Analysis
- max time kernel
40s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 00:22
Static task
static1
Behavioral task
behavioral1
Sample
633980cfc11ed6eddfb30571ecf45392073707f382cc24967fd91472498922aa.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
633980cfc11ed6eddfb30571ecf45392073707f382cc24967fd91472498922aa.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target 633980cfc11ed6eddfb30571ecf45392073707f382cc24967fd91472498922aa.js
- Size 13.5MB
- Sample260823-apdk9adj6t
- SHA256 633980cfc11ed6eddfb30571ecf45392073707f382cc24967fd91472498922aa
- MD5 056ccc5feaa9b325aeb423f239880151
- SHA1 0aa25c62411b181a2e539fc62965e35d4014c487
- SHA512 31c35e513d2a98d2d8ca9a3aa3ca0bd384a1171e1e66d161c66fbacdda3fc8e81e5cc8d0655221ed7bec6b8cc1d0b137afa0826ae4c2a73280b679b0017d916e
- SSDEEP 49152:FN7DYdyh3ITBHLjevs8+V6lgW7SgGfWZCtS75oC2sTmFwnlclUO9DHayTGtU+biQ:N
- TLSH T176E6C08DF105591BBE70061560E1B1E7694647C486FE83826B91EF7EBB83EB03667F08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 5076 WMIC.exe 5076 WMIC.exe 5076 WMIC.exe 5076 WMIC.exe 5176 WMIC.exe 5176 WMIC.exe 5176 WMIC.exe 5176 WMIC.exe 1828 WMIC.exe 1828 WMIC.exe 1828 WMIC.exe 1828 WMIC.exe 6064 WMIC.exe 6064 WMIC.exe 6064 WMIC.exe 6064 WMIC.exe 5040 WMIC.exe 5040 WMIC.exe 5040 WMIC.exe 5040 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5076 WMIC.exe Token: SeSecurityPrivilege 5076 WMIC.exe Token: SeTakeOwnershipPrivilege 5076 WMIC.exe Token: SeLoadDriverPrivilege 5076 WMIC.exe Token: SeSystemProfilePrivilege 5076 WMIC.exe Token: SeSystemtimePrivilege 5076 WMIC.exe Token: SeProfSingleProcessPrivilege 5076 WMIC.exe Token: SeIncBasePriorityPrivilege 5076 WMIC.exe Token: SeCreatePagefilePrivilege 5076 WMIC.exe Token: SeBackupPrivilege 5076 WMIC.exe Token: SeRestorePrivilege 5076 WMIC.exe Token: SeShutdownPrivilege 5076 WMIC.exe Token: SeDebugPrivilege 5076 WMIC.exe Token: SeSystemEnvironmentPrivilege 5076 WMIC.exe Token: SeRemoteShutdownPrivilege 5076 WMIC.exe Token: SeUndockPrivilege 5076 WMIC.exe Token: SeManageVolumePrivilege 5076 WMIC.exe Token: 33 5076 WMIC.exe Token: 34 5076 WMIC.exe Token: 35 5076 WMIC.exe Token: 36 5076 WMIC.exe Token: SeIncreaseQuotaPrivilege 5076 WMIC.exe Token: SeSecurityPrivilege 5076 WMIC.exe Token: SeTakeOwnershipPrivilege 5076 WMIC.exe Token: SeLoadDriverPrivilege 5076 WMIC.exe Token: SeSystemProfilePrivilege 5076 WMIC.exe Token: SeSystemtimePrivilege 5076 WMIC.exe Token: SeProfSingleProcessPrivilege 5076 WMIC.exe Token: SeIncBasePriorityPrivilege 5076 WMIC.exe Token: SeCreatePagefilePrivilege 5076 WMIC.exe Token: SeBackupPrivilege 5076 WMIC.exe Token: SeRestorePrivilege 5076 WMIC.exe Token: SeShutdownPrivilege 5076 WMIC.exe Token: SeDebugPrivilege 5076 WMIC.exe Token: SeSystemEnvironmentPrivilege 5076 WMIC.exe Token: SeRemoteShutdownPrivilege 5076 WMIC.exe Token: SeUndockPrivilege 5076 WMIC.exe Token: SeManageVolumePrivilege 5076 WMIC.exe Token: 33 5076 WMIC.exe Token: 34 5076 WMIC.exe Token: 35 5076 WMIC.exe Token: 36 5076 WMIC.exe Token: SeIncreaseQuotaPrivilege 5176 WMIC.exe Token: SeSecurityPrivilege 5176 WMIC.exe Token: SeTakeOwnershipPrivilege 5176 WMIC.exe Token: SeLoadDriverPrivilege 5176 WMIC.exe Token: SeSystemProfilePrivilege 5176 WMIC.exe Token: SeSystemtimePrivilege 5176 WMIC.exe Token: SeProfSingleProcessPrivilege 5176 WMIC.exe Token: SeIncBasePriorityPrivilege 5176 WMIC.exe Token: SeCreatePagefilePrivilege 5176 WMIC.exe Token: SeBackupPrivilege 5176 WMIC.exe Token: SeRestorePrivilege 5176 WMIC.exe Token: SeShutdownPrivilege 5176 WMIC.exe Token: SeDebugPrivilege 5176 WMIC.exe Token: SeSystemEnvironmentPrivilege 5176 WMIC.exe Token: SeRemoteShutdownPrivilege 5176 WMIC.exe Token: SeUndockPrivilege 5176 WMIC.exe Token: SeManageVolumePrivilege 5176 WMIC.exe Token: 33 5176 WMIC.exe Token: 34 5176 WMIC.exe Token: 35 5176 WMIC.exe Token: 36 5176 WMIC.exe Token: SeIncreaseQuotaPrivilege 5176 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3480 wrote to memory of 2500 3480 wscript.exe 90 PID 3480 wrote to memory of 5076 3480 wscript.exe 92 PID 3480 wrote to memory of 5176 3480 wscript.exe 95 PID 3480 wrote to memory of 1828 3480 wscript.exe 97 PID 3480 wrote to memory of 6064 3480 wscript.exe 99 PID 3480 wrote to memory of 5040 3480 wscript.exe 101 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2500 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\633980cfc11ed6eddfb30571ecf45392073707f382cc24967fd91472498922aa.js1⤵
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\renoqom"2⤵
- Views/modifies file attributes
PID:2500
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\renoqom"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5176
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1828
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6064
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5040
-