Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

14/03/2024, 10:26

240314-mgrjcsbh52 10

14/03/2024, 10:25

240314-mfxc8ahe7z 10

Analysis

  • max time kernel
    118s
  • max time network
    306s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/03/2024, 10:26

General

  • Target

    Rino's Discord Account ToolKit/Rinos_Discord_Account_ToolKit.exe

  • Size

    4.3MB

  • MD5

    a7553cc8ad2b91025f5bfb532090d2b6

  • SHA1

    5326aeb29d57118faaad3af9946584b87ad7f0d0

  • SHA256

    6aeee8b13c11c4157a2a92a38270c30af85fb060e5ccf3ef54994d2c3a1cf5b4

  • SHA512

    1a62dec71262fcf6561cf6ea615f9cb0a4d9d495e8759ab62b5980f6ad4211effce2e3f0726e69afb55441999e264ea25512db0e6d584d4c7e3c949429c9b81c

  • SSDEEP

    98304:XIPanxb7sGW9NcEJn5kKxGOd82SqTxaA/XjOqC1kIq9o8ha:Ys7sGqNcLGGOJSeV7L9o

Score
10/10

Malware Config

Extracted

Family

xworm

Version

3.1

Attributes
  • install_file

    game.exe

Signatures

  • Detect Xworm Payload 3 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:424
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{d8e2fd8d-cc80-422d-9c25-d074e476b539}
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2616
    • C:\Users\Admin\AppData\Local\Temp\Rino's Discord Account ToolKit\Rinos_Discord_Account_ToolKit.exe
      "C:\Users\Admin\AppData\Local\Temp\Rino's Discord Account ToolKit\Rinos_Discord_Account_ToolKit.exe"
      1⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:640
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelCpHDCPSvc.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelCpHDCPSvc.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2860
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelCpHDCPSvc.exe'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2372
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'IntelCpHDCPSvc.exe'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1664
      • C:\TOOLS\Rino's Discord Account ToolKit.exe
        "C:\TOOLS\Rino's Discord Account ToolKit.exe"
        2⤵
        • Executes dropped EXE
        PID:2484

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\TOOLS\Rino's Discord Account ToolKit.exe

      Filesize

      1.2MB

      MD5

      1171e21cb134bbb7f12ae3e6140074fe

      SHA1

      7f882104470545ee1fe2adddc83dc971e42f8968

      SHA256

      4305eea2c9577597fe5e9799585ab6567b89219191ffc246775a7aad2414f276

      SHA512

      b68485534fedc29b6f7a4ad4f8e808694cefa662951e9043760e6eef184ec92b31c9933a1be3e5aa88c78b3a5ea5a0eb46cc0fc4d126e3cd09b0184c75de010d

    • C:\TOOLS\Rino's Discord Account ToolKit.exe

      Filesize

      1.2MB

      MD5

      a9b8c6b4b50b65014dcc0246f450d4db

      SHA1

      ec2579aed806f2eb3e0d5899139145534b014e89

      SHA256

      6568eb9ebab395c8e6a01995c0431ee367712784bf018018ee86ce40be4386b8

      SHA512

      07e8bd7399f82bde5f0c02fbf7709c067999077415dfdb6ceb859cabe6f62e1cc973371d27955bf728dbb7fc556b61c9d02193700e2f83aad8cac8bab2264ff4

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3S19USJ1NX92CKNDOGVC.temp

      Filesize

      7KB

      MD5

      1f79c138874afc33d769e1f19e92b926

      SHA1

      e6897a2c57b7dfb87ae7327848b0432a2bb5b55a

      SHA256

      8488bb33d5f9d13ba32dee99bbf7c7f4596083d180749f787d22198f2d017221

      SHA512

      58bc143261729cb8ae293b8a211a07fd2b6a2d719538f30e2ae1d1676016424566a1c4d745e7538a19b8a2ebd81c4ede1e3100ed57512fae15e5a265f5b269b9

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelCpHDCPSvc.exe

      Filesize

      301KB

      MD5

      34613dee8aeb37cf39ea63ce5fdb47ea

      SHA1

      c0c5816551614719bb79b7fc5f0092f3c6e50f6f

      SHA256

      9a14d4f1fc797330557379e7fdec808cd3ef0ba5d372c02f8ce37a86b8bed214

      SHA512

      0d11526487843c62fe0edf3fbba413ac6c035e8b3ce8d47f878daf9ab39e45aae4d7108e4a1652da144b8af6c38c20df354fd34850df51943748f6c21e7f36e2

