Extracted

• • Target
    ORDEN DE COMPRA COPR0008041 LANCETAHG.js
  • Size 210KB
  • SHA256 3a7d3c12127e6ee45b1aca51dda931150a99c13069c4a21e151d125ef4e444a5
  • MD5 96f9c0324e7400575f196be288fbfd45
  • SHA1 a4b55ba19612071e611cf7b4a165f0330a7b03b6
  • SHA512 458a627582894c19e98a1cf3837dbe0b2c97dcdf394c56b14fca9a921682d16bb4ccd92022cc5cbd0dd4f1a44c431c7688e9ffecf9b6a0cac382c61e21b71b25
  • SSDEEP 3072:dAEejWVtltpF5+Px4MFPgX+Bt7Xc6pGahQ8tIJqv30irJrEgRd:dH0Az3F5+PxxgXA5craSlgvkCrjz
  • TLSH
    T157244B2C03F4349EE2485EE8050F3387A4E5B9F259288D41AA75C7EFB5065BB8C79DD8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2