Extracted

Extracted

• • Target
    Ordend de Compra OC - 35194.js
  • Size 1.0MB
  • SHA256 e3fc7dd13f96080845cad2edec8e9f75fae22fce3b60e7898cb4ec6421461863
  • MD5 148284fa1b950080c2c5531631f9406c
  • SHA1 ce665fb1df1363b36126e65aace887dca14ef2bb
  • SHA512 54cddc93c3ac0e48b340e958277299b02f7d9de48a4f14da6b0fb4f0056fa19a544c5450c9d4df50127f41e1a23e6e128abfb62a61256588ce4a73e4841a7cbd
  • SSDEEP 12288:m22zL5UfMlE3Gu8EZuwTihcASEh4pBEB4hGjuun9odHf4BSOJqnyk3cRNC13MtvW:D
  • TLSH
    T1D535EAD2FDBC71C9B03D8E0DCD5636412291828632D9083BB9A968D415D3E9B51EEEF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionpersistenceprivilege_escalationdiscoveryxwormrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2