Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
211s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
14/03/2024, 10:26
Behavioral task
behavioral1
Sample
Rino's Discord Account ToolKit/Rino's Discord Acount toolkit.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Rino's Discord Account ToolKit/Rino's Discord Acount toolkit.exe
Resource
win10-20240214-en
Behavioral task
behavioral3
Sample
Rino's Discord Account ToolKit/Rino's Discord Acount toolkit.exe
Resource
win11-20240221-en
Behavioral task
behavioral4
Sample
Rino's Discord Account ToolKit/Rinos_Discord_Account_ToolKit.exe
Resource
win7-20240221-en
Behavioral task
behavioral5
Sample
Rino's Discord Account ToolKit/Rinos_Discord_Account_ToolKit.exe
Resource
win10-20240221-en
General
-
Target
Rino's Discord Account ToolKit/Rinos_Discord_Account_ToolKit.exe
-
Size
4.3MB
-
MD5
a7553cc8ad2b91025f5bfb532090d2b6
-
SHA1
5326aeb29d57118faaad3af9946584b87ad7f0d0
-
SHA256
6aeee8b13c11c4157a2a92a38270c30af85fb060e5ccf3ef54994d2c3a1cf5b4
-
SHA512
1a62dec71262fcf6561cf6ea615f9cb0a4d9d495e8759ab62b5980f6ad4211effce2e3f0726e69afb55441999e264ea25512db0e6d584d4c7e3c949429c9b81c
-
SSDEEP
98304:XIPanxb7sGW9NcEJn5kKxGOd82SqTxaA/XjOqC1kIq9o8ha:Ys7sGqNcLGGOJSeV7L9o
Malware Config
Extracted
xworm
3.1
-
install_file
game.exe
Signatures
-
Detect Xworm Payload 3 IoCs
resource yara_rule behavioral6/files/0x000700000002a74e-15.dat family_xworm behavioral6/memory/4668-40-0x00000223D1240000-0x00000223D1254000-memory.dmp family_xworm behavioral6/memory/4668-16-0x00000223D0DF0000-0x00000223D0E40000-memory.dmp family_xworm -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4668 created 632 4668 IntelCpHDCPSvc.exe 698 -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelCpHDCPSvc.exe Rinos_Discord_Account_ToolKit.exe -
Executes dropped EXE 2 IoCs
pid Process 4668 IntelCpHDCPSvc.exe 3480 Rino's Discord Account ToolKit.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4668 set thread context of 4604 4668 IntelCpHDCPSvc.exe 1287 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 4668 IntelCpHDCPSvc.exe 4604 dllhost.exe 4604 dllhost.exe 4604 dllhost.exe 4604 dllhost.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 3672 Process not Found 3592 Process not Found 2872 Process not Found 4632 Process not Found 2632 Process not Found 5108 Process not Found 2240 Process not Found 1464 Process not Found 4636 Process not Found 3160 Process not Found 532 Process not Found 4696 Process not Found 2896 Process not Found 232 Process not Found 5088 Process not Found 2264 Process not Found 3636 Process not Found 4940 Process not Found 348 Process not Found 3292 Process not Found 1204 Process not Found 2864 Process not Found 3668 Process not Found 2764 Process not Found 1616 Process not Found 4704 Process not Found 1188 Process not Found 848 Process not Found 4024 Process not Found 2272 Process not Found 4200 Process not Found 2216 Process not Found 1496 Process not Found 3540 Process not Found 4880 Process not Found 2700 Process not Found 4424 Process not Found 4836 Process not Found 1564 Process not Found 3760 Process not Found 3368 Process not Found 3524 Process not Found 3196 Process not Found 2156 Process not Found 3100 Process not Found 2628 Process not Found 2564 Process not Found 5084 Process not Found 236 Process not Found 1216 Process not Found 1240 Process not Found 3128 Process not Found 1968 Process not Found 2832 Process not Found 1836 Process not Found 1632 Process not Found 2600 Process not Found 1584 Process not Found 1520 Process not Found 4840 Process not Found 816 Process not Found 3972 Process not Found 3476 Process not Found 4180 Process not Found -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4668 IntelCpHDCPSvc.exe Token: SeDebugPrivilege 4668 IntelCpHDCPSvc.exe Token: SeDebugPrivilege 4604 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1188 wrote to memory of 4668 1188 Rinos_Discord_Account_ToolKit.exe 82 PID 1188 wrote to memory of 4668 1188 Rinos_Discord_Account_ToolKit.exe 82 PID 1188 wrote to memory of 3480 1188 Rinos_Discord_Account_ToolKit.exe 83 PID 1188 wrote to memory of 3480 1188 Rinos_Discord_Account_ToolKit.exe 83 PID 4668 wrote to memory of 4604 4668 IntelCpHDCPSvc.exe 1287 PID 4668 wrote to memory of 4604 4668 IntelCpHDCPSvc.exe 1287 PID 4668 wrote to memory of 4604 4668 IntelCpHDCPSvc.exe 1287 PID 4668 wrote to memory of 4604 4668 IntelCpHDCPSvc.exe 1287 PID 4668 wrote to memory of 4604 4668 IntelCpHDCPSvc.exe 1287 PID 4668 wrote to memory of 4604 4668 IntelCpHDCPSvc.exe 1287 PID 4668 wrote to memory of 4604 4668 IntelCpHDCPSvc.exe 1287 PID 4668 wrote to memory of 4604 4668 IntelCpHDCPSvc.exe 1287 PID 4668 wrote to memory of 4604 4668 IntelCpHDCPSvc.exe 1287 PID 4668 wrote to memory of 4604 4668 IntelCpHDCPSvc.exe 1287 PID 4668 wrote to memory of 4604 4668 IntelCpHDCPSvc.exe 1287 PID 4604 wrote to memory of 632 4604 dllhost.exe 698 PID 4604 wrote to memory of 692 4604 dllhost.exe 7 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 4604 wrote to memory of 980 4604 dllhost.exe 12 PID 4604 wrote to memory of 460 4604 dllhost.exe 394 PID 4604 wrote to memory of 764 4604 dllhost.exe 14 