1099a2b68b2ad1e548646cb81fd37a236bd0476b5036f33416831e74a14d1e8f

Analysis

max time kernel
147s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:43

Target

785858Ord_Citacion022555Investigativa_DelitosdsxdkgfInternacionalesXOQVGP.zip
Size

2.3MB
MD5

43f008e55da1461922d6374ee0f25330
SHA1

c1ef8c6619ce86642c560010e117b703b798a586
SHA256

1099a2b68b2ad1e548646cb81fd37a236bd0476b5036f33416831e74a14d1e8f
SHA512

7961935c60076667ef2927736c2a71cb63e2c9e24f4837e3ea50224501504d315f315f1ea2238b145313f1776be9f5504b45942c85cf5cf3e08e628d314fb1db
SSDEEP

49152:i4ufFGQQrzi18xSTuuu/6vAFY2cgYDfRw6UaEhu0RyJqb8uDM:BDOoSoCvGcdVUaf0EQ8uw

Score

8^/10

Blocklisted process makes network request 3 IoCs

Processes:

WScript.exeWScript.exeWScript.exe

flow pid process

27 4976 WScript.exe
29 2356 WScript.exe
37 3488 WScript.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	27	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	29	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	37	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7zG.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zG.exe

pid process

4472 7zG.exe

pid	process
4472	7zG.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\785858Ord_Citacion022555Investigativa_DelitosdsxdkgfInternacionalesXOQVGP.zip
1⤵
PID:4232

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4024

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\785858Ord_Citacion022555Investigativa_DelitosdsxdkgfInternacionalesXOQVGP\273299Citacion102699DelitosxyppyfyInternacionalesPNQSDA.vbs"
1⤵
- Blocklisted process makes network request
PID:4976

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\785858Ord_Citacion022555Investigativa_DelitosdsxdkgfInternacionalesXOQVGP\273299Citacion102699DelitosxyppyfyInternacionalesPNQSDA.vbs"
1⤵
- Blocklisted process makes network request
PID:2356

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\785858Ord_Citacion022555Investigativa_DelitosdsxdkgfInternacionalesXOQVGP\273299Citacion102699DelitosxyppyfyInternacionalesPNQSDA.vbs"
1⤵
- Blocklisted process makes network request
PID:3488

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Documents\Arquivo_C\5-22-2024.txt
1⤵
PID:3208

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Documents\Projeto_B\5-22-2024.txt
1⤵
PID:3792

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Documents\Relatorios_C\5-22-2024.txt
1⤵
PID:2508

C:\Users\Admin\Desktop\785858Ord_Citacion022555Investigativa_DelitosdsxdkgfInternacionalesXOQVGP\273299Citacion102699DelitosxyppyfyInternacionalesPNQSDA.vbs
Filesize
4KB

MD5
a62708122d7c4d9d2d8bb7f2ecf440f7

SHA1
f9ad05722234a718f836cdece780161e77b188a6

SHA256
eda81732c8c97f402eb529cfebb4422d0881d7c752fafe247ffb9d0cb23ea554

SHA512
28a8d2b59ff27798623ebd433a9e10d319324ed2c255334ed1de1faa8e306b04f2241088fab8b162d8e77a372d5e60ad46f71b3a8336517887e7beb4f63ba530

Download Submit