cbd527d1dbfef781aaa1d1ef6c8c5a0edd32658a230c58d504d00037cf0fcb78

Analysis

Target

En la presente fecha el juzgado citante notifica el auto admisorio de la demanda proferido dentro de.vbs
Size

827B
MD5

d514951376914b9a27c6224acf10795e
SHA1

dcdb8f2c70372d5104ab1ee68e6f23c767a88a1b
SHA256

cbd527d1dbfef781aaa1d1ef6c8c5a0edd32658a230c58d504d00037cf0fcb78
SHA512

f69ba8b7921aadc8032578a5f7e7515bebc0377a513cad099575fbee543df6ede19659853aa728ef514a835a9737b8417af16e80cf914cd7afdbc1302d75d03e

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

9 1736 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1736 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1736 powershell.exe

flow	pid	process
9	1736	powershell.exe

pid	process
1736	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1736	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 1664 wrote to memory of 1736	1664	WScript.exe	powershell.exe
PID 1664 wrote to memory of 1736	1664	WScript.exe	powershell.exe
PID 1664 wrote to memory of 1736	1664	WScript.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\En la presente fecha el juzgado citante notifica el auto admisorio de la demanda proferido dentro de.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1664-52-0x000007FEFC2A1000-0x000007FEFC2A3000-memory.dmp

Filesize
8KB

Download
memory/1736-53-0x0000000000000000-mapping.dmp

Download
memory/1736-55-0x000007FEF36F0000-0x000007FEF424D000-memory.dmp

Filesize
11.4MB

Download
memory/1736-58-0x0000000002644000-0x0000000002647000-memory.dmp

Filesize
12KB

Download
memory/1736-57-0x0000000002642000-0x0000000002644000-memory.dmp

Filesize
8KB

Download
memory/1736-56-0x0000000002640000-0x0000000002642000-memory.dmp

Filesize
8KB

Download
memory/1736-59-0x000000000264B000-0x000000000266A000-memory.dmp

Filesize
124KB

Download