Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/05/2026, 13:40
General
- Target Official Signed Contract and Agreement Document..js
- Size 709KB
- Sample260520-qyl7raey5w
- SHA256 299d8622520c2dac8b4a77285bbce6d4bdef55f58c96b59b0adfeb85d30e21c8
Malware Config
Extracted
-
xworm
-
XWorm V7.1
-
worksodsirius.ydns.eu:4449
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Official Signed Contract and Agreement Document..js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "PhotoStudioJS" /xml "C:\Users\Admin\AppData\Local\Temp\Task_10552.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\Users\Admin\AppData\Local\Microsoft\Windows\00000000-fec5eff7-7ecddd63e5f0\Interface_LIB.ps1'"2⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Interface_LIB.ps1
Task_10552.xml
__PSScriptPolicyTest_khuwslw0.0su.ps1
memory/3312-31-0x00000000052A0000-0x00000000052AA000-memory.dmp
memory/3312-30-0x0000000005AC0000-0x0000000005B52000-memory.dmp
memory/3312-29-0x0000000005310000-0x00000000058B4000-memory.dmp
memory/3312-28-0x0000000004B90000-0x0000000004C2C000-memory.dmp
memory/3312-25-0x0000000000370000-0x0000000000386000-memory.dmp
memory/4020-9-0x0000000005870000-0x0000000005892000-memory.dmp
memory/4020-12-0x0000000006210000-0x0000000006564000-memory.dmp
memory/4020-20-0x00000000067F0000-0x000000000680E000-memory.dmp
memory/4020-21-0x0000000006880000-0x00000000068CC000-memory.dmp
memory/4020-11-0x00000000060C0000-0x0000000006126000-memory.dmp
memory/4020-23-0x0000000006CA0000-0x0000000006CB6000-memory.dmp
memory/4020-24-0x0000000006CB0000-0x0000000006CB8000-memory.dmp
memory/4020-10-0x0000000005A10000-0x0000000005A76000-memory.dmp
memory/4020-8-0x0000000005A90000-0x00000000060B8000-memory.dmp
memory/4020-7-0x00000000033C0000-0x00000000033D0000-memory.dmp
memory/4020-6-0x0000000002EE0000-0x0000000002F16000-memory.dmp
memory/4020-5-0x00000000033C0000-0x00000000033D0000-memory.dmp