Analysis
- max time kernel
40s - max time network
27s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/08/2026, 15:07
Static task
static1
Behavioral task
behavioral1
Sample
19d2a10da88e962d187915a90e74e87dd30d385daa015c830a8bafb50b2c0bae.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
19d2a10da88e962d187915a90e74e87dd30d385daa015c830a8bafb50b2c0bae.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target 19d2a10da88e962d187915a90e74e87dd30d385daa015c830a8bafb50b2c0bae.js
- Size 13.5MB
- Sample260821-sg99cssdkg
- SHA256 19d2a10da88e962d187915a90e74e87dd30d385daa015c830a8bafb50b2c0bae
- MD5 98d223fa4c0d7541901fd8118b7f8186
- SHA1 a057cfc31bb65c45fd09ba23a3d517d7b6f254f6
- SHA512 c4b9afc2eb6bc0342c51a88be2c5a639f553765170503f1fd0a2ab7da7805db31fc3c98807ff73d72e645a3750f96ee481941ede28df75cd7b362d7fbb26829d
- SSDEEP 49152:4ptBqqmr6Y2zfxaqf2hPFZPT4BLzXFC1OKYd02oqE59SH2NJc+gyhlrPUOmpn2V7:p
- TLSH T1DCE6E017270BAE7D371EBCB8748E70526DC3868735E8DF6DAE432DC4A84FA2262C5514
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4200 WMIC.exe 4200 WMIC.exe 4200 WMIC.exe 4200 WMIC.exe 3360 WMIC.exe 3360 WMIC.exe 3360 WMIC.exe 3360 WMIC.exe 2256 WMIC.exe 2256 WMIC.exe 2256 WMIC.exe 2256 WMIC.exe 360 WMIC.exe 360 WMIC.exe 360 WMIC.exe 360 WMIC.exe 3336 WMIC.exe 3336 WMIC.exe 3336 WMIC.exe 3336 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4200 WMIC.exe Token: SeSecurityPrivilege 4200 WMIC.exe Token: SeTakeOwnershipPrivilege 4200 WMIC.exe Token: SeLoadDriverPrivilege 4200 WMIC.exe Token: SeSystemProfilePrivilege 4200 WMIC.exe Token: SeSystemtimePrivilege 4200 WMIC.exe Token: SeProfSingleProcessPrivilege 4200 WMIC.exe Token: SeIncBasePriorityPrivilege 4200 WMIC.exe Token: SeCreatePagefilePrivilege 4200 WMIC.exe Token: SeBackupPrivilege 4200 WMIC.exe Token: SeRestorePrivilege 4200 WMIC.exe Token: SeShutdownPrivilege 4200 WMIC.exe Token: SeDebugPrivilege 4200 WMIC.exe Token: SeSystemEnvironmentPrivilege 4200 WMIC.exe Token: SeRemoteShutdownPrivilege 4200 WMIC.exe Token: SeUndockPrivilege 4200 WMIC.exe Token: SeManageVolumePrivilege 4200 WMIC.exe Token: 33 4200 WMIC.exe Token: 34 4200 WMIC.exe Token: 35 4200 WMIC.exe Token: 36 4200 WMIC.exe Token: SeIncreaseQuotaPrivilege 4200 WMIC.exe Token: SeSecurityPrivilege 4200 WMIC.exe Token: SeTakeOwnershipPrivilege 4200 WMIC.exe Token: SeLoadDriverPrivilege 4200 WMIC.exe Token: SeSystemProfilePrivilege 4200 WMIC.exe Token: SeSystemtimePrivilege 4200 WMIC.exe Token: SeProfSingleProcessPrivilege 4200 WMIC.exe Token: SeIncBasePriorityPrivilege 4200 WMIC.exe Token: SeCreatePagefilePrivilege 4200 WMIC.exe Token: SeBackupPrivilege 4200 WMIC.exe Token: SeRestorePrivilege 4200 WMIC.exe Token: SeShutdownPrivilege 4200 WMIC.exe Token: SeDebugPrivilege 4200 WMIC.exe Token: SeSystemEnvironmentPrivilege 4200 WMIC.exe Token: SeRemoteShutdownPrivilege 4200 WMIC.exe Token: SeUndockPrivilege 4200 WMIC.exe Token: SeManageVolumePrivilege 4200 WMIC.exe Token: 33 4200 WMIC.exe Token: 34 4200 WMIC.exe Token: 35 4200 WMIC.exe Token: 36 4200 WMIC.exe Token: SeIncreaseQuotaPrivilege 3360 WMIC.exe Token: SeSecurityPrivilege 3360 WMIC.exe Token: SeTakeOwnershipPrivilege 3360 WMIC.exe Token: SeLoadDriverPrivilege 3360 WMIC.exe Token: SeSystemProfilePrivilege 3360 WMIC.exe Token: SeSystemtimePrivilege 3360 WMIC.exe Token: SeProfSingleProcessPrivilege 3360 WMIC.exe Token: SeIncBasePriorityPrivilege 3360 WMIC.exe Token: SeCreatePagefilePrivilege 3360 WMIC.exe Token: SeBackupPrivilege 3360 WMIC.exe Token: SeRestorePrivilege 3360 WMIC.exe Token: SeShutdownPrivilege 3360 WMIC.exe Token: SeDebugPrivilege 3360 WMIC.exe Token: SeSystemEnvironmentPrivilege 3360 WMIC.exe Token: SeRemoteShutdownPrivilege 3360 WMIC.exe Token: SeUndockPrivilege 3360 WMIC.exe Token: SeManageVolumePrivilege 3360 WMIC.exe Token: 33 3360 WMIC.exe Token: 34 3360 WMIC.exe Token: 35 3360 WMIC.exe Token: 36 3360 WMIC.exe Token: SeIncreaseQuotaPrivilege 3360 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4628 wrote to memory of 1812 4628 wscript.exe 90 PID 4628 wrote to memory of 4200 4628 wscript.exe 92 PID 4628 wrote to memory of 3360 4628 wscript.exe 95 PID 4628 wrote to memory of 2256 4628 wscript.exe 97 PID 4628 wrote to memory of 360 4628 wscript.exe 99 PID 4628 wrote to memory of 3336 4628 wscript.exe 101 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1812 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\19d2a10da88e962d187915a90e74e87dd30d385daa015c830a8bafb50b2c0bae.js1⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\ravepiw"2⤵
- Views/modifies file attributes
PID:1812
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4200
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\ravepiw"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3360
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2256
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:360
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3336
-