Analysis
- max time kernel
40s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 08:12
Static task
static1
Behavioral task
behavioral1
Sample
5e85087859d8839c47d9e81ff53f243a7fdd567ed0d31b3568f569fa426242ea.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
5e85087859d8839c47d9e81ff53f243a7fdd567ed0d31b3568f569fa426242ea.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target 5e85087859d8839c47d9e81ff53f243a7fdd567ed0d31b3568f569fa426242ea.js
- Size 13.5MB
- Sample260822-j4aycaee93
- SHA256 5e85087859d8839c47d9e81ff53f243a7fdd567ed0d31b3568f569fa426242ea
- MD5 c87f9d7828540b92cdd535a82df2cc1e
- SHA1 103c528fa06eab7327fc8930f1facdc43e17bd21
- SHA512 7487d67676f3228ce3e1d4d2b32d9f2b11ca0597eb75ea5aa80dcecc6c437d1538471ebc7fca706caa0dd2a21b33ffca0d33147170a2812f4fc03984b0aa8436
- SSDEEP 49152:SmmN9+89BWoAiSALFPg8dmIwz1O8YSaUKj8S0hDWDBL14VdeDUQuogQ63a++vYx8:C
- TLSH T160E6D1A18BF0550CC80E6516A6BA184BF142F6A1580F8FB2F687B457333DB15B4DCA7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4892 WMIC.exe 4892 WMIC.exe 4892 WMIC.exe 4892 WMIC.exe 2668 WMIC.exe 2668 WMIC.exe 2668 WMIC.exe 2668 WMIC.exe 4968 WMIC.exe 4968 WMIC.exe 4968 WMIC.exe 4968 WMIC.exe 5932 WMIC.exe 5932 WMIC.exe 5932 WMIC.exe 5932 WMIC.exe 704 WMIC.exe 704 WMIC.exe 704 WMIC.exe 704 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4892 WMIC.exe Token: SeSecurityPrivilege 4892 WMIC.exe Token: SeTakeOwnershipPrivilege 4892 WMIC.exe Token: SeLoadDriverPrivilege 4892 WMIC.exe Token: SeSystemProfilePrivilege 4892 WMIC.exe Token: SeSystemtimePrivilege 4892 WMIC.exe Token: SeProfSingleProcessPrivilege 4892 WMIC.exe Token: SeIncBasePriorityPrivilege 4892 WMIC.exe Token: SeCreatePagefilePrivilege 4892 WMIC.exe Token: SeBackupPrivilege 4892 WMIC.exe Token: SeRestorePrivilege 4892 WMIC.exe Token: SeShutdownPrivilege 4892 WMIC.exe Token: SeDebugPrivilege 4892 WMIC.exe Token: SeSystemEnvironmentPrivilege 4892 WMIC.exe Token: SeRemoteShutdownPrivilege 4892 WMIC.exe Token: SeUndockPrivilege 4892 WMIC.exe Token: SeManageVolumePrivilege 4892 WMIC.exe Token: 33 4892 WMIC.exe Token: 34 4892 WMIC.exe Token: 35 4892 WMIC.exe Token: 36 4892 WMIC.exe Token: SeIncreaseQuotaPrivilege 4892 WMIC.exe Token: SeSecurityPrivilege 4892 WMIC.exe Token: SeTakeOwnershipPrivilege 4892 WMIC.exe Token: SeLoadDriverPrivilege 4892 WMIC.exe Token: SeSystemProfilePrivilege 4892 WMIC.exe Token: SeSystemtimePrivilege 4892 WMIC.exe Token: SeProfSingleProcessPrivilege 4892 WMIC.exe Token: SeIncBasePriorityPrivilege 4892 WMIC.exe Token: SeCreatePagefilePrivilege 4892 WMIC.exe Token: SeBackupPrivilege 4892 WMIC.exe Token: SeRestorePrivilege 4892 WMIC.exe Token: SeShutdownPrivilege 4892 WMIC.exe Token: SeDebugPrivilege 4892 WMIC.exe Token: SeSystemEnvironmentPrivilege 4892 WMIC.exe Token: SeRemoteShutdownPrivilege 4892 WMIC.exe Token: SeUndockPrivilege 4892 WMIC.exe Token: SeManageVolumePrivilege 4892 WMIC.exe Token: 33 4892 WMIC.exe Token: 34 4892 WMIC.exe Token: 35 4892 WMIC.exe Token: 36 4892 WMIC.exe Token: SeIncreaseQuotaPrivilege 2668 WMIC.exe Token: SeSecurityPrivilege 2668 WMIC.exe Token: SeTakeOwnershipPrivilege 2668 WMIC.exe Token: SeLoadDriverPrivilege 2668 WMIC.exe Token: SeSystemProfilePrivilege 2668 WMIC.exe Token: SeSystemtimePrivilege 2668 WMIC.exe Token: SeProfSingleProcessPrivilege 2668 WMIC.exe Token: SeIncBasePriorityPrivilege 2668 WMIC.exe Token: SeCreatePagefilePrivilege 2668 WMIC.exe Token: SeBackupPrivilege 2668 WMIC.exe Token: SeRestorePrivilege 2668 WMIC.exe Token: SeShutdownPrivilege 2668 WMIC.exe Token: SeDebugPrivilege 2668 WMIC.exe Token: SeSystemEnvironmentPrivilege 2668 WMIC.exe Token: SeRemoteShutdownPrivilege 2668 WMIC.exe Token: SeUndockPrivilege 2668 WMIC.exe Token: SeManageVolumePrivilege 2668 WMIC.exe Token: 33 2668 WMIC.exe Token: 34 2668 WMIC.exe Token: 35 2668 WMIC.exe Token: 36 2668 WMIC.exe Token: SeIncreaseQuotaPrivilege 2668 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 6052 wrote to memory of 4192 6052 wscript.exe 90 PID 6052 wrote to memory of 4892 6052 wscript.exe 92 PID 6052 wrote to memory of 2668 6052 wscript.exe 95 PID 6052 wrote to memory of 4968 6052 wscript.exe 97 PID 6052 wrote to memory of 5932 6052 wscript.exe 99 PID 6052 wrote to memory of 704 6052 wscript.exe 101 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4192 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\5e85087859d8839c47d9e81ff53f243a7fdd567ed0d31b3568f569fa426242ea.js1⤵
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\roripar"2⤵
- Views/modifies file attributes
PID:4192
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\roripar"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4968
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5932
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:704
-