Extracted

• • Target
    Orden de Compra.js
  • Size 1.1MB
  • SHA256 3e8faf7f4ef7d73b8fd5f29caa963eb18c1925ec40a1b3b1893b3357617dadbb
  • MD5 c3192d566a214008cdc6b06b6e19c607
  • SHA1 bede2a3987977b8e3ecdf0752a0b37e5ef0f7f12
  • SHA512 1d0265bd97fbe6c5dfa680c02c74ac8562d1e1b4e53ec87e1e019dbc5798be524a47ebf9cfd2c6213c0be393e8be24c0015cbbba5bb0c4a9363be7579fb02620
  • SSDEEP 768:A6J+U+bw0wKfbOCHAixdUJQA+G+S+30rMKZP/nr7N5gizafL8+qqBKwht9eT2vgB:W2
  • TLSH
    T11F355E321A0445BCD7EE410DB8A0D159AA72D339ECF33D20BA541F5EDAB70C993EA359
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionpersistenceprivilege_escalation

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2