Extracted

• • Target
    квитанция об оплате.hta
  • Size 34KB
  • SHA256 699ddd8e611614da320ae0f0394041a50c9ed8784e440d5dd4cdcc01c336df12
  • MD5 784427e8445b47fd71ce41667f300e86
  • SHA1 852fa3734d31fb99a3bff500da6a74adaedf9c71
  • SHA512 1611f205321c864e3ad0b28d59b73f80f31c5de2fd85a3fde769a2a73f5cc2469a0827f2a7015af5570377a0876ed5b73e790580a158d79e7630bc1dcc539f18
  • SSDEEP 384:FI01ehOsuDSw59V1S15e95lQwtdNQ7f88OC76q1x:FI01eIsuDS0K15e95lDDQ7f88OC76q1x
  • TLSH
    T1A7F2A7751F23C9A1EBA073BDC42F5B224DE1D05241190CE66D9AC3DB6EAD892D7B2370
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionadwarexwormpersistenceransomwareratspywaretrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2