Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
9Static
static
3CampPinecrest.exe
windows11-21h2-x64
9$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows11-21h2-x64
3WorldWars.exe
windows11-21h2-x64
9d3dcompiler_47.dll
windows11-21h2-x64
1ffmpeg.dll
windows11-21h2-x64
1libEGL.dll
windows11-21h2-x64
1libGLESv2.dll
windows11-21h2-x64
1locales/af.ps1
windows11-21h2-x64
3locales/uk.ps1
windows11-21h2-x64
3resources/...nts.js
windows11-21h2-x64
3resources/...ent.js
windows11-21h2-x64
3resources/...ode.js
windows11-21h2-x64
3resources/...age.js
windows11-21h2-x64
3resources/...med.js
windows11-21h2-x64
3resources/...rse.js
windows11-21h2-x64
3resources/...ver.js
windows11-21h2-x64
3resources/...ver.js
windows11-21h2-x64
3resources/elevate.exe
windows11-21h2-x64
3vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3$R0/Uninst...rs.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3Resubmissions
02/09/2024, 21:14
240902-z3rgpsxcnm 902/09/2024, 21:08
240902-zyvnkaxbqj 902/09/2024, 20:57
240902-zrx54sxapk 902/09/2024, 20:52
240902-znsffsxajm 9Analysis
-
max time kernel
1800s -
max time network
1119s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
02/09/2024, 21:14
Static task
static1
Behavioral task
behavioral1
Sample
CampPinecrest.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
LICENSES.chromium.html
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
WorldWars.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
d3dcompiler_47.dll
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
ffmpeg.dll
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
libEGL.dll
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
libGLESv2.dll
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
locales/af.ps1
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
locales/uk.ps1
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
resources/app.asar.unpacked/node_modules/hbo-dnsd/constants.js
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
resources/app.asar.unpacked/node_modules/hbo-dnsd/convenient.js
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
resources/app.asar.unpacked/node_modules/hbo-dnsd/encode.js
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
resources/app.asar.unpacked/node_modules/hbo-dnsd/message.js
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/hbo-dnsd/named.js
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/hbo-dnsd/parse.js
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/hbo-dnsd/server.js
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/hbo-dnsd/util/null-server.js
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
resources/elevate.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
vk_swiftshader.dll
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
vulkan-1.dll
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
$R0/Uninstall WorldWars.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20240802-en
windows11-21h2-x64
General
-
Target
WorldWars.exe
-
Size
154.6MB
-
MD5
225cd570d533705a6798559e90ed99d9
-
SHA1
dadf3eccaf2b6c7183128941e3b854b8e6f21cec
-
SHA256
b4f796f1cd929e6da285b3469f8ad9a2ae9ef4d383295abf0a746bf053ea4c0e
-
SHA512
67aefd4d858caacf7129671081cf8eae9762a5e27cf63832226da7a25f9aac3b3c19a8b4d9cd3216b6565f066259c2d7dadc86d9ca1277b659d9351054759405
-
SSDEEP
1572864:ITmw0ciLNpDPuAvHxJLkY2O6Ea3f9kwZXeT6EivLp1vUAtdjtZn+f4FnIvGaC9dU:7v6E70+Mk
Malware Config
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Loads dropped DLL 2 IoCs
pid Process 1300 WorldWars.exe 1300 WorldWars.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 3548 tasklist.exe 2464 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 560 WorldWars.exe 560 WorldWars.exe 4592 WorldWars.exe 4592 WorldWars.exe 4592 WorldWars.exe 4592 WorldWars.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1576 WMIC.exe Token: SeSecurityPrivilege 1576 WMIC.exe Token: SeTakeOwnershipPrivilege 1576 WMIC.exe Token: SeLoadDriverPrivilege 1576 WMIC.exe Token: SeSystemProfilePrivilege 1576 WMIC.exe Token: SeSystemtimePrivilege 1576 WMIC.exe Token: SeProfSingleProcessPrivilege 1576 WMIC.exe Token: SeIncBasePriorityPrivilege 1576 WMIC.exe Token: SeCreatePagefilePrivilege 1576 WMIC.exe Token: SeBackupPrivilege 1576 WMIC.exe Token: SeRestorePrivilege 1576 WMIC.exe Token: SeShutdownPrivilege 1576 WMIC.exe Token: SeDebugPrivilege 1576 WMIC.exe Token: SeSystemEnvironmentPrivilege 1576 WMIC.exe Token: SeRemoteShutdownPrivilege 1576 WMIC.exe Token: SeUndockPrivilege 1576 WMIC.exe Token: SeManageVolumePrivilege 1576 WMIC.exe Token: 33 1576 WMIC.exe Token: 34 1576 WMIC.exe Token: 35 1576 WMIC.exe Token: 36 1576 WMIC.exe Token: