142013c23090dbbd00855db51c0f20f5cf244b4ed7add6f1bf2ca7d
SSDEEP 768:bthHn7dSDNC0DdlKhUcDamoaMZs9naW+9SLf:bthHSNCqIToaAs9a3SLf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

eternity

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	afcc447467d954cf08e916789e7181a3c8b5fa9f49ec628574f43b17c2eee05d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1732	2300	WerFault.exe	82

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings	afcc447467d954cf08e916789e7181a3c8b5fa9f49ec628574f43b17c2eee05d.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3504	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 3504	2300	afcc447467d954cf08e916789e7181a3c8b5fa9f49ec628574f43b17c2eee05d.exe	83
PID 2300 wrote to memory of 3504	2300	afcc447467d954cf08e916789e7181a3c8b5fa9f49ec628574f43b17c2eee05d.exe	83
PID 2300 wrote to memory of 3504	2300	afcc447467d954cf08e916789e7181a3c8b5fa9f49ec628574f43b17c2eee05d.exe	83

C:\Users\Admin\AppData\Local\Temp\afcc447467d954cf08e916789e7181a3c8b5fa9f49ec628574f43b17c2eee05d.exe
"C:\Users\Admin\AppData\Local\Temp\afcc447467d954cf08e916789e7181a3c8b5fa9f49ec628574f43b17c2eee05d.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\FolderTypes.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1268
  2⤵
  - Program crash
  PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2300 -ip 2300
1⤵
PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FolderTypes.exe

Path C:\Users\Admin\AppData\Local\Temp\FolderTypes.exe
Size 5KB
SHA256 91e823c85cebafefd6ca98759234f1dca7a3585d7d0fbafe4463664197d9d8e5
MD5 24c482e9a8094deba0e5d2e85046727c
SHA1 1882cca51c567bc9bd7504a2555e6c366cbe80fa
SHA512 877158427e3fa8a3539d64f0b9994409d3c3a2c6920823827c6b11fa52001f1ef69999bafafbee6a63a0ab38ed94b0a03ae71994f4fdb78e223156fee1ac0cd8
SSDEEP 96:TNNYZ6KXrSgW1ZYMoxT0ixD3nqTreTrGdIhZz:TNNYZ6K7SgW1ZK0ixjGyPz
MD5 SHA1 SHA512 SSDEEP

Submit Download

FolderTypes.txt

Path C:\Users\Admin\AppData\Local\Temp\FolderTypes.txt
Size 6KB
SHA256 a79c4cd7cf44dd454409d12779e613de88e40089037c7d99c63aee3e86347805
MD5 5130e896d3f3e5e02553b6f779ae4a37
SHA1 22de192c9b890095936acd668bb71b37975d5891
SHA512 8c6fe1f0974437f427d872a9f43d8133bd456514f47f201b6200a98232645aa844eb96470bb7aa25f2521706efc482e86dd1af7f330d9a316c982e496ef8ea1d
SSDEEP 96:LuXq0T3JPCIqbwKBC1/MHCU9f5sxSL+tNxOA19GDU1naGjAis/ly2ggBWLvCauAc:LuXq0bLMvUWF91k42DpnuAoH/EqPH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2300-0-0x000000007485E000-0x000000007485F000-memory.dmp

Download

memory/2300-1-0x00000000006D0000-0x00000000006E6000-memory.dmp

Download

memory/2300-3-0x0000000074850000-0x0000000075000000-memory.dmp

Download

memory/2300-15-0x0000000074850000-0x0000000075000000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads