eternity | d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 04:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e.exe
Size

67KB
MD5

4e4df7281b450388df63cee0a2bdd0f1
SHA1

6f5074b16cdb2798cae6fb439a6a8d0067ac6ed2
SHA256

d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e
SHA512

201fb3b92d4e74e2c22b4224b322bee7d2ee40f199fe667e86d51b25b8e92aae0cf961a5cae5bd7f73fc413e30ce124c3b5a9ffd4806bb1b28a3fec4c87680e6
SSDEEP

768:8vRJjAqJmhnmRIVYOFYaL0ix9ps9naW+9SLf:8ZJj2J/Ts9a3SLf

Score

10^/10

eternity

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1852	2796	WerFault.exe	27

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2216	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2216	2796	d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e.exe	28
PID 2796 wrote to memory of 2216	2796	d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e.exe	28
PID 2796 wrote to memory of 2216	2796	d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e.exe	28
PID 2796 wrote to memory of 2216	2796	d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e.exe	28
PID 2796 wrote to memory of 1852	2796	d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e.exe	29
PID 2796 wrote to memory of 1852	2796	d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e.exe	29
PID 2796 wrote to memory of 1852	2796	d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e.exe	29
PID 2796 wrote to memory of 1852	2796	d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e.exe	29

C:\Users\Admin\AppData\Local\Temp\d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e.exe
"C:\Users\Admin\AppData\Local\Temp\d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Inf.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 920
  2⤵
  - Program crash
  PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Inf.txt

Filesize
1KB

MD5
b81514967c10eef0bd78fc4aa1eb213f

SHA1
2a2f9e531981e804e6a5446261159d36c9355211

SHA256
5dcaa38c4a9bfd401db6c6759a7f5a258743770c25d4067c20cddcad52b0fc76

SHA512
ebc2338ea7a9b5cc442c29881a540960c2c17ec9e473f1c465788dce79a36aa6679642e654bf013aabea6f7c11583dd013a041e73caa03056acadd8c8df29b52

Download Submit
memory/2796-0-0x000000007436E000-0x000000007436F000-memory.dmp

Filesize
4KB

Download
memory/2796-1-0x0000000000B90000-0x0000000000BA6000-memory.dmp

Filesize
88KB

Download
memory/2796-4-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/2796-8-0x000000007436E000-0x000000007436F000-memory.dmp

Filesize
4KB

Download
memory/2796-9-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download