SeIncreaseQuotaPrivilege 1576 WMIC.exe Token: SeSecurityPrivilege 1576 WMIC.exe Token: SeTakeOwnershipPrivilege 1576 WMIC.exe Token: SeLoadDriverPrivilege 1576 WMIC.exe Token: SeSystemProfilePrivilege 1576 WMIC.exe Token: SeSystemtimePrivilege 1576 WMIC.exe Token: SeProfSingleProcessPrivilege 1576 WMIC.exe Token: SeIncBasePriorityPrivilege 1576 WMIC.exe Token: SeCreatePagefilePrivilege 1576 WMIC.exe Token: SeBackupPrivilege 1576 WMIC.exe Token: SeRestorePrivilege 1576 WMIC.exe Token: SeShutdownPrivilege 1576 WMIC.exe Token: SeDebugPrivilege 1576 WMIC.exe Token: SeSystemEnvironmentPrivilege 1576 WMIC.exe Token: SeRemoteShutdownPrivilege 1576 WMIC.exe Token: SeUndockPrivilege 1576 WMIC.exe Token: SeManageVolumePrivilege 1576 WMIC.exe Token: 33 1576 WMIC.exe Token: 34 1576 WMIC.exe Token: 35 1576 WMIC.exe Token: 36 1576 WMIC.exe Token: SeDebugPrivilege 3548 tasklist.exe Token: SeDebugPrivilege 2464 tasklist.exe Token: SeShutdownPrivilege 1300 WorldWars.exe Token: SeCreatePagefilePrivilege 1300 WorldWars.exe Token: SeShutdownPrivilege 1300 WorldWars.exe Token: SeCreatePagefilePrivilege 1300 WorldWars.exe Token: SeShutdownPrivilege 1300 WorldWars.exe Token: SeCreatePagefilePrivilege 1300 WorldWars.exe Token: SeShutdownPrivilege 1300 WorldWars.exe Token: SeCreatePagefilePrivilege 1300 WorldWars.exe Token: SeShutdownPrivilege 1300 WorldWars.exe Token: SeCreatePagefilePrivilege 1300 WorldWars.exe Token: SeShutdownPrivilege 1300 WorldWars.exe Token: SeCreatePagefilePrivilege 1300 WorldWars.exe Token: SeShutdownPrivilege 1300 WorldWars.exe Token: SeCreatePagefilePrivilege 1300 WorldWars.exe Token: SeShutdownPrivilege 1300 WorldWars.exe Token: SeCreatePagefilePrivilege 1300 WorldWars.exe Token: SeShutdownPrivilege 1300 WorldWars.exe Token: SeCreatePagefilePrivilege 1300 WorldWars.exe Token: SeShutdownPrivilege 1300 WorldWars.exe Token: SeCreatePagefilePrivilege 1300 WorldWars.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1300 wrote to memory of 2616 1300 WorldWars.exe 80 PID 1300 wrote to memory of 2616 1300 WorldWars.exe 80 PID 2616 wrote to memory of 1576 2616 cmd.exe 82 PID 2616 wrote to memory of 1576 2616 cmd.exe 82 PID 1300 wrote to memory of 768 1300 WorldWars.exe 84 PID 1300 wrote to memory of 768 1300 WorldWars.exe 84 PID 1300 wrote to memory of 1572 1300 WorldWars.exe 85 PID 1300 wrote to memory of 1572 1300 WorldWars.exe 85 PID 1572 wrote to memory of 3548 1572 cmd.exe 88 PID 1572 wrote to memory of 3548 1572 cmd.exe 88 PID 768 wrote to memory of 2464 768 cmd.exe 89 PID 768 wrote to memory of 2464 768 cmd.exe 89 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 2920 1300 WorldWars.exe 90 PID 1300 wrote to memory of 560 1300 WorldWars.exe 91 PID 1300 wrote to memory of 560 1300 WorldWars.exe 91 PID 1300 wrote to memory of 4592 1300 WorldWars.exe 92 PID 1300 wrote to memory of 4592 1300 WorldWars.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\WorldWars.exe"C:\Users\Admin\AppData\Local\Temp\WorldWars.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"2⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1576
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3548
-
-
-
C:\Users\Admin\AppData\Local\Temp\WorldWars.exe"C:\Users\Admin\AppData\Local\Temp\WorldWars.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\unitygame-setup" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1872 --field-trial-handle=1876,i,18446229219209449067,11794341009866648329,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2920
-
-
C:\Users\Admin\AppData\Local\Temp\WorldWars.exe"C:\Users\Admin\AppData\Local\Temp\WorldWars.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\unitygame-setup" --mojo-platform-channel-handle=2068 --field-trial-handle=1876,i,18446229219209449067,11794341009866648329,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:560
-
-
C:\Users\Admin\AppData\Local\Temp\WorldWars.exe"C:\Users\Admin\AppData\Local\Temp\WorldWars.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\unitygame-setup" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1448 --field-trial-handle=1876,i,18446229219209449067,11794341009866648329,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4592
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
137KB
MD504bfbfec8db966420fe4c7b85ebb506a
SHA1939bb742a354a92e1dcd3661a62d69e48030a335
SHA256da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
SHA5124ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
-
Filesize
1.4MB
MD556192831a7f808874207ba593f464415
SHA1e0c18c72a62692d856da1f8988b0bc9c8088d2aa
SHA2566aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c
SHA512c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33