Analysis
- max time kernel
40s - max time network
38s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 19:58
Static task
static1
Behavioral task
behavioral1
Sample
74adf9ef84b2f8a12c7e1f003afceab3a379b2c1087bc1711d876820487b42f3.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
74adf9ef84b2f8a12c7e1f003afceab3a379b2c1087bc1711d876820487b42f3.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target 74adf9ef84b2f8a12c7e1f003afceab3a379b2c1087bc1711d876820487b42f3.js
- Size 13.5MB
- Sample260820-yp4dnsfe64
- SHA256 74adf9ef84b2f8a12c7e1f003afceab3a379b2c1087bc1711d876820487b42f3
- MD5 a99a3a77e66f145aa744df780d2304e2
- SHA1 536fc4acfbf19fd71d176b6449c837ba0b16a61b
- SHA512 fed7fa39372597fade8627c4d9ccdec5b94c9e40ed3c4f79b9e43a239e935d8cebda702ed270a60d8b4ddb475ea36c4ed80b7247b713db9021f8da057f7f9566
- SSDEEP 49152:qZS6Uw/e58KA5Uh9VgQeCi1YG9NnmH7b/HMbqyq7V5+rilH2Udvca9rTA40vzua3:i
- TLSH T1DBE6CF92BA7DE54CD350A3FAD21F315023D6F2375866434FDBB531AE11B8E08A709E26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 5408 WMIC.exe 5408 WMIC.exe 5408 WMIC.exe 5408 WMIC.exe 2684 WMIC.exe 2684 WMIC.exe 2684 WMIC.exe 2684 WMIC.exe 3432 WMIC.exe 3432 WMIC.exe 3432 WMIC.exe 3432 WMIC.exe 4140 WMIC.exe 4140 WMIC.exe 4140 WMIC.exe 4140 WMIC.exe 1204 WMIC.exe 1204 WMIC.exe 1204 WMIC.exe 1204 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5408 WMIC.exe Token: SeSecurityPrivilege 5408 WMIC.exe Token: SeTakeOwnershipPrivilege 5408 WMIC.exe Token: SeLoadDriverPrivilege 5408 WMIC.exe Token: SeSystemProfilePrivilege 5408 WMIC.exe Token: SeSystemtimePrivilege 5408 WMIC.exe Token: SeProfSingleProcessPrivilege 5408 WMIC.exe Token: SeIncBasePriorityPrivilege 5408 WMIC.exe Token: SeCreatePagefilePrivilege 5408 WMIC.exe Token: SeBackupPrivilege 5408 WMIC.exe Token: SeRestorePrivilege 5408 WMIC.exe Token: SeShutdownPrivilege 5408 WMIC.exe Token: SeDebugPrivilege 5408 WMIC.exe Token: SeSystemEnvironmentPrivilege 5408 WMIC.exe Token: SeRemoteShutdownPrivilege 5408 WMIC.exe Token: SeUndockPrivilege 5408 WMIC.exe Token: SeManageVolumePrivilege 5408 WMIC.exe Token: 33 5408 WMIC.exe Token: 34 5408 WMIC.exe Token: 35 5408 WMIC.exe Token: 36 5408 WMIC.exe Token: SeIncreaseQuotaPrivilege 5408 WMIC.exe Token: SeSecurityPrivilege 5408 WMIC.exe Token: SeTakeOwnershipPrivilege 5408 WMIC.exe Token: SeLoadDriverPrivilege 5408 WMIC.exe Token: SeSystemProfilePrivilege 5408 WMIC.exe Token: SeSystemtimePrivilege 5408 WMIC.exe Token: SeProfSingleProcessPrivilege 5408 WMIC.exe Token: SeIncBasePriorityPrivilege 5408 WMIC.exe Token: SeCreatePagefilePrivilege 5408 WMIC.exe Token: SeBackupPrivilege 5408 WMIC.exe Token: SeRestorePrivilege 5408 WMIC.exe Token: SeShutdownPrivilege 5408 WMIC.exe Token: SeDebugPrivilege 5408 WMIC.exe Token: SeSystemEnvironmentPrivilege 5408 WMIC.exe Token: SeRemoteShutdownPrivilege 5408 WMIC.exe Token: SeUndockPrivilege 5408 WMIC.exe Token: SeManageVolumePrivilege 5408 WMIC.exe Token: 33 5408 WMIC.exe Token: 34 5408 WMIC.exe Token: 35 5408 WMIC.exe Token: 36 5408 WMIC.exe Token: SeIncreaseQuotaPrivilege 2684 WMIC.exe Token: SeSecurityPrivilege 2684 WMIC.exe Token: SeTakeOwnershipPrivilege 2684 WMIC.exe Token: SeLoadDriverPrivilege 2684 WMIC.exe Token: SeSystemProfilePrivilege 2684 WMIC.exe Token: SeSystemtimePrivilege 2684 WMIC.exe Token: SeProfSingleProcessPrivilege 2684 WMIC.exe Token: SeIncBasePriorityPrivilege 2684 WMIC.exe Token: SeCreatePagefilePrivilege 2684 WMIC.exe Token: SeBackupPrivilege 2684 WMIC.exe Token: SeRestorePrivilege 2684 WMIC.exe Token: SeShutdownPrivilege 2684 WMIC.exe Token: SeDebugPrivilege 2684 WMIC.exe Token: SeSystemEnvironmentPrivilege 2684 WMIC.exe Token: SeRemoteShutdownPrivilege 2684 WMIC.exe Token: SeUndockPrivilege 2684 WMIC.exe Token: SeManageVolumePrivilege 2684 WMIC.exe Token: 33 2684 WMIC.exe Token: 34 2684 WMIC.exe Token: 35 2684 WMIC.exe Token: 36 2684 WMIC.exe Token: SeIncreaseQuotaPrivilege 2684 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4944 wrote to memory of 4684 4944 wscript.exe 89 PID 4944 wrote to memory of 5408 4944 wscript.exe 91 PID 4944 wrote to memory of 2684 4944 wscript.exe 94 PID 4944 wrote to memory of 3432 4944 wscript.exe 96 PID 4944 wrote to memory of 4140 4944 wscript.exe 98 PID 4944 wrote to memory of 1204 4944 wscript.exe 100 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4684 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\74adf9ef84b2f8a12c7e1f003afceab3a379b2c1087bc1711d876820487b42f3.js1⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\riyapuc"2⤵
- Views/modifies file attributes
PID:4684
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5408
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\riyapuc"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3432
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4140
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1204
-