Extracted

• • Target
    PUR012908.vbs
  • Size 817KB
  • SHA256 18e524fb9be61b8e8408eae149c3512584c3185bcc7d4ba77bcf591edf4b8612
  • MD5 d6a3dfc7aed72bbf5f310f98f3c37667
  • SHA1 9f4cd7ce52dee3d751a019b84acb0c055ec87c5b
  • SHA512 fffa61c146451b45fa2abb041337998184f80b56dced6989b00f4d92cfa5c5015e58f7703f9a647b06365a8635ca0a10e0528a511aba563b2d6793b2f471a1f3
  • SSDEEP 192:kynrMKGYpaclNBLKTN+9qPRSIyDyi7erWpacN7NykSMFBAaprqfFDHNPvKGAuxL:FYpgSZoW
  • TLSH
    T1BE0562995F256D7F2A1C1E0728B66C8814A63C943FB34D8F750E4D248606BE46EF34AF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executiondiscoveryxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2