Extracted

• • Target
    wegivenbestthinkgsformebest.hta
  • Size 607KB
  • SHA256 a5f613f5f0f3cd8a5d88779067cb1d1e8f9fb28d7e3b2a78b44f2ad0f96f5e86
  • MD5 5bfc0f8b172c57bb87ec059a1d585a38
  • SHA1 9fb462fddd38064d525a2fc23a395bd20dcada6b
  • SHA512 142f180309f1d9e880bdf4cc0a9ef68ba23d37e0e3df7ece5b9d0591ed72c59e55e3258a67d98bc93681ccd779efd61211d881c69d1eef02a560ec22730cc492
  • SSDEEP 768:kPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPeS4sPPPPPPP8:F9
  • TLSH
    T170D4A24CA91E1A7C09FBAC7BDDB46C4B2682D0C789573079F5179ACB85299CDBDC2302
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2