eternity | d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e

Analysis

max time kernel
134s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 04:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e.exe
Size

67KB
MD5

4e4df7281b450388df63cee0a2bdd0f1
SHA1

6f5074b16cdb2798cae6fb439a6a8d0067ac6ed2
SHA256

d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e
SHA512

201fb3b92d4e74e2c22b4224b322bee7d2ee40f199fe667e86d51b25b8e92aae0cf961a5cae5bd7f73fc413e30ce124c3b5a9ffd4806bb1b28a3fec4c87680e6
SSDEEP

768:8vRJjAqJmhnmRIVYOFYaL0ix9ps9naW+9SLf:8ZJj2J/Ts9a3SLf

Score

10^/10

eternity

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4896	4104	WerFault.exe	82

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings	d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1076	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 1076	4104	d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e.exe	83
PID 4104 wrote to memory of 1076	4104	d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e.exe	83
PID 4104 wrote to memory of 1076	4104	d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e.exe	83

C:\Users\Admin\AppData\Local\Temp\d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e.exe
"C:\Users\Admin\AppData\Local\Temp\d2fb55c9cefddd34e914e987a0e398ef9679ae59c80dc5ae1540e134ee1d9c7e.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Inf.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 1640
  2⤵
  - Program crash
  PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4104 -ip 4104
1⤵
PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Inf.exe

Filesize
5KB

MD5
24c482e9a8094deba0e5d2e85046727c

SHA1
1882cca51c567bc9bd7504a2555e6c366cbe80fa

SHA256
91e823c85cebafefd6ca98759234f1dca7a3585d7d0fbafe4463664197d9d8e5

SHA512
877158427e3fa8a3539d64f0b9994409d3c3a2c6920823827c6b11fa52001f1ef69999bafafbee6a63a0ab38ed94b0a03ae71994f4fdb78e223156fee1ac0cd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Inf.txt

Filesize
1KB

MD5
b81514967c10eef0bd78fc4aa1eb213f

SHA1
2a2f9e531981e804e6a5446261159d36c9355211

SHA256
5dcaa38c4a9bfd401db6c6759a7f5a258743770c25d4067c20cddcad52b0fc76

SHA512
ebc2338ea7a9b5cc442c29881a540960c2c17ec9e473f1c465788dce79a36aa6679642e654bf013aabea6f7c11583dd013a041e73caa03056acadd8c8df29b52

Download Submit
memory/4104-0-0x000000007534E000-0x000000007534F000-memory.dmp

Filesize
4KB

Download
memory/4104-1-0x0000000000C40000-0x0000000000C56000-memory.dmp

Filesize
88KB

Download
memory/4104-3-0x0000000075340000-0x0000000075AF0000-memory.dmp

Filesize
7.7MB

Download
memory/4104-15-0x0000000075340000-0x0000000075AF0000-memory.dmp

Filesize
7.7MB

Download