Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    61s
  • max time network
    64s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250128-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    05/02/2025, 19:11

General

  • Target

    C0D3X17 (123).rar

  • Size

    37.5MB

  • MD5

    6fd4cf19af37d9fc8860f00675d3d068

  • SHA1

    1b1d72a7d677c1f982d7b46054e904f8619040f4

  • SHA256

    b26f3837d1069076e8e4a4e0dd77c0a375452a8f1829bfdb9bcbc44e01d3347f

  • SHA512

    3cf415dda7f6fc27a5e2a022e837178a4f4ef3e78373cc14454ba1e85aa467308d1fa81a09293a4d7e1c7dd6a6511d1492e9b46654d99af4e98cc18361de154c

  • SSDEEP

    786432:JCqf2YINtXHgh1EiZwgEMLFuBwhamncUpFKJnBh/4UF10hxKqu+J3xtKadQ:IFYINtaEU4MRk4cQFKJBh/NFuxKqP3xu

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

1VeDwfujGeaxOsgJ

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Njrat family
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NTFS ADS 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\C0D3X17 (123).rar"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:240
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4896
    • C:\Users\Admin\Desktop\C0D3X17\C0D3X17-NUKER.exe
      "C:\Users\Admin\Desktop\C0D3X17\C0D3X17-NUKER.exe"
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3152
      • C:\Users\Admin\AppData\Roaming\rundl32.exe
        "C:\Users\Admin\AppData\Roaming\rundl32.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2984
      • C:\Users\Admin\AppData\Roaming\Stable_Network.exe
        "C:\Users\Admin\AppData\Roaming\Stable_Network.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • NTFS ADS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1152
        • C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
          C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1364
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4884
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
            4⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:1312
      • C:\Users\Admin\AppData\Local\Temp\host.exe
        "C:\Users\Admin\AppData\Local\Temp\host.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3300
        • C:\ProgramData\GameSDK.exe
          "C:\ProgramData\GameSDK.exe"
          3⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4080
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall add allowedprogram "C:\ProgramData\GameSDK.exe" "GameSDK.exe" ENABLE
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:2772
      • C:\Users\Admin\AppData\Local\Temp\system.dll.exe
        "C:\Users\Admin\AppData\Local\Temp\system.dll.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:1148
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\mbbdNBRQQE.ps1""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3008
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\mbbdNBRQQE.ps1"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1784
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tsmmdbix\tsmmdbix.cmdline"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4172
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5B8.tmp" "c:\Users\Admin\AppData\Local\Temp\tsmmdbix\CSC6E0043B747464514BC89BAF4674A980.TMP"
                6⤵
                  PID:4260
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "C:\Users\Admin\AppData\Local\Temp\mbbdNBRQQE.ps1"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4600

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\32.exe

        Filesize

        7.4MB

        MD5

        f71859e5750415fb32eb045e58635cae

        SHA1

        fa70d2a35caeb0c12214775cad8cdd8ff0583b59

        SHA256

        8d668f74825fd8cf5809d9c63e36084bd04d672585fb1f5cdda429e052b8488e

        SHA512

        423bc36ec4d2b811aa54685a70d5b9daad21d31e95759b1437b7b1966bcdd05d322a76c4288dc647b35bd4b1f6acc0c692fa4ba365715e55671da4edef65df1f

      • C:\Users\Admin\AppData\Local\Temp\64.exe

        Filesize

        8.4MB

        MD5

        4f19535079b64da77ce91d429cfbcfdc

        SHA1

        68b4d4679024111b246c45328db9478f3a67a709

        SHA256

        fc02c6319cc5b32536a4b1773a5aba82c213fed6de3249d117b2c8ffe5c82b58

        SHA512

        fcea894e6a00384c4af0d5abd8143a72b122c6e3052b602ee4a150c89b538e4ac5f76dcbc01770548dba6ef67dd13420450d368bfb42ddcf4fd11995181382dc

      • C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt

        Filesize

        722KB

        MD5

        43141e85e7c36e31b52b22ab94d5e574

        SHA1

        cfd7079a9b268d84b856dc668edbb9ab9ef35312

        SHA256

        ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d

        SHA512

        9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc

      • C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt

        Filesize

        14.6MB

        MD5

        053bd8fa3b586bd5b8ee60970c6cae44

        SHA1

        ada9b5270e7025a5438bc0066f68286243db15c7

        SHA256

        e0e342cd6302970770d542d516a02a445c13f1f6a77799342ced658ca4e3f8ad

        SHA512

        0bc717c9bc09ee019662ee3cee795ad5510981d36ca706872f776385b4b98826768c5a5136e592e997383690a0d1634d72d4462a05120550a6e5a3295e5a587c