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 4604 wrote to memory of 676 4604 dllhost.exe 15 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 4604 wrote to memory of 1076 4604 dllhost.exe 16 PID 4604 wrote to memory of 1084 4604 dllhost.exe 17 PID 4604 wrote to memory of 1164 4604 dllhost.exe 19 PID 4604 wrote to memory of 1176 4604 dllhost.exe 20 PID 4604 wrote to memory of 1244 4604 dllhost.exe 21 PID 4604 wrote to memory of 1300 4604 dllhost.exe 22 PID 4604 wrote to memory of 1396 4604 dllhost.exe 23 PID 4604 wrote to memory of 1432 4604 dllhost.exe 24 PID 4604 wrote to memory of 1476 4604 dllhost.exe 25 PID 4604 wrote to memory of 1576 4604 dllhost.exe 26 PID 4604 wrote to memory of 1596 4604 dllhost.exe 27 PID 4604 wrote to memory of 1680 4604 dllhost.exe 28 PID 4604 wrote to memory of 1720 4604 dllhost.exe 29 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 1476 wrote to memory of 2112 1476 svchost.exe 989 PID 1476 wrote to memory of 2112 1476 svchost.exe 989 PID 1476 wrote to memory of 4764 1476 svchost.exe 992 PID 1476 wrote to memory of 4764 1476 svchost.exe 992 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 1476 wrote to memory of 4760 1476 svchost.exe 994 PID 1476 wrote to memory of 4760 1476 svchost.exe 994 PID 1476 wrote to memory of 5068 1476 svchost.exe 1618 PID 1476 wrote to memory of 5068 1476 svchost.exe 1618 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 692 wrote to memory of 2692 692 lsass.exe 45 PID 692 wrote to memory of 2692 692 lsass.exe 45
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
PID:692
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:980
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:764
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:676
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1076
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1084
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1164
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1176
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵PID:1244
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1300
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1396
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
PID:1432
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2112
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:4764
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:4760
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:5068
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1576
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1596
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵PID:1680
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵PID:2576
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\Rino's Discord Account ToolKit\Rinos_Discord_Account_ToolKit.exe"C:\Users\Admin\AppData\Local\Temp\Rino's Discord Account ToolKit\Rinos_Discord_Account_ToolKit.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelCpHDCPSvc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelCpHDCPSvc.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4668
-
-
C:\TOOLS\Rino's Discord Account ToolKit.exe"C:\TOOLS\Rino's Discord Account ToolKit.exe"2⤵
- Executes dropped EXE
PID:3480
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{7bf50dff-a510-4c7f-bf78-54afc659ecf7}1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4604
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000138 0000008c1⤵PID:460
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000e4 0000008c1⤵PID:632
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000e4 0000008c1⤵PID:2112
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 0000010c 0000008c1⤵PID:4764
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000f0 0000008c1⤵PID:4760
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000110 0000008c1⤵PID:4604
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000f8 0000008c1⤵PID:5068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD59f65d905b34fb00cb30b1dccccbfa431
SHA1fbd44d688914699bd711972726482a81c54830a8
SHA256bcb2cce497235ef8b47c6b0a91e40ad639ea9270845ae32d49d54b4e00c8760f
SHA5120d4262ac75d30c083856dd01a23b7c5b737c073abd6f12912e8fd7b7a17acd9377194718d60bec7ef2922b0133313f613e48e1d4b25df6279e18fb116afc9d60
-
Filesize
606KB
MD52360524f65e8272678d61af2a125cc9f
SHA1775aa288e1fda3df46ad0a8d75fc3eb89a28b83c
SHA256b418eb8afa5a8935924681c8f4b2af2e91408edce40275b278e853dafbdf2153
SHA51211219bdd33a1254ae9eecfb44ce7aad483514821eda2955ea41116cc10febf6cd990817bcf77414a80e4a291087e2976203388ff8ef182329a3d7b6d7aafd412
-
Filesize
450KB
MD563c7f7603dca29aa9bb9d6e970ca452a
SHA1253997966c7996acfda41e651f958bc679a36fac
SHA2560fedff4da7bd34ca861b82b032507f86faa3fec75fc3197c4bf7e16dba8a04f4
SHA51293c7892f34d4116bc7418ea1566596488dfff658eee8e483da743ec95c2dc712100de434b37241777df30a5d9865db3052c1b8cb2445a4d716740280356d0bf0
-
Filesize
301KB
MD534613dee8aeb37cf39ea63ce5fdb47ea
SHA1c0c5816551614719bb79b7fc5f0092f3c6e50f6f
SHA2569a14d4f1fc797330557379e7fdec808cd3ef0ba5d372c02f8ce37a86b8bed214
SHA5120d11526487843c62fe0edf3fbba413ac6c035e8b3ce8d47f878daf9ab39e45aae4d7108e4a1652da144b8af6c38c20df354fd34850df51943748f6c21e7f36e2