Extracted

• • Target
    order confirmation.js
  • Size 343KB
  • SHA256 1f79f7239d6f8cd9224064830720909884f98b989c1d7d01d90a3de686f02641
  • MD5 4b1f73a57a3620ad05115b3db400aa8a
  • SHA1 7572107528b811fda4cfc165a473c3775e22298f
  • SHA512 77231207038288e396ba063d830af76b081a0f3f37c40e7e2b35a6e3d34fbbbf29c1da7bfe920615de1df7ce60add6907848030a6e0d6b9bfab2bb0262432581
  • SSDEEP 6144:WXOYjBzgMKEgkUldni7GLxWwEjtEVT0oLd6a8NBiYsjBLUsuLRxZtuze8af2Ulv:W9NgexEdLd4fi1jNUTHJlv
  • TLSH
    T142749F169B05AAC8347DDB88F8C6C35A832B23335DFF454B610177C34A7A6257FE819A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2