Extracted

• • Target
    Orden de compra_087858_xls.vbs
  • Size 159KB
  • SHA256 9668dc70ea30a8ea0025cc0d1b75d65df3548dd661ca36d4622fba07dea739e9
  • MD5 1819ade993ac67569ddf622833c5987b
  • SHA1 f32b87bce8126bd5ee77883b8145ecdfbd968109
  • SHA512 929d621595918accbec40e5e0da87e490617be1ff810c0f7bc7af54a40f70cfe1244b60c7d46088f8f4fa2e65130a453bc37a8015f6e7d372c544359e8bec23f
  • SSDEEP 768:aZ3mAZkBZxsQJcVrIgDDHBqEeCrnvPxi/eHRJFpMQJGOE97:q2AZKs0gD0eHRJF+Q8
  • TLSH
    T17DF33D3D0E3A0F9D52F15D6C908E53FA6E6B526DE0F9467DC8AA324997B340235A03CD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionpersistenceprivilege_escalation

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2