Analysis
- max time kernel
40s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 04:24
Static task
static1
Behavioral task
behavioral1
Sample
2f579dc80d3ba5d6bb786464049281528c326497f3bba3fc7689767a51987034.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
2f579dc80d3ba5d6bb786464049281528c326497f3bba3fc7689767a51987034.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target 2f579dc80d3ba5d6bb786464049281528c326497f3bba3fc7689767a51987034.js
- Size 13.5MB
- Sample260823-e1n9caxwav
- SHA256 2f579dc80d3ba5d6bb786464049281528c326497f3bba3fc7689767a51987034
- MD5 79028fa0dc95eceebb99ad66f4aede67
- SHA1 52d33477cef44f20e9daef9d107906330e5fb2f9
- SHA512 fd3ba90bceaad7f6a27d72a277d41c32e79b129853ef50533295332f41fe295380af0a8984b9630d3ab96947b4ec77af89f937b7f2c0533a53cf0e95c6727b7e
- SSDEEP 49152:b0v6wLKdQqh9KVzsAsJkAdNe6DVtpf/+KuliwtOt+pmnc3vHULka5q0FwSJP2TOG:e
- TLSH T115E6D01B8D1ADF7EB99CA81220DA79AF245E32DBF0948B87188C11D3F569CC15C3395B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4812 WMIC.exe 4812 WMIC.exe 4812 WMIC.exe 4812 WMIC.exe 4900 WMIC.exe 4900 WMIC.exe 4900 WMIC.exe 4900 WMIC.exe 1076 WMIC.exe 1076 WMIC.exe 1076 WMIC.exe 1076 WMIC.exe 3544 WMIC.exe 3544 WMIC.exe 3544 WMIC.exe 3544 WMIC.exe 5832 WMIC.exe 5832 WMIC.exe 5832 WMIC.exe 5832 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4812 WMIC.exe Token: SeSecurityPrivilege 4812 WMIC.exe Token: SeTakeOwnershipPrivilege 4812 WMIC.exe Token: SeLoadDriverPrivilege 4812 WMIC.exe Token: SeSystemProfilePrivilege 4812 WMIC.exe Token: SeSystemtimePrivilege 4812 WMIC.exe Token: SeProfSingleProcessPrivilege 4812 WMIC.exe Token: SeIncBasePriorityPrivilege 4812 WMIC.exe Token: SeCreatePagefilePrivilege 4812 WMIC.exe Token: SeBackupPrivilege 4812 WMIC.exe Token: SeRestorePrivilege 4812 WMIC.exe Token: SeShutdownPrivilege 4812 WMIC.exe Token: SeDebugPrivilege 4812 WMIC.exe Token: SeSystemEnvironmentPrivilege 4812 WMIC.exe Token: SeRemoteShutdownPrivilege 4812 WMIC.exe Token: SeUndockPrivilege 4812 WMIC.exe Token: SeManageVolumePrivilege 4812 WMIC.exe Token: 33 4812 WMIC.exe Token: 34 4812 WMIC.exe Token: 35 4812 WMIC.exe Token: 36 4812 WMIC.exe Token: SeIncreaseQuotaPrivilege 4812 WMIC.exe Token: SeSecurityPrivilege 4812 WMIC.exe Token: SeTakeOwnershipPrivilege 4812 WMIC.exe Token: SeLoadDriverPrivilege 4812 WMIC.exe Token: SeSystemProfilePrivilege 4812 WMIC.exe Token: SeSystemtimePrivilege 4812 WMIC.exe Token: SeProfSingleProcessPrivilege 4812 WMIC.exe Token: SeIncBasePriorityPrivilege 4812 WMIC.exe Token: SeCreatePagefilePrivilege 4812 WMIC.exe Token: SeBackupPrivilege 4812 WMIC.exe Token: SeRestorePrivilege 4812 WMIC.exe Token: SeShutdownPrivilege 4812 WMIC.exe Token: SeDebugPrivilege 4812 WMIC.exe Token: SeSystemEnvironmentPrivilege 4812 WMIC.exe Token: SeRemoteShutdownPrivilege 4812 WMIC.exe Token: SeUndockPrivilege 4812 WMIC.exe Token: SeManageVolumePrivilege 4812 WMIC.exe Token: 33 4812 WMIC.exe Token: 34 4812 WMIC.exe Token: 35 4812 WMIC.exe Token: 36 4812 WMIC.exe Token: SeIncreaseQuotaPrivilege 4900 WMIC.exe Token: SeSecurityPrivilege 4900 WMIC.exe Token: SeTakeOwnershipPrivilege 4900 WMIC.exe Token: SeLoadDriverPrivilege 4900 WMIC.exe Token: SeSystemProfilePrivilege 4900 WMIC.exe Token: SeSystemtimePrivilege 4900 WMIC.exe Token: SeProfSingleProcessPrivilege 4900 WMIC.exe Token: SeIncBasePriorityPrivilege 4900 WMIC.exe Token: SeCreatePagefilePrivilege 4900 WMIC.exe Token: SeBackupPrivilege 4900 WMIC.exe Token: SeRestorePrivilege 4900 WMIC.exe Token: SeShutdownPrivilege 4900 WMIC.exe Token: SeDebugPrivilege 4900 WMIC.exe Token: SeSystemEnvironmentPrivilege 4900 WMIC.exe Token: SeRemoteShutdownPrivilege 4900 WMIC.exe Token: SeUndockPrivilege 4900 WMIC.exe Token: SeManageVolumePrivilege 4900 WMIC.exe Token: 33 4900 WMIC.exe Token: 34 4900 WMIC.exe Token: 35 4900 WMIC.exe Token: 36 4900 WMIC.exe Token: SeIncreaseQuotaPrivilege 4900 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3176 wrote to memory of 3720 3176 wscript.exe 90 PID 3176 wrote to memory of 4812 3176 wscript.exe 92 PID 3176 wrote to memory of 4900 3176 wscript.exe 95 PID 3176 wrote to memory of 1076 3176 wscript.exe 97 PID 3176 wrote to memory of 3544 3176 wscript.exe 99 PID 3176 wrote to memory of 5832 3176 wscript.exe 101 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3720 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\2f579dc80d3ba5d6bb786464049281528c326497f3bba3fc7689767a51987034.js1⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\renoqom"2⤵
- Views/modifies file attributes
PID:3720
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4812
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\renoqom"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4900
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1076
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3544
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5832
-