Extracted

• • Target
    Orden de compra_93938387.js
  • Size 285KB
  • SHA256 1169f4fe3eea997dfd820ef78c1bb0acea3398fb3bd062beac21d3882691f9b0
  • MD5 41cb45538a4175b01503d96edeee3671
  • SHA1 b2c69f764f19b1be1a976e95e756ab33e0e25f4d
  • SHA512 b837b890c05f35ce75fe3b8912cc3e3981755908f974e7e770d4f4c8825ef65147674a4fc03b57394c7e407ce5bcd20c5b023be688ca66d7cff463e75b0e3aa2
  • SSDEEP 1536:2YLlPwIR28KGhSDEZYAFFxmMidPFkG80dTKTReUJVJWyWqpg8CKu8klKpH2rcTzm:fc87PDpz+Rwj83f
  • TLSH
    T1FA54ED5603550B7DF78D5EC5887E201B34F5E826B92412A8EFB76AE7BC3FC849034629
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistencerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2