Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 11:53
Behavioral task
behavioral1
Sample
Eternity.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
General
-
Target
Eternity.exe
-
Size
40.8MB
-
MD5
40f0212fa97e2fe44ee0fbffae0c96b5
-
SHA1
e11664504e7b3ab905de8069e6fb5b1159aec002
-
SHA256
32d38e1eae86466254658d5a91a8bca983706b3aec35148012cb0a50f550a74f
-
SHA512
2eeebc345f202033762cfa1e5ae4a2b2f477dad7e7019e5aff7b3aff98d0a9ee7c2223a94dfb6cc1a6fd66eb0290adee3baa1fda8d99658253c005ca11f425f5
-
SSDEEP
786432:gHvsyBy7Mu30RSVRAaAeQc98NmhJQ8mZoJRWUmx2qmE:gUyCMrUVKa/bhJQ8mZorV+
Malware Config
Signatures
-
Growtopia family
-
Program crash 1 IoCs
pid pid_target Process procid_target 1556 588 WerFault.exe 28 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eternity.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 588 Eternity.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 588 wrote to memory of 1556 588 Eternity.exe 29 PID 588 wrote to memory of 1556 588 Eternity.exe 29 PID 588 wrote to memory of 1556 588 Eternity.exe 29 PID 588 wrote to memory of 1556 588 Eternity.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\Eternity.exe"C:\Users\Admin\AppData\Local\Temp\Eternity.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 588 -s 7962⤵
- Program crash
PID:1556
-