    • memory/640-1-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

      Filesize

      9.9MB

    • memory/640-2-0x000000001AC90000-0x000000001AD10000-memory.dmp

      Filesize

      512KB

    • memory/640-0-0x00000000002A0000-0x00000000006F0000-memory.dmp

      Filesize

      4.3MB

    • memory/640-17-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

      Filesize

      9.9MB

    • memory/1664-62-0x0000000002A60000-0x0000000002AE0000-memory.dmp

      Filesize

      512KB

    • memory/1664-65-0x000007FEECB80000-0x000007FEED51D000-memory.dmp

      Filesize

      9.6MB

    • memory/1664-61-0x0000000002A60000-0x0000000002AE0000-memory.dmp

      Filesize

      512KB

    • memory/1664-63-0x0000000002A60000-0x0000000002AE0000-memory.dmp

      Filesize

      512KB

    • memory/1664-67-0x0000000002A60000-0x0000000002AE0000-memory.dmp

      Filesize

      512KB

    • memory/1664-60-0x000007FEECB80000-0x000007FEED51D000-memory.dmp

      Filesize

      9.6MB

    • memory/1664-59-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

      Filesize

      32KB

    • memory/1664-58-0x000000001B2C0000-0x000000001B5A2000-memory.dmp

      Filesize

      2.9MB

    • memory/1664-68-0x000007FEECB80000-0x000007FEED51D000-memory.dmp

      Filesize

      9.6MB

    • memory/2372-52-0x000007FEED520000-0x000007FEEDEBD000-memory.dmp

      Filesize

      9.6MB

    • memory/2372-51-0x0000000002A70000-0x0000000002AF0000-memory.dmp

      Filesize

      512KB

    • memory/2372-48-0x0000000002A70000-0x0000000002AF0000-memory.dmp

      Filesize

      512KB

    • memory/2372-47-0x0000000002A70000-0x0000000002AF0000-memory.dmp

      Filesize

      512KB

    • memory/2372-46-0x000007FEED520000-0x000007FEEDEBD000-memory.dmp

      Filesize

      9.6MB

    • memory/2372-45-0x0000000002A70000-0x0000000002AF0000-memory.dmp

      Filesize

      512KB

    • memory/2372-44-0x000007FEED520000-0x000007FEEDEBD000-memory.dmp

      Filesize

      9.6MB

    • memory/2372-43-0x00000000025F0000-0x00000000025F8000-memory.dmp

      Filesize

      32KB

    • memory/2372-42-0x000000001B390000-0x000000001B672000-memory.dmp

      Filesize

      2.9MB

    • memory/2484-37-0x0000000000B50000-0x0000000000BD0000-memory.dmp

      Filesize

      512KB

    • memory/2484-18-0x0000000001280000-0x0000000001684000-memory.dmp

      Filesize

      4.0MB

    • memory/2484-35-0x0000000000B50000-0x0000000000BD0000-memory.dmp

      Filesize

      512KB

    • memory/2484-34-0x000000001B7D0000-0x000000001BC84000-memory.dmp

      Filesize

      4.7MB

    • memory/2484-33-0x0000000000B50000-0x0000000000BD0000-memory.dmp

      Filesize

      512KB

    • memory/2484-72-0x0000000000B50000-0x0000000000BD0000-memory.dmp

      Filesize

      512KB

    • memory/2484-71-0x0000000000B50000-0x0000000000BD0000-memory.dmp

      Filesize

      512KB

    • memory/2484-70-0x0000000000B50000-0x0000000000BD0000-memory.dmp

      Filesize

      512KB

    • memory/2484-49-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

      Filesize

      9.9MB

    • memory/2484-16-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

      Filesize

      9.9MB

    • memory/2616-24-0x0000000140000000-0x0000000140040000-memory.dmp

      Filesize

      256KB

    • memory/2616-29-0x00000000775E0000-0x00000000776FF000-memory.dmp

      Filesize

      1.1MB

    • memory/2616-26-0x0000000140000000-0x0000000140040000-memory.dmp

      Filesize

      256KB

    • memory/2616-30-0x0000000140000000-0x0000000140040000-memory.dmp

      Filesize

      256KB

    • memory/2616-28-0x0000000140000000-0x0000000140040000-memory.dmp

      Filesize

      256KB

    • memory/2616-69-0x0000000077800000-0x00000000779A9000-memory.dmp

      Filesize

      1.7MB

    • memory/2616-27-0x0000000077800000-0x00000000779A9000-memory.dmp

      Filesize

      1.7MB

    • memory/2860-64-0x00000000775E0000-0x00000000776FF000-memory.dmp

      Filesize

      1.1MB

    • memory/2860-19-0x0000000000750000-0x000000000078E000-memory.dmp

      Filesize

      248KB

    • memory/2860-21-0x0000000077800000-0x00000000779A9000-memory.dmp

      Filesize

      1.7MB

    • memory/2860-50-0x0000000077800000-0x00000000779A9000-memory.dmp

      Filesize

      1.7MB

    • memory/2860-66-0x000000001C000000-0x000000001C080000-memory.dmp

      Filesize

      512KB

    • memory/2860-14-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

      Filesize

      9.9MB

    • memory/2860-9-0x000000013F6D0000-0x000000013F720000-memory.dmp

      Filesize

      320KB

    • memory/2860-22-0x00000000775E0000-0x00000000776FF000-memory.dmp

      Filesize

      1.1MB

    • memory/2860-23-0x000000001C000000-0x000000001C080000-memory.dmp

      Filesize

      512KB

    • memory/2860-36-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

      Filesize

      9.9MB

    • memory/2860-32-0x0000000000800000-0x0000000000814000-memory.dmp

      Filesize

      80KB