Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

02/09/2024, 21:14

240902-z3rgpsxcnm 9

02/09/2024, 21:08

240902-zyvnkaxbqj 9

02/09/2024, 20:57

240902-zrx54sxapk 9

02/09/2024, 20:52

240902-znsffsxajm 9

Analysis

  • max time kernel
    1800s
  • max time network
    1119s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02/09/2024, 21:14

General

  • Target

    WorldWars.exe

  • Size

    154.6MB

  • MD5

    225cd570d533705a6798559e90ed99d9

  • SHA1

    dadf3eccaf2b6c7183128941e3b854b8e6f21cec

  • SHA256

    b4f796f1cd929e6da285b3469f8ad9a2ae9ef4d383295abf0a746bf053ea4c0e

  • SHA512

    67aefd4d858caacf7129671081cf8eae9762a5e27cf63832226da7a25f9aac3b3c19a8b4d9cd3216b6565f066259c2d7dadc86d9ca1277b659d9351054759405

  • SSDEEP

    1572864:ITmw0ciLNpDPuAvHxJLkY2O6Ea3f9kwZXeT6EivLp1vUAtdjtZn+f4FnIvGaC9dU:7v6E70+Mk

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WorldWars.exe
    "C:\Users\Admin\AppData\Local\Temp\WorldWars.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2616
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1576
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:768
      • C:\Windows\system32\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2464
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1572
      • C:\Windows\system32\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:3548
    • C:\Users\Admin\AppData\Local\Temp\WorldWars.exe
      "C:\Users\Admin\AppData\Local\Temp\WorldWars.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\unitygame-setup" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1872 --field-trial-handle=1876,i,18446229219209449067,11794341009866648329,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:2920
      • C:\Users\Admin\AppData\Local\Temp\WorldWars.exe
        "C:\Users\Admin\AppData\Local\Temp\WorldWars.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\unitygame-setup" --mojo-platform-channel-handle=2068 --field-trial-handle=1876,i,18446229219209449067,11794341009866648329,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:560
      • C:\Users\Admin\AppData\Local\Temp\WorldWars.exe
        "C:\Users\Admin\AppData\Local\Temp\WorldWars.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\unitygame-setup" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1448 --field-trial-handle=1876,i,18446229219209449067,11794341009866648329,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4592

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\cc0e4b9c-d1dd-42a5-b4e6-3469e83bfb19.tmp.node

      Filesize

      137KB

      MD5

      04bfbfec8db966420fe4c7b85ebb506a

      SHA1

      939bb742a354a92e1dcd3661a62d69e48030a335

      SHA256

      da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd

      SHA512

      4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65

    • C:\Users\Admin\AppData\Local\Temp\e6729e63-c0a6-4277-9eaf-d03b17671359.tmp.node

      Filesize

      1.4MB

      MD5

      56192831a7f808874207ba593f464415

      SHA1

      e0c18c72a62692d856da1f8988b0bc9c8088d2aa

      SHA256

      6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c

      SHA512

      c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

    • memory/4592-43-0x000002696DBD0000-0x000002696DBD1000-memory.dmp

      Filesize

      4KB

    • memory/4592-45-0x000002696DBD0000-0x000002696DBD1000-memory.dmp

      Filesize

      4KB

    • memory/4592-44-0x000002696DBD0000-0x000002696DBD1000-memory.dmp

      Filesize

      4KB

    • memory/4592-49-0x000002696DBD0000-0x000002696DBD1000-memory.dmp

      Filesize

      4KB

    • memory/4592-52-0x000002696DBD0000-0x000002696DBD1000-memory.dmp

      Filesize

      4KB

    • memory/4592-55-0x000002696DBD0000-0x000002696DBD1000-memory.dmp

      Filesize

      4KB

    • memory/4592-54-0x000002696DBD0000-0x000002696DBD1000-memory.dmp

      Filesize

      4KB

    • memory/4592-53-0x000002696DBD0000-0x000002696DBD1000-memory.dmp

      Filesize

      4KB

    • memory/4592-50-0x000002696DBD0000-0x000002696DBD1000-memory.dmp

      Filesize

      4KB

    • memory/4592-51-0x000002696DBD0000-0x000002696DBD1000-memory.dmp

      Filesize

      4KB