Extracted

• • Target
    Quotation specification items.js
  • Size 540B
  • SHA256 d82a5ada925fd980afb04e7902b9bfb8e23824736eb51256894b3da3a485d942
  • MD5 067f1364a82fc8c115e6e9d1f5c6b9f8
  • SHA1 906efaa1227aec37b0ca4784bf45725cffcbf068
  • SHA512 5761b4d69fa04d9cb5627a9e19d93c481f0d4a88ebb9f66711ca26a23ce8fb9fd153159b14bf7752f48d2bd8dec1b905068bdf1ebd7eb64fa86055d0d2e75fec
  • TLSH
    T1ECF01CD263F4670C72B36B08BA3121A14A777FA5ED38C68C0174191C1AF2E44C9A2B77
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  discoveryexecutionxwormpersistenceprivilege_escalationratspywarestealertrojancollection

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2