Analysis
- max time kernel
40s - max time network
42s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 00:24
Static task
static1
Behavioral task
behavioral1
Sample
38aba4040537b20450e78092d79b4a9bd92eab8814842d6ecd1cad93e8f6a6ab.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
38aba4040537b20450e78092d79b4a9bd92eab8814842d6ecd1cad93e8f6a6ab.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target 38aba4040537b20450e78092d79b4a9bd92eab8814842d6ecd1cad93e8f6a6ab.js
- Size 13.5MB
- Sample260819-ap437sbm51
- SHA256 38aba4040537b20450e78092d79b4a9bd92eab8814842d6ecd1cad93e8f6a6ab
- MD5 05907edac4616717ee10ec7aea10b92d
- SHA1 567d2a06a7876d8cdbb79ffa8879201f18efd906
- SHA512 3cdb89400dba300c67188e4c165efeaa294251c8d9b394dffa165072970a4a5be0d9bca15f736b7c10cf2def6486250691b6c540fb2a38a6b4b33f27d6e3aa93
- SSDEEP 49152:ZIq84RMqp0kRxIie/kCzVGfRTEMTcW/Kqr32uixx3C3MedmAn5Q8C65TC+U1Fqsn:K
- TLSH T192E6C081F83C55CACAAEDD455273E9CE61E1C842E97C4C7CBD496A0A472FB0E1A94F0D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2340 WMIC.exe 2340 WMIC.exe 2340 WMIC.exe 2340 WMIC.exe 4220 WMIC.exe 4220 WMIC.exe 4220 WMIC.exe 4220 WMIC.exe 4752 WMIC.exe 4752 WMIC.exe 4752 WMIC.exe 4752 WMIC.exe 4216 WMIC.exe 4216 WMIC.exe 4216 WMIC.exe 4216 WMIC.exe 364 WMIC.exe 364 WMIC.exe 364 WMIC.exe 364 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2340 WMIC.exe Token: SeSecurityPrivilege 2340 WMIC.exe Token: SeTakeOwnershipPrivilege 2340 WMIC.exe Token: SeLoadDriverPrivilege 2340 WMIC.exe Token: SeSystemProfilePrivilege 2340 WMIC.exe Token: SeSystemtimePrivilege 2340 WMIC.exe Token: SeProfSingleProcessPrivilege 2340 WMIC.exe Token: SeIncBasePriorityPrivilege 2340 WMIC.exe Token: SeCreatePagefilePrivilege 2340 WMIC.exe Token: SeBackupPrivilege 2340 WMIC.exe Token: SeRestorePrivilege 2340 WMIC.exe Token: SeShutdownPrivilege 2340 WMIC.exe Token: SeDebugPrivilege 2340 WMIC.exe Token: SeSystemEnvironmentPrivilege 2340 WMIC.exe Token: SeRemoteShutdownPrivilege 2340 WMIC.exe Token: SeUndockPrivilege 2340 WMIC.exe Token: SeManageVolumePrivilege 2340 WMIC.exe Token: 33 2340 WMIC.exe Token: 34 2340 WMIC.exe Token: 35 2340 WMIC.exe Token: 36 2340 WMIC.exe Token: SeIncreaseQuotaPrivilege 2340 WMIC.exe Token: SeSecurityPrivilege 2340 WMIC.exe Token: SeTakeOwnershipPrivilege 2340 WMIC.exe Token: SeLoadDriverPrivilege 2340 WMIC.exe Token: SeSystemProfilePrivilege 2340 WMIC.exe Token: SeSystemtimePrivilege 2340 WMIC.exe Token: SeProfSingleProcessPrivilege 2340 WMIC.exe Token: SeIncBasePriorityPrivilege 2340 WMIC.exe Token: SeCreatePagefilePrivilege 2340 WMIC.exe Token: SeBackupPrivilege 2340 WMIC.exe Token: SeRestorePrivilege 2340 WMIC.exe Token: SeShutdownPrivilege 2340 WMIC.exe Token: SeDebugPrivilege 2340 WMIC.exe Token: SeSystemEnvironmentPrivilege 2340 WMIC.exe Token: SeRemoteShutdownPrivilege 2340 WMIC.exe Token: SeUndockPrivilege 2340 WMIC.exe Token: SeManageVolumePrivilege 2340 WMIC.exe Token: 33 2340 WMIC.exe Token: 34 2340 WMIC.exe Token: 35 2340 WMIC.exe Token: 36 2340 WMIC.exe Token: SeIncreaseQuotaPrivilege 4220 WMIC.exe Token: SeSecurityPrivilege 4220 WMIC.exe Token: SeTakeOwnershipPrivilege 4220 WMIC.exe Token: SeLoadDriverPrivilege 4220 WMIC.exe Token: SeSystemProfilePrivilege 4220 WMIC.exe Token: SeSystemtimePrivilege 4220 WMIC.exe Token: SeProfSingleProcessPrivilege 4220 WMIC.exe Token: SeIncBasePriorityPrivilege 4220 WMIC.exe Token: SeCreatePagefilePrivilege 4220 WMIC.exe Token: SeBackupPrivilege 4220 WMIC.exe Token: SeRestorePrivilege 4220 WMIC.exe Token: SeShutdownPrivilege 4220 WMIC.exe Token: SeDebugPrivilege 4220 WMIC.exe Token: SeSystemEnvironmentPrivilege 4220 WMIC.exe Token: SeRemoteShutdownPrivilege 4220 WMIC.exe Token: SeUndockPrivilege 4220 WMIC.exe Token: SeManageVolumePrivilege 4220 WMIC.exe Token: 33 4220 WMIC.exe Token: 34 4220 WMIC.exe Token: 35 4220 WMIC.exe Token: 36 4220 WMIC.exe Token: SeIncreaseQuotaPrivilege 4220 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2956 wrote to memory of 1472 2956 wscript.exe 90 PID 2956 wrote to memory of 2340 2956 wscript.exe 92 PID 2956 wrote to memory of 4220 2956 wscript.exe 95 PID 2956 wrote to memory of 4752 2956 wscript.exe 97 PID 2956 wrote to memory of 4216 2956 wscript.exe 99 PID 2956 wrote to memory of 364 2956 wscript.exe 101 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1472 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\38aba4040537b20450e78092d79b4a9bd92eab8814842d6ecd1cad93e8f6a6ab.js1⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\sucupeh"2⤵
- Views/modifies file attributes
PID:1472
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\sucupeh"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4220
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4752
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4216
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:364
-