Analysis
- max time kernel
38s - max time network
41s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/08/2026, 09:26
Static task
static1
Behavioral task
behavioral1
Sample
0d6a30b6733b3e931d6164fd24510ec04f6a9fb876634a9a1879ceb923708349.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
0d6a30b6733b3e931d6164fd24510ec04f6a9fb876634a9a1879ceb923708349.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target 0d6a30b6733b3e931d6164fd24510ec04f6a9fb876634a9a1879ceb923708349.js
- Size 13.5MB
- Sample260823-leabmafp21
- SHA256 0d6a30b6733b3e931d6164fd24510ec04f6a9fb876634a9a1879ceb923708349
- MD5 e9f6b966ac4fe9fc37d4058376010975
- SHA1 e6f320955347c060b0bc7c62a085baf90096141b
- SHA512 6911fd35c2ce8225b3bf73cb09e925a5de7ee9f89b7958f815178c90b407d8fc364e7d85415bf128f9db6f5cda9176a2c94c03b2c4dccc9c23750fe155ce301d
- SSDEEP 49152:WO21G7kGceVyOe9XXFntKbeIu4ztR7qbDHi/86jVcTAS1d4V0jlzmoegCJlz0uYr:S
- TLSH T15FE6C0071F1612C8CF1B4BF933659CD1BA13BFDA75A6452ED3A36258E0993A1270CACD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation wscript.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 564 WMIC.exe Token: SeSecurityPrivilege 564 WMIC.exe Token: SeTakeOwnershipPrivilege 564 WMIC.exe Token: SeLoadDriverPrivilege 564 WMIC.exe Token: SeSystemProfilePrivilege 564 WMIC.exe Token: SeSystemtimePrivilege 564 WMIC.exe Token: SeProfSingleProcessPrivilege 564 WMIC.exe Token: SeIncBasePriorityPrivilege 564 WMIC.exe Token: SeCreatePagefilePrivilege 564 WMIC.exe Token: SeBackupPrivilege 564 WMIC.exe Token: SeRestorePrivilege 564 WMIC.exe Token: SeShutdownPrivilege 564 WMIC.exe Token: SeDebugPrivilege 564 WMIC.exe Token: SeSystemEnvironmentPrivilege 564 WMIC.exe Token: SeRemoteShutdownPrivilege 564 WMIC.exe Token: SeUndockPrivilege 564 WMIC.exe Token: SeManageVolumePrivilege 564 WMIC.exe Token: 33 564 WMIC.exe Token: 34 564 WMIC.exe Token: 35 564 WMIC.exe Token: 36 564 WMIC.exe Token: SeIncreaseQuotaPrivilege 564 WMIC.exe Token: SeSecurityPrivilege 564 WMIC.exe Token: SeTakeOwnershipPrivilege 564 WMIC.exe Token: SeLoadDriverPrivilege 564 WMIC.exe Token: SeSystemProfilePrivilege 564 WMIC.exe Token: SeSystemtimePrivilege 564 WMIC.exe Token: SeProfSingleProcessPrivilege 564 WMIC.exe Token: SeIncBasePriorityPrivilege 564 WMIC.exe Token: SeCreatePagefilePrivilege 564 WMIC.exe Token: SeBackupPrivilege 564 WMIC.exe Token: SeRestorePrivilege 564 WMIC.exe Token: SeShutdownPrivilege 564 WMIC.exe Token: SeDebugPrivilege 564 WMIC.exe Token: SeSystemEnvironmentPrivilege 564 WMIC.exe Token: SeRemoteShutdownPrivilege 564 WMIC.exe Token: SeUndockPrivilege 564 WMIC.exe Token: SeManageVolumePrivilege 564 WMIC.exe Token: 33 564 WMIC.exe Token: 34 564 WMIC.exe Token: 35 564 WMIC.exe Token: 36 564 WMIC.exe Token: SeIncreaseQuotaPrivilege 1320 WMIC.exe Token: SeSecurityPrivilege 1320 WMIC.exe Token: SeTakeOwnershipPrivilege 1320 WMIC.exe Token: SeLoadDriverPrivilege 1320 WMIC.exe Token: SeSystemProfilePrivilege 1320 WMIC.exe Token: SeSystemtimePrivilege 1320 WMIC.exe Token: SeProfSingleProcessPