Analysis
- max time kernel
38s - max time network
39s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/08/2026, 15:07
Static task
static1
Behavioral task
behavioral1
Sample
19d2a10da88e962d187915a90e74e87dd30d385daa015c830a8bafb50b2c0bae.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
19d2a10da88e962d187915a90e74e87dd30d385daa015c830a8bafb50b2c0bae.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target 19d2a10da88e962d187915a90e74e87dd30d385daa015c830a8bafb50b2c0bae.js
- Size 13.5MB
- Sample260821-sg99cssdkg
- SHA256 19d2a10da88e962d187915a90e74e87dd30d385daa015c830a8bafb50b2c0bae
- MD5 98d223fa4c0d7541901fd8118b7f8186
- SHA1 a057cfc31bb65c45fd09ba23a3d517d7b6f254f6
- SHA512 c4b9afc2eb6bc0342c51a88be2c5a639f553765170503f1fd0a2ab7da7805db31fc3c98807ff73d72e645a3750f96ee481941ede28df75cd7b362d7fbb26829d
- SSDEEP 49152:4ptBqqmr6Y2zfxaqf2hPFZPT4BLzXFC1OKYd02oqE59SH2NJc+gyhlrPUOmpn2V7:p
- TLSH T1DCE6E017270BAE7D371EBCB8748E70526DC3868735E8DF6DAE432DC4A84FA2262C5514
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation wscript.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4948 WMIC.exe Token: SeSecurityPrivilege 4948 WMIC.exe Token: SeTakeOwnershipPrivilege 4948 WMIC.exe Token: SeLoadDriverPrivilege 4948 WMIC.exe Token: SeSystemProfilePrivilege 4948 WMIC.exe Token: SeSystemtimePrivilege 4948 WMIC.exe Token: SeProfSingleProcessPrivilege 4948 WMIC.exe Token: SeIncBasePriorityPrivilege 4948 WMIC.exe Token: SeCreatePagefilePrivilege 4948 WMIC.exe Token: SeBackupPrivilege 4948 WMIC.exe Token: SeRestorePrivilege 4948 WMIC.exe Token: SeShutdownPrivilege 4948 WMIC.exe Token: SeDebugPrivilege 4948 WMIC.exe Token: SeSystemEnvironmentPrivilege 4948 WMIC.exe Token: SeRemoteShutdownPrivilege 4948 WMIC.exe Token: SeUndockPrivilege 4948 WMIC.exe Token: SeManageVolumePrivilege 4948 WMIC.exe Token: 33 4948 WMIC.exe Token: 34 4948 WMIC.exe Token: 35 4948 WMIC.exe Token: 36 4948 WMIC.exe Token: SeIncreaseQuotaPrivilege 4948 WMIC.exe Token: SeSecurityPrivilege 4948 WMIC.exe Token: SeTakeOwnershipPrivilege 4948 WMIC.exe Token: SeLoadDriverPrivilege 4948 WMIC.exe Token: SeSystemProfilePrivilege 4948 WMIC.exe Token: SeSystemtimePrivilege 4948 WMIC.exe Token: SeProfSingleProcessPrivilege 4948 WMIC.exe Token: SeIncBasePriorityPrivilege 4948 WMIC.exe Token: SeCreatePagefilePrivilege 4948 WMIC.exe Token: SeBackupPrivilege 4948 WMIC.exe Token: SeRestorePrivilege 4948 WMIC.exe Token: SeShutdownPrivilege 4948 WMIC.exe Token: SeDebugPrivilege 4948 WMIC.exe Token: SeSystemEnvironmentPrivilege 4948 WMIC.exe Token: SeRemoteShutdownPrivilege 4948 WMIC.exe Token: SeUndockPrivilege 4948 WMIC.exe Token: SeManageVolumePrivilege 4948 WMIC.exe Token: 33 4948 WMIC.exe Token: 34 4948 WMIC.exe Token: 35 4948 WMIC.exe Token: 36 4948 WMIC.exe Token: SeIncreaseQuotaPrivilege 1864 WMIC.exe Token: SeSecurityPrivilege 1864 WMIC.exe Token: SeTakeOwnershipPrivilege 1864 WMIC.exe Token: SeLoadDriverPrivilege 1864 WMIC.exe Token: SeSystemProfilePrivilege 1864 WMIC.exe Token: SeSystemtimePrivilege 1864 WMIC.exe Token: SeProfSingleProcessPrivilege 1864 WMIC.exe Token: SeIncBasePriorityPrivilege 1864 WMIC.exe Token: SeCreatePagefilePrivilege 1864 WMIC.exe Token: SeBackupPrivilege 1864 WMIC.exe Token: SeRestorePrivilege 1864 WMIC.exe Token: SeShutdownPrivilege 1864 WMIC.exe Token: SeDebugPrivilege 1864 WMIC.exe Token: SeSystemEnvironmentPrivilege 1864 WMIC.exe Token: SeRemoteShutdownPrivilege 1864 WMIC.exe Token: SeUndockPrivilege 1864 WMIC.exe Token: SeManageVolumePrivilege 1864 WMIC.exe Token: 33 1864 WMIC.exe Token: 34 1864 WMIC.exe Token: 35 1864 WMIC.exe Token: 36 1864 WMIC.exe Token: SeIncreaseQuotaPrivilege 1864 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2568 wrote to memory of 3924 2568 wscript.exe 86 PID 2568 wrote to memory of 4948 2568 wscript.exe 88 PID 2568 wrote to memory of 1864 2568 wscript.exe 91 PID 2568 wrote to memory of 1296 2568 wscript.exe 93 PID 2568 wrote to memory of 3180 2568 wscript.exe 95 PID 2568 wrote to memory of 1044 2568 wscript.exe 97 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3924 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\19d2a10da88e962d187915a90e74e87dd30d385daa015c830a8bafb50b2c0bae.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\ravepiw"2⤵
- Views/modifies file attributes
PID:3924
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4948
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\ravepiw"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵PID:1296
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵PID:3180
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵PID:1044
-