Extracted

Extracted

• • Target
    20261022_3546MV BEE GW PIPES.hta
  • Size 2KB
  • SHA256 9e32a6a856241cfb46d230edf27035cf1d85a2ecbb594dda0241b80b08143b1f
  • MD5 ed95538313eca249f41ffe3bb33c2144
  • SHA1 4c515211ba9c726b9038c4678e71a8fddf0e1051
  • SHA512 58561ab5e8e04a23dd4801e53fc0ad38abf3256b083275db9488c72c01fec1a78e139b232a2195d4fbf60edd04aa2f8170f331dd979da98115bf07cab6396337
  • TLSH
    T14241F44363EE0504A2F31B8DA97361750BB7BE46593C8A9C04DC690D8FE3E558862BF3
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Suspicious use of SetThreadContext

  behavioral1behavioral2