Analysis
- max time kernel
40s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 23:24
Static task
static1
Behavioral task
behavioral1
Sample
dca8e83d1832f812ebd64d36671ebea1746f637bd2be51e020f1d9d5375c5f9a.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
dca8e83d1832f812ebd64d36671ebea1746f637bd2be51e020f1d9d5375c5f9a.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target dca8e83d1832f812ebd64d36671ebea1746f637bd2be51e020f1d9d5375c5f9a.js
- Size 13.5MB
- Sample260818-3dqqnaca22
- SHA256 dca8e83d1832f812ebd64d36671ebea1746f637bd2be51e020f1d9d5375c5f9a
- MD5 429449436b9e8b0ec3ba596895f1166e
- SHA1 03351f66987c6632a7916e067a5a5c4bef3b9679
- SHA512 7e074be02ce5e05fdbf28a409868523fb31fd96aa38d73f770ce7edf5fe3d72715da2ad96d16343ccca749531d74eb3a6ee8652cd07d52a088e51fafd9acbbd9
- SSDEEP 49152:77nm3A6P6NBDHVngYo+/2Bi11P71nQLhko8+Spn1cRrBtnSr3fvvoU4ohnc7pkJP:T
- TLSH T12BE6D016958AE3C673DD4AA045500DBF54D0DEA7A4708E8873162C9BBCB2DF3B21876F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2008 WMIC.exe 2008 WMIC.exe 2008 WMIC.exe 2008 WMIC.exe 4532 WMIC.exe 4532 WMIC.exe 4532 WMIC.exe 4532 WMIC.exe 3304 WMIC.exe 3304 WMIC.exe 3304 WMIC.exe 3304 WMIC.exe 4704 WMIC.exe 4704 WMIC.exe 4704 WMIC.exe 4704 WMIC.exe 52 WMIC.exe 52 WMIC.exe 52 WMIC.exe 52 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2008 WMIC.exe Token: SeSecurityPrivilege 2008 WMIC.exe Token: SeTakeOwnershipPrivilege 2008 WMIC.exe Token: SeLoadDriverPrivilege 2008 WMIC.exe Token: SeSystemProfilePrivilege 2008 WMIC.exe Token: SeSystemtimePrivilege 2008 WMIC.exe Token: SeProfSingleProcessPrivilege 2008 WMIC.exe Token: SeIncBasePriorityPrivilege 2008 WMIC.exe Token: SeCreatePagefilePrivilege 2008 WMIC.exe Token: SeBackupPrivilege 2008 WMIC.exe Token: SeRestorePrivilege 2008 WMIC.exe Token: SeShutdownPrivilege 2008 WMIC.exe Token: SeDebugPrivilege 2008 WMIC.exe Token: SeSystemEnvironmentPrivilege 2008 WMIC.exe Token: SeRemoteShutdownPrivilege 2008 WMIC.exe Token: SeUndockPrivilege 2008 WMIC.exe Token: SeManageVolumePrivilege 2008 WMIC.exe Token: 33 2008 WMIC.exe Token: 34 2008 WMIC.exe Token: 35 2008 WMIC.exe Token: 36 2008 WMIC.exe Token: SeIncreaseQuotaPrivilege 2008 WMIC.exe Token: SeSecurityPrivilege 2008 WMIC.exe Token: SeTakeOwnershipPrivilege 2008 WMIC.exe Token: SeLoadDriverPrivilege 2008 WMIC.exe Token: SeSystemProfilePrivilege 2008 WMIC.exe Token: SeSystemtimePrivilege 2008 WMIC.exe Token: SeProfSingleProcessPrivilege 2008 WMIC.exe Token: SeIncBasePriorityPrivilege 2008 WMIC.exe Token: SeCreatePagefilePrivilege 2008 WMIC.exe Token: SeBackupPrivilege 2008 WMIC.exe Token: SeRestorePrivilege 2008 WMIC.exe Token: SeShutdownPrivilege 2008 WMIC.exe Token: SeDebugPrivilege 2008 WMIC.exe Token: SeSystemEnvironmentPrivilege 2008 WMIC.exe Token: SeRemoteShutdownPrivilege 2008 WMIC.exe Token: SeUndockPrivilege 2008 WMIC.exe Token: SeManageVolumePrivilege 2008 WMIC.exe Token: 33 2008 WMIC.exe Token: 34 2008 WMIC.exe Token: 35 2008 WMIC.exe Token: 36 2008 WMIC.exe Token: SeIncreaseQuotaPrivilege 4532 WMIC.exe Token: SeSecurityPrivilege 4532 WMIC.exe Token: SeTakeOwnershipPrivilege 4532 WMIC.exe Token: SeLoadDriverPrivilege 4532 WMIC.exe Token: SeSystemProfilePrivilege 4532 WMIC.exe Token: SeSystemtimePrivilege 4532 WMIC.exe Token: SeProfSingleProcessPrivilege 4532 WMIC.exe Token: SeIncBasePriorityPrivilege 4532 WMIC.exe Token: SeCreatePagefilePrivilege 4532 WMIC.exe Token: SeBackupPrivilege 4532 WMIC.exe Token: SeRestorePrivilege 4532 WMIC.exe Token: SeShutdownPrivilege 4532 WMIC.exe Token: SeDebugPrivilege 4532 WMIC.exe Token: SeSystemEnvironmentPrivilege 4532 WMIC.exe Token: SeRemoteShutdownPrivilege 4532 WMIC.exe Token: SeUndockPrivilege 4532 WMIC.exe Token: SeManageVolumePrivilege 4532 WMIC.exe Token: 33 4532 WMIC.exe Token: 34 4532 WMIC.exe Token: 35 4532 WMIC.exe Token: 36 4532 WMIC.exe Token: SeIncreaseQuotaPrivilege 4532 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3504 wrote to memory of 4272 3504 wscript.exe 90 PID 3504 wrote to memory of 2008 3504 wscript.exe 92 PID 3504 wrote to memory of 4532 3504 wscript.exe 95 PID 3504 wrote to memory of 3304 3504 wscript.exe 97 PID 3504 wrote to memory of 4704 3504 wscript.exe 99 PID 3504 wrote to memory of 52 3504 wscript.exe 101 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4272 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\dca8e83d1832f812ebd64d36671ebea1746f637bd2be51e020f1d9d5375c5f9a.js1⤵
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\segipun"2⤵
- Views/modifies file attributes
PID:4272
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\segipun"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4532
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3304
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4704
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:52
-