Analysis
- max time kernel
38s - max time network
25s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 20:59
Static task
static1
Behavioral task
behavioral1
Sample
2520f72f37c4ccbe2c65b6828d18801bc50a64a8caaa1318bded786d5c50a4fd.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
2520f72f37c4ccbe2c65b6828d18801bc50a64a8caaa1318bded786d5c50a4fd.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target 2520f72f37c4ccbe2c65b6828d18801bc50a64a8caaa1318bded786d5c50a4fd.js
- Size 13.5MB
- Sample260820-zssl1sff96
- SHA256 2520f72f37c4ccbe2c65b6828d18801bc50a64a8caaa1318bded786d5c50a4fd
- MD5 b5078d2834ef5e74b1c9e847a7b8810a
- SHA1 c52b31c9aa37978cf392279c963bc425f91cd6a7
- SHA512 d667cc45657c12dba3b7646cf1e51123396b3da382ea47454e468cb88bd2dc97d045f9f50ebd4d8d68ffc2316ad3274531090822d6d70e43e9217f3b05e9add5
- SSDEEP 49152:4MHn30J/wRtFpNIlVZHJShKR8NYEX43Qr9VbR4blNdhahv20GkuK5DmmnbZOlXOB:X
- TLSH T1BBE6B0C445FDDFAFC5E44436F3921CCB5D8BFFC59184A2B2E639281B326A462AB19D10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4112 WMIC.exe 4112 WMIC.exe 4112 WMIC.exe 4112 WMIC.exe 4952 WMIC.exe 4952 WMIC.exe 4952 WMIC.exe 4952 WMIC.exe 4800 WMIC.exe 4800 WMIC.exe 4800 WMIC.exe 4800 WMIC.exe 4980 WMIC.exe 4980 WMIC.exe 4980 WMIC.exe 4980 WMIC.exe 5820 WMIC.exe 5820 WMIC.exe 5820 WMIC.exe 5820 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4112 WMIC.exe Token: SeSecurityPrivilege 4112 WMIC.exe Token: SeTakeOwnershipPrivilege 4112 WMIC.exe Token: SeLoadDriverPrivilege 4112 WMIC.exe Token: SeSystemProfilePrivilege 4112 WMIC.exe Token: SeSystemtimePrivilege 4112 WMIC.exe Token: SeProfSingleProcessPrivilege 4112 WMIC.exe Token: SeIncBasePriorityPrivilege 4112 WMIC.exe Token: SeCreatePagefilePrivilege 4112 WMIC.exe Token: SeBackupPrivilege 4112 WMIC.exe Token: SeRestorePrivilege 4112 WMIC.exe Token: SeShutdownPrivilege 4112 WMIC.exe Token: SeDebugPrivilege 4112 WMIC.exe Token: SeSystemEnvironmentPrivilege 4112 WMIC.exe Token: SeRemoteShutdownPrivilege 4112 WMIC.exe Token: SeUndockPrivilege 4112 WMIC.exe Token: SeManageVolumePrivilege 4112 WMIC.exe Token: 33 4112 WMIC.exe Token: 34 4112 WMIC.exe Token: 35 4112 WMIC.exe Token: 36 4112 WMIC.exe Token: SeIncreaseQuotaPrivilege 4112 WMIC.exe Token: SeSecurityPrivilege 4112 WMIC.exe Token: SeTakeOwnershipPrivilege 4112 WMIC.exe Token: SeLoadDriverPrivilege 4112 WMIC.exe Token: SeSystemProfilePrivilege 4112 WMIC.exe Token: SeSystemtimePrivilege 4112 WMIC.exe Token: SeProfSingleProcessPrivilege 4112 WMIC.exe Token: SeIncBasePriorityPrivilege 4112 WMIC.exe Token: SeCreatePagefilePrivilege 4112 WMIC.exe Token: SeBackupPrivilege 4112 WMIC.exe Token: SeRestorePrivilege 4112 WMIC.exe Token: SeShutdownPrivilege 4112 WMIC.exe Token: SeDebugPrivilege 4112 WMIC.exe Token: SeSystemEnvironmentPrivilege 4112 WMIC.exe Token: SeRemoteShutdownPrivilege 4112 WMIC.exe Token: SeUndockPrivilege 4112 WMIC.exe Token: SeManageVolumePrivilege 4112 WMIC.exe Token: 33 4112 WMIC.exe Token: 34 4112 WMIC.exe Token: 35 4112 WMIC.exe Token: 36 4112 WMIC.exe Token: SeIncreaseQuotaPrivilege 4952 WMIC.exe Token: SeSecurityPrivilege 4952 WMIC.exe Token: SeTakeOwnershipPrivilege 4952 WMIC.exe Token: SeLoadDriverPrivilege 4952 WMIC.exe Token: SeSystemProfilePrivilege 4952 WMIC.exe Token: SeSystemtimePrivilege 4952 WMIC.exe Token: SeProfSingleProcessPrivilege 4952 WMIC.exe Token: SeIncBasePriorityPrivilege 4952 WMIC.exe Token: SeCreatePagefilePrivilege 4952 WMIC.exe Token: SeBackupPrivilege 4952 WMIC.exe Token: SeRestorePrivilege 4952 WMIC.exe Token: SeShutdownPrivilege 4952 WMIC.exe Token: SeDebugPrivilege 4952 WMIC.exe Token: SeSystemEnvironmentPrivilege 4952 WMIC.exe Token: SeRemoteShutdownPrivilege 4952 WMIC.exe Token: SeUndockPrivilege 4952 WMIC.exe Token: SeManageVolumePrivilege 4952 WMIC.exe Token: 33 4952 WMIC.exe Token: 34 4952 WMIC.exe Token: 35 4952 WMIC.exe Token: 36 4952 WMIC.exe Token: SeIncreaseQuotaPrivilege 4952 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1728 wrote to memory of 5008 1728 wscript.exe 90 PID 1728 wrote to memory of 4112 1728 wscript.exe 92 PID 1728 wrote to memory of 4952 1728 wscript.exe 95 PID 1728 wrote to memory of 4800 1728 wscript.exe 97 PID 1728 wrote to memory of 4980 1728 wscript.exe 99 PID 1728 wrote to memory of 5820 1728 wscript.exe 101 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 5008 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\2520f72f37c4ccbe2c65b6828d18801bc50a64a8caaa1318bded786d5c50a4fd.js1⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\riyapuc"2⤵
- Views/modifies file attributes
PID:5008
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\riyapuc"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4800
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4980
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5820
-