Analysis
- max time kernel
40s - max time network
23s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 12:13
Static task
static1
Behavioral task
behavioral1
Sample
c9d5603669a5664c4dc8281117a3e1cddb58a4f5c136de7f4b3bdb4f3eb2b813.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
c9d5603669a5664c4dc8281117a3e1cddb58a4f5c136de7f4b3bdb4f3eb2b813.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target c9d5603669a5664c4dc8281117a3e1cddb58a4f5c136de7f4b3bdb4f3eb2b813.js
- Size 13.5MB
- Sample260822-pd5mxseh87
- SHA256 c9d5603669a5664c4dc8281117a3e1cddb58a4f5c136de7f4b3bdb4f3eb2b813
- MD5 662f816ed650067599fc088830c41763
- SHA1 70ffab7680dd45087d95e447f485c6249812a047
- SHA512 c4dec43d7aeccf4e8492c2378c4fa61fd9889b8970ee84bd462a6e1dfd73a8cc30f26838b66be495dd41ed933721d5c44f190de93f9aed13fbfbe1b77faf3c8f
- SSDEEP 49152:d0dlflcfJO8mIKr+9+OL+YaRtwWigvd8xclv8NqY11cqrAVRN/eUM0MlBy+HvRit:A
- TLSH T1EEE6D0136381131FB88C75D89054649DBDC8F2ABB6362BBBD054718AECD39B933A1F16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4792 WMIC.exe 4792 WMIC.exe 4792 WMIC.exe 4792 WMIC.exe 2980 WMIC.exe 2980 WMIC.exe 2980 WMIC.exe 2980 WMIC.exe 3576 WMIC.exe 3576 WMIC.exe 3576 WMIC.exe 3576 WMIC.exe 4112 WMIC.exe 4112 WMIC.exe 4112 WMIC.exe 4112 WMIC.exe 2940 WMIC.exe 2940 WMIC.exe 2940 WMIC.exe 2940 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4792 WMIC.exe Token: SeSecurityPrivilege 4792 WMIC.exe Token: SeTakeOwnershipPrivilege 4792 WMIC.exe Token: SeLoadDriverPrivilege 4792 WMIC.exe Token: SeSystemProfilePrivilege 4792 WMIC.exe Token: SeSystemtimePrivilege 4792 WMIC.exe Token: SeProfSingleProcessPrivilege 4792 WMIC.exe Token: SeIncBasePriorityPrivilege 4792 WMIC.exe Token: SeCreatePagefilePrivilege 4792 WMIC.exe Token: SeBackupPrivilege 4792 WMIC.exe Token: SeRestorePrivilege 4792 WMIC.exe Token: SeShutdownPrivilege 4792 WMIC.exe Token: SeDebugPrivilege 4792 WMIC.exe Token: SeSystemEnvironmentPrivilege 4792 WMIC.exe Token: SeRemoteShutdownPrivilege 4792 WMIC.exe Token: SeUndockPrivilege 4792 WMIC.exe Token: SeManageVolumePrivilege 4792 WMIC.exe Token: 33 4792 WMIC.exe Token: 34 4792 WMIC.exe Token: 35 4792 WMIC.exe Token: 36 4792 WMIC.exe Token: SeIncreaseQuotaPrivilege 4792 WMIC.exe Token: SeSecurityPrivilege 4792 WMIC.exe Token: SeTakeOwnershipPrivilege 4792 WMIC.exe Token: SeLoadDriverPrivilege 4792 WMIC.exe Token: SeSystemProfilePrivilege 4792 WMIC.exe Token: SeSystemtimePrivilege 4792 WMIC.exe Token: SeProfSingleProcessPrivilege 4792 WMIC.exe Token: SeIncBasePriorityPrivilege 4792 WMIC.exe Token: SeCreatePagefilePrivilege 4792 WMIC.exe Token: SeBackupPrivilege 4792 WMIC.exe Token: SeRestorePrivilege 4792 WMIC.exe Token: SeShutdownPrivilege 4792 WMIC.exe Token: SeDebugPrivilege 4792 WMIC.exe Token: SeSystemEnvironmentPrivilege 4792 WMIC.exe Token: SeRemoteShutdownPrivilege 4792 WMIC.exe Token: SeUndockPrivilege 4792 WMIC.exe Token: SeManageVolumePrivilege 4792 WMIC.exe Token: 33 4792 WMIC.exe Token: 34 4792 WMIC.exe Token: 35 4792 WMIC.exe Token: 36 4792 WMIC.exe Token: SeIncreaseQuotaPrivilege 2980 WMIC.exe Token: SeSecurityPrivilege 2980 WMIC.exe Token: SeTakeOwnershipPrivilege 2980 WMIC.exe Token: SeLoadDriverPrivilege 2980 WMIC.exe Token: SeSystemProfilePrivilege 2980 WMIC.exe Token: SeSystemtimePrivilege 2980 WMIC.exe Token: SeProfSingleProcessPrivilege 2980 WMIC.exe Token: SeIncBasePriorityPrivilege 2980 WMIC.exe Token: SeCreatePagefilePrivilege 2980 WMIC.exe Token: SeBackupPrivilege 2980 WMIC.exe Token: SeRestorePrivilege 2980 WMIC.exe Token: SeShutdownPrivilege 2980 WMIC.exe Token: SeDebugPrivilege 2980 WMIC.exe Token: SeSystemEnvironmentPrivilege 2980 WMIC.exe Token: SeRemoteShutdownPrivilege 2980 WMIC.exe Token: SeUndockPrivilege 2980 WMIC.exe Token: SeManageVolumePrivilege 2980 WMIC.exe Token: 33 2980 WMIC.exe Token: 34 2980 WMIC.exe Token: 35 2980 WMIC.exe Token: 36 2980 WMIC.exe Token: SeIncreaseQuotaPrivilege 2980 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5988 wrote to memory of 3108 5988 wscript.exe 90 PID 5988 wrote to memory of 4792 5988 wscript.exe 92 PID 5988 wrote to memory of 2980 5988 wscript.exe 95 PID 5988 wrote to memory of 3576 5988 wscript.exe 97 PID 5988 wrote to memory of 4112 5988 wscript.exe 99 PID 5988 wrote to memory of 2940 5988 wscript.exe 101 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3108 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\c9d5603669a5664c4dc8281117a3e1cddb58a4f5c136de7f4b3bdb4f3eb2b813.js1⤵
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\roripar"2⤵
- Views/modifies file attributes
PID:3108
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\roripar"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3576
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4112
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2940
-