Analysis
- max time kernel
40s - max time network
22s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/08/2026, 21:10
Static task
static1
Behavioral task
behavioral1
Sample
9f0e1697b88eda0c896bf5acedd085303010e5fc9d458ccaa8e3b03a493a8806.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
9f0e1697b88eda0c896bf5acedd085303010e5fc9d458ccaa8e3b03a493a8806.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target 9f0e1697b88eda0c896bf5acedd085303010e5fc9d458ccaa8e3b03a493a8806.js
- Size 13.5MB
- Sample260821-zz8a2sxeqf
- SHA256 9f0e1697b88eda0c896bf5acedd085303010e5fc9d458ccaa8e3b03a493a8806
- MD5 995d36fe8cebba18cb3921de02ab6b24
- SHA1 de5d83fd8849e295a0ec99faa9a08283fed718b0
- SHA512 9874a234a1693192d6613c85b29a317898ed236786bbc66094caf2b2380e56f05219a68518e132c3816097d7cd5956a60bbd31540ca4df95c716a3ef3167f623
- SSDEEP 49152:MLR+HTkThQKDaee4CbRNuxPOM7WMZ5dvANmrimTar4v4H0qCnZZLJV4C++M+TDYG:C
- TLSH T126E6D049388EC99D0857243EA5E0094B18CD9D8B1A81F5B9F4FCD1E213F6BDE590EACD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3428 WMIC.exe 3428 WMIC.exe 3428 WMIC.exe 3428 WMIC.exe 1260 WMIC.exe 1260 WMIC.exe 1260 WMIC.exe 1260 WMIC.exe 5968 WMIC.exe 5968 WMIC.exe 5968 WMIC.exe 5968 WMIC.exe 4356 WMIC.exe 4356 WMIC.exe 4356 WMIC.exe 4356 WMIC.exe 708 WMIC.exe 708 WMIC.exe 708 WMIC.exe 708 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3428 WMIC.exe Token: SeSecurityPrivilege 3428 WMIC.exe Token: SeTakeOwnershipPrivilege 3428 WMIC.exe Token: SeLoadDriverPrivilege 3428 WMIC.exe Token: SeSystemProfilePrivilege 3428 WMIC.exe Token: SeSystemtimePrivilege 3428 WMIC.exe Token: SeProfSingleProcessPrivilege 3428 WMIC.exe Token: SeIncBasePriorityPrivilege 3428 WMIC.exe Token: SeCreatePagefilePrivilege 3428 WMIC.exe Token: SeBackupPrivilege 3428 WMIC.exe Token: SeRestorePrivilege 3428 WMIC.exe Token: SeShutdownPrivilege 3428 WMIC.exe Token: SeDebugPrivilege 3428 WMIC.exe Token: SeSystemEnvironmentPrivilege 3428 WMIC.exe Token: SeRemoteShutdownPrivilege 3428 WMIC.exe Token: SeUndockPrivilege 3428 WMIC.exe Token: SeManageVolumePrivilege 3428 WMIC.exe Token: 33 3428 WMIC.exe Token: 34 3428 WMIC.exe Token: 35 3428 WMIC.exe Token: 36 3428 WMIC.exe Token: SeIncreaseQuotaPrivilege 3428 WMIC.exe Token: SeSecurityPrivilege 3428 WMIC.exe Token: SeTakeOwnershipPrivilege 3428 WMIC.exe Token: SeLoadDriverPrivilege 3428 WMIC.exe Token: SeSystemProfilePrivilege 3428 WMIC.exe Token: SeSystemtimePrivilege 3428 WMIC.exe Token: SeProfSingleProcessPrivilege 3428 WMIC.exe Token: SeIncBasePriorityPrivilege 3428 WMIC.exe Token: SeCreatePagefilePrivilege 3428 WMIC.exe Token: SeBackupPrivilege 3428 WMIC.exe Token: SeRestorePrivilege 3428 WMIC.exe Token: SeShutdownPrivilege 3428 WMIC.exe Token: SeDebugPrivilege 3428 WMIC.exe Token: SeSystemEnvironmentPrivilege 3428 WMIC.exe Token: SeRemoteShutdownPrivilege 3428 WMIC.exe Token: SeUndockPrivilege 3428 WMIC.exe Token: SeManageVolumePrivilege 3428 WMIC.exe Token: 33 3428 WMIC.exe Token: 34 3428 WMIC.exe Token: 35 3428 WMIC.exe Token: 36 3428 WMIC.exe Token: SeIncreaseQuotaPrivilege 1260 WMIC.exe Token: SeSecurityPrivilege 1260 WMIC.exe Token: SeTakeOwnershipPrivilege 1260 WMIC.exe Token: SeLoadDriverPrivilege 1260 WMIC.exe Token: SeSystemProfilePrivilege 1260 WMIC.exe Token: SeSystemtimePrivilege 1260 WMIC.exe Token: SeProfSingleProcessPrivilege 1260 WMIC.exe Token: SeIncBasePriorityPrivilege 1260 WMIC.exe Token: SeCreatePagefilePrivilege 1260 WMIC.exe Token: SeBackupPrivilege 1260 WMIC.exe Token: SeRestorePrivilege 1260 WMIC.exe Token: SeShutdownPrivilege 1260 WMIC.exe Token: SeDebugPrivilege 1260 WMIC.exe Token: SeSystemEnvironmentPrivilege 1260 WMIC.exe Token: SeRemoteShutdownPrivilege 1260 WMIC.exe Token: SeUndockPrivilege 1260 WMIC.exe Token: SeManageVolumePrivilege 1260 WMIC.exe Token: 33 1260 WMIC.exe Token: 34 1260 WMIC.exe Token: 35 1260 WMIC.exe Token: 36 1260 WMIC.exe Token: SeIncreaseQuotaPrivilege 1260 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5936 wrote to memory of 4248 5936 wscript.exe 90 PID 5936 wrote to memory of 3428 5936 wscript.exe 92 PID 5936 wrote to memory of 1260 5936 wscript.exe 95 PID 5936 wrote to memory of 5968 5936 wscript.exe 97 PID 5936 wrote to memory of 4356 5936 wscript.exe 99 PID 5936 wrote to memory of 708 5936 wscript.exe 101 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4248 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\9f0e1697b88eda0c896bf5acedd085303010e5fc9d458ccaa8e3b03a493a8806.js1⤵
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\ravepiw"2⤵
- Views/modifies file attributes
PID:4248
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3428
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\ravepiw"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5968
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4356
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:708
-