Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3Xtool 3.rar
windows7-x64
3Xtool 3.rar
windows10-2004-x64
7Xtool 3/De...ha.dll
windows7-x64
1Xtool 3/De...ha.dll
windows10-2004-x64
1Xtool 3/Mi...es.dll
windows7-x64
1Xtool 3/Mi...es.dll
windows10-2004-x64
1Xtool 3/Mi...rs.dll
windows7-x64
1Xtool 3/Mi...rs.dll
windows10-2004-x64
1Xtool 3/Mi...ll.dll
windows7-x64
1Xtool 3/Mi...ll.dll
windows10-2004-x64
1Xtool 3/Mi...ns.dll
windows7-x64
1Xtool 3/Mi...ns.dll
windows10-2004-x64
1Xtool 3/Mi...ck.dll
windows7-x64
1Xtool 3/Mi...ck.dll
windows10-2004-x64
1Xtool 3/README.md
windows7-x64
3Xtool 3/README.md
windows10-2004-x64
3Xtool 3/RestSharp.dll
windows7-x64
1Xtool 3/RestSharp.dll
windows10-2004-x64
1Xtool 3/Sy...om.dll
windows7-x64
1Xtool 3/Sy...om.dll
windows10-2004-x64
1Xtool 3/Up...og.txt
windows7-x64
1Xtool 3/Up...og.txt
windows10-2004-x64
1Xtool 3/Vi...us.dll
windows7-x64
1Xtool 3/Vi...us.dll
windows10-2004-x64
1Xtool 3/Xtool3.exe
windows7-x64
1Xtool 3/Xtool3.exe
windows10-2004-x64
1Analysis
-
max time kernel
115s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 23:34
Static task
static1
Behavioral task
behavioral1
Sample
Xtool 3.rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Xtool 3.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Xtool 3/DeathByCaptcha.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
Xtool 3/DeathByCaptcha.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Xtool 3/Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Xtool 3/Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Xtool 3/Microsoft.WindowsAPICodePack.Sensors.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Xtool 3/Microsoft.WindowsAPICodePack.Sensors.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Xtool 3/Microsoft.WindowsAPICodePack.Shell.dll
Resource
win7-20240319-en
Behavioral task
behavioral10
Sample
Xtool 3/Microsoft.WindowsAPICodePack.Shell.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Xtool 3/Microsoft.WindowsAPICodePack.ShellExtensions.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Xtool 3/Microsoft.WindowsAPICodePack.ShellExtensions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Xtool 3/Microsoft.WindowsAPICodePack.dll
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
Xtool 3/Microsoft.WindowsAPICodePack.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
Xtool 3/README.md
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
Xtool 3/README.md
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Xtool 3/RestSharp.dll
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
Xtool 3/RestSharp.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Xtool 3/System.CodeDom.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Xtool 3/System.CodeDom.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Xtool 3/Update Log.txt
Resource
win7-20240319-en
Behavioral task
behavioral22
Sample
Xtool 3/Update Log.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
Xtool 3/VisualPlus.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Xtool 3/VisualPlus.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Xtool 3/Xtool3.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Xtool 3/Xtool3.exe
Resource
win10v2004-20231215-en
General
-
Target
Xtool 3.rar
-
Size
628KB
-
MD5
ecac524d944e9580b56de53552a64184
-
SHA1
e8cc94559d030b1f1feeb20f2482892b24d31671
-
SHA256
8e7cf04f6a32429304b49abe68604c1174b58d6bd35ed58ffc5d973932d12487
-
SHA512
3a2ddc8ba9264aea1217c9c37efafd1ecce1a41f4e2e23f5f1ccfb51cd0e4379fac1a2b813ac73462d533e7c6278b9a733ebb37e9afd33eec07c4f93a2f05411
-
SSDEEP
12288:3sCy71fZ9gm/Q6yPFduRDMM0+xJFGYq++sa51sDX3JcW:3sP5fLgmuduhJxJwMa51sDXmW
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 3904 7zFM.exe Token: 35 3904 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3904 7zFM.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4360 wrote to memory of 3904 4360 cmd.exe 91 PID 4360 wrote to memory of 3904 4360 cmd.exe 91
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Xtool 3.rar"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Xtool 3.rar"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3112,i,1786399861560734457,5606877702857066305,262144 --variations-seed-version /prefetch:81⤵PID:220