Analysis
- user interaction
yes - max time kernel
298s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 01:08
Static task
static1
Behavioral task
behavioral1
Sample
9d825bca_studio_final_x3.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
9d825bca_studio_final_x3.js
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
6 signatures
300 seconds
General
- Target 9d825bca_studio_final_x3.js
- Size 13.5MB
- Sample260819-bhafpawsbx
- SHA256 951b00329104e1478887898169e968de2c1ccd0a6dce0cf54abc0c4c9d8934a4
- MD5 56e8f08e636abf907dc9629cf9d2a4ab
- SHA1 ed30f6ee09a11f5a41acc236d099f9629c649912
- SHA512 e1427d14c0397c2e6ad34403d6c4537944509cac1b92c93c1a17c9b856858dac802c07a464cdc4f14f7ec59863468390b916cc68f44021574e1bf59f4eb9de0d
- SSDEEP 49152:j+Wj8S537oqDvvMsmdQppMpEPqhS9MmX4KI2EQKTvO+izDJInYUuzHIhEge6K7PR:R
- TLSH T197E6CF329B5EF725ACF5444C0FE24A87C9C8CA10D2919AA3BD766857CD4CDE363E6843
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 5648 WMIC.exe 5648 WMIC.exe 5648 WMIC.exe 5648 WMIC.exe 5864 WMIC.exe 5864 WMIC.exe 5864 WMIC.exe 5864 WMIC.exe 3480 WMIC.exe 3480 WMIC.exe 3480 WMIC.exe 3480 WMIC.exe 5964 WMIC.exe 5964 WMIC.exe 5964 WMIC.exe 5964 WMIC.exe 200 WMIC.exe 200 WMIC.exe 200 WMIC.exe 200 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5648 WMIC.exe Token: SeSecurityPrivilege 5648 WMIC.exe Token: SeTakeOwnershipPrivilege 5648 WMIC.exe Token: SeLoadDriverPrivilege 5648 WMIC.exe Token: SeSystemProfilePrivilege 5648 WMIC.exe Token: SeSystemtimePrivilege 5648 WMIC.exe Token: SeProfSingleProcessPrivilege 5648 WMIC.exe Token: SeIncBasePriorityPrivilege 5648 WMIC.exe Token: SeCreatePagefilePrivilege 5648 WMIC.exe Token: SeBackupPrivilege 5648 WMIC.exe Token: SeRestorePrivilege 5648 WMIC.exe Token: SeShutdownPrivilege 5648 WMIC.exe Token: SeDebugPrivilege 5648 WMIC.exe Token: SeSystemEnvironmentPrivilege 5648 WMIC.exe Token: SeRemoteShutdownPrivilege 5648 WMIC.exe Token: SeUndockPrivilege 5648 WMIC.exe Token: SeManageVolumePrivilege 5648 WMIC.exe Token: 33 5648 WMIC.exe Token: 34 5648 WMIC.exe Token: 35 5648 WMIC.exe Token: 36 5648 WMIC.exe Token: SeIncreaseQuotaPrivilege 5648 WMIC.exe Token: SeSecurityPrivilege 5648 WMIC.exe Token: SeTakeOwnershipPrivilege 5648 WMIC.exe Token: SeLoadDriverPrivilege 5648 WMIC.exe Token: SeSystemProfilePrivilege 5648 WMIC.exe Token: SeSystemtimePrivilege 5648 WMIC.exe Token: SeProfSingleProcessPrivilege 5648 WMIC.exe Token: SeIncBasePriorityPrivilege 5648 WMIC.exe Token: SeCreatePagefilePrivilege 5648 WMIC.exe Token: SeBackupPrivilege 5648 WMIC.exe Token: SeRestorePrivilege 5648 WMIC.exe Token: SeShutdownPrivilege 5648 WMIC.exe Token: SeDebugPrivilege 5648 WMIC.exe Token: SeSystemEnvironmentPrivilege 5648 WMIC.exe Token: SeRemoteShutdownPrivilege 5648 WMIC.exe Token: SeUndockPrivilege 5648 WMIC.exe Token: SeManageVolumePrivilege 5648 WMIC.exe Token: 33 5648 WMIC.exe Token: 34 5648 WMIC.exe Token: 35 5648 WMIC.exe Token: 36 5648 WMIC.exe Token: SeIncreaseQuotaPrivilege 5864 WMIC.exe Token: SeSecurityPrivilege 5864 WMIC.exe Token: SeTakeOwnershipPrivilege 5864 WMIC.exe Token: SeLoadDriverPrivilege 5864 WMIC.exe Token: SeSystemProfilePrivilege 5864 WMIC.exe Token: SeSystemtimePrivilege 5864 WMIC.exe Token: SeProfSingleProcessPrivilege 5864 WMIC.exe Token: SeIncBasePriorityPrivilege 5864 WMIC.exe Token: SeCreatePagefilePrivilege 5864 WMIC.exe Token: SeBackupPrivilege 5864 WMIC.exe Token: SeRestorePrivilege 5864 WMIC.exe Token: SeShutdownPrivilege 5864 WMIC.exe Token: SeDebugPrivilege 5864 WMIC.exe Token: SeSystemEnvironmentPrivilege 5864 WMIC.exe Token: SeRemoteShutdownPrivilege 5864 WMIC.exe Token: SeUndockPrivilege 5864 WMIC.exe Token: SeManageVolumePrivilege 5864 WMIC.exe Token: 33 5864 WMIC.exe Token: 34 5864 WMIC.exe Token: 35 5864 WMIC.exe Token: 36 5864 WMIC.exe Token: SeIncreaseQuotaPrivilege 5864 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4880 wrote to memory of 4912 4880 wscript.exe 90 PID 4880 wrote to memory of 5648 4880 wscript.exe 92 PID 4880 wrote to memory of 5864 4880 wscript.exe 95 PID 4880 wrote to memory of 3480 4880 wscript.exe 97 PID 4880 wrote to memory of 5964 4880 wscript.exe 99 PID 4880 wrote to memory of 200 4880 wscript.exe 101 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4912 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\9d825bca_studio_final_x3.js1⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\sucupeh"2⤵
- Views/modifies file attributes
PID:4912
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5648
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\sucupeh"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5864
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3480
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5964
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:200
-