      • C:\Users\Admin\AppData\Local\Temp\RES5B8.tmp

        Filesize

        1KB

        MD5

        c3c8d641302403f541d6ef45d75dbd88

        SHA1

        864977fb0d36dc101375e0237fdd4497272a6f64

        SHA256

        582118bfef3225e2a1de5cb18bb315fe52161f407c24b36e5374929f61b61fac

        SHA512

        0008ead63ea7f81f4fa77e00377fa0aa2420c1fb01603c5c3c338be5188a559e436f18f4c83068c28c858b5522810ccfc81e386133384205c56e3043e6b7cb21

      • C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml

        Filesize

        2KB

        MD5

        46f2f154060d639b1f5f1ceb47ba9574

        SHA1

        6bdee2c266f48415b9d580801fea16a9d43faa25

        SHA256

        a08b36bde4948ac2878d5aaaad2e2cacf0ed2b1fde097b9c6ae2d777843b1d4f

        SHA512

        752e3042d9e3b50748d4075aca84ab61a975dad6be1d5c1ef6d807e8933048e75221ea0babf935b1aee778bad3f51374ca3984418cb4587d5f2e1de45b07f7a1

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0l4cbb4p.5ka.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\host.exe

        Filesize

        22KB

        MD5

        1b6c329b64a9d5a8b37db35c6ab08d81

        SHA1

        9d233019f811dc56810102889838e5087a1f18b1

        SHA256

        4cc11297a2bd2f4d4cbbb8ed3123e46db325a0808a29499897c34e3e49d392f9

        SHA512

        df80242f2e33269c6cbdfef39460fcfb3f5b44c1f7463c8c897813c9ad2f828769e486469e948dbcd6378791c2917ac8f39cabb38a797207cc55e4cfee794fe7

      • C:\Users\Admin\AppData\Local\Temp\mbbdNBRQQE.ps1

        Filesize

        380B

        MD5

        cbb9a56c9c8d7c3494b508934ace0b98

        SHA1

        e76539db673cc1751864166494d4d3d1761cb117

        SHA256

        027703af742d779f4dcde399ac49a3334f1b9e51b199215203e1f4b5e3251fe5

        SHA512

        f71e0a521c2b0aa034e0a2c9f0efd7d813d8408d118979f8e05ecd3aa6fb94c67793e2302ed9455aad9a63d43a53fa1ac2b3d45f7bdfa1cc8104c9a9ace84129

      • C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node

        Filesize

        1.8MB

        MD5

        66a65322c9d362a23cf3d3f7735d5430

        SHA1

        ed59f3e4b0b16b759b866ef7293d26a1512b952e

        SHA256

        f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c

        SHA512

        0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21

      • C:\Users\Admin\AppData\Local\Temp\system.dll.exe

        Filesize

        37.2MB

        MD5

        fe7289489248263aa30870bb95892163

        SHA1

        c5f853974f90c6f032d7119eae24a811dd4a55af

        SHA256

        8f41b4f16a02cf70f620b3f9cc8d11eb3d97707eb8d50f418789628ad77c4bf9

        SHA512

        aebcec7967744dab0f605e349d396a8e397b7e36f9d5f80c38f6caf08f2cf45edb7ab873cfee59082ad7f54bb4b092593c434e1755ec3ca13d8273b734e4c0bc

      • C:\Users\Admin\AppData\Local\Temp\tsmmdbix\tsmmdbix.dll

        Filesize

        3KB

        MD5

        3c0c52b8595c65b3572f437ed55c406f

        SHA1

        a77ae253134866607bc602b65d03f605194a70e9

        SHA256

        7e34bba6c6c85030a07076880ea4dc1033be67cde7a93a3a337121347fcd5828

        SHA512

        f8fc290f5fd62610da84bcc612e46ac2a4f33e1a9ad3b823373556e6b70e0403403927d84c04b786b259bf6a0cd9e4ba3ed578ecba6dec394b67cbeb45960cdf

      • C:\Users\Admin\AppData\Roaming\Stable_Network.exe

        Filesize

        15.9MB

        MD5

        a1a51313f8d07d2eb4ca0123108094e1

        SHA1

        4024e60d52e4c992596b73cb205ea7b4a1a91ae0

        SHA256

        8753515f422c81bf9bf921d9857f5f7ee0b3f47573e84129092e095147eebd63

        SHA512

        3a43cdaae6d988f935f4092d5a9a4eb3cf2f2230d438858a3dc24eec6b050c21c1844f899b60fc69ed3d34b76f2f4057b82e8730f149b0103628af7219392e4d

      • C:\Users\Admin\AppData\Roaming\rundl32.exe

        Filesize

        32KB

        MD5

        c51af2c2a47ba5716ba57939bbe28b5d

        SHA1

        3e7294cba2e81cec02b5c18db9c8e6b6fdea60a6

        SHA256

        52055979386ff9f81bceaa8a2a2e2be3f0f78e74097bf34b7c7aa8bd0cd01033

        SHA512

        0f0e9dcd7eb85820e4be8a19cc471b8599c1b69e2750b528e88e8fd508bd994a382f4fdd10850f74966732c6e46a48ec92c9155c1bb516a2e94de70494ade28a

      • C:\Users\Admin\Desktop\C0D3X17\C0D3X17-NUKER.exe

        Filesize

        37.5MB

        MD5

        1723589503194e30504ab703f55b70fd

        SHA1

        1a74dcf5d737dd91bdeee28859c5d44506be9b16

        SHA256

        60600f983d15d7313292ae4f84daf1a97fc627bc3f70f5b854004fda492cdc7f

        SHA512

        7f457e68ab252a22c209c261ad5a97c2b3770fe73fbee1463aeb4d94b8f779344ae99ac019cdc099feda1441256d134674e236744799f9ec7dc065ed1637db93

      • \??\c:\Users\Admin\AppData\Local\Temp\tsmmdbix\CSC6E0043B747464514BC89BAF4674A980.TMP

        Filesize

        652B

        MD5

        2219f2985061e0310ddd241ebc74e55e

        SHA1

        822fb386a324ff75de9a7528c3a0006d2435f506

        SHA256

        64b9e45a9b9c8e86a92aa882d2f66ec542c8a54e8194aab0ae174d21df4137a6

        SHA512

        4ec35cfd457831939ff335a9e659a27a7b3e1932c3987d52304dfc693288ca82d944e614339da3e97abd9eb033285bc28de06e6a1fa930ab135e7f8bdff7d871

      • \??\c:\Users\Admin\AppData\Local\Temp\tsmmdbix\tsmmdbix.0.cs

        Filesize

        312B

        MD5

        ecbf151f81ff98f7dff196304a40239e

        SHA1

        ccf6b97b6f8276656b042d64f0595963fe9ec79c

        SHA256

        295ca195631c485c876e7c468ddcbb3fe7cd219d3e5005a2441be2de54e62ac8

        SHA512

        4526a59055a18af6c0c13fb9f55a9a9bc15aa1407b697849e19b6cc32c88ee7206b3efff806bd154d36bce144ae1d9c407c6ea0f5077c54fbe92cd172c203720

      • \??\c:\Users\Admin\AppData\Local\Temp\tsmmdbix\tsmmdbix.cmdline

        Filesize

        369B

        MD5

        39393a54f82f682c3c4d0be91be40eca

        SHA1

        74f23a58cec176c451e2aab0603751ddcd6102e7

        SHA256

        99718da87f03cfdfa4a3f04609d37a1b3f42ef71ae68489c3c5833f3c6ca2445

        SHA512

        3e870a39e67c39cd05b1a64f3e55062fff5561e9d86d7ec781aae3d19c7fed2849c06047b3999b13dc6c3c6ca790eb4b765b6a27a8c4ea22b6390f62a9c840b3

      • memory/1784-178-0x000001FBB6360000-0x000001FBB6368000-memory.dmp

        Filesize

        32KB

      • memory/1784-164-0x000001FBB6370000-0x000001FBB6392000-memory.dmp

        Filesize

        136KB

      • memory/2984-23-0x0000000000A40000-0x0000000000A4E000-memory.dmp

        Filesize

        56KB

      • memory/3152-9-0x0000000075050000-0x0000000075601000-memory.dmp

        Filesize

        5.7MB

      • memory/3152-7-0x0000000075050000-0x0000000075601000-memory.dmp

        Filesize

        5.7MB

      • memory/3152-67-0x0000000075050000-0x0000000075601000-memory.dmp

        Filesize

        5.7MB

      • memory/3152-6-0x0000000075052000-0x0000000075053000-memory.dmp

        Filesize

        4KB

      • memory/4600-198-0x000001B88BE20000-0x000001B88BE58000-memory.dmp

        Filesize

        224KB

      • memory/4600-199-0x000001B8A87F0000-0x000001B8A883A000-memory.dmp

        Filesize

        296KB

      • memory/4600-200-0x000001B8A64C0000-0x000001B8A64CE000-memory.dmp

        Filesize

        56KB

      • memory/4600-201-0x000001B8A87B0000-0x000001B8A87E8000-memory.dmp

        Filesize

        224KB

      • memory/4600-206-0x000001B8A8790000-0x000001B8A8798000-memory.dmp

        Filesize

        32KB

      • memory/4600-216-0x000001B8A8A60000-0x000001B8A8A68000-memory.dmp

        Filesize

        32KB

      • memory/4600-217-0x000001B8A8A70000-0x000001B8A8A78000-memory.dmp

        Filesize

        32KB

      • memory/4600-218-0x000001B8A7E50000-0x000001B8A7E58000-memory.dmp

        Filesize

        32KB

      • memory/4600-219-0x000001B8A8D00000-0x000001B8A8D26000-memory.dmp

        Filesize

        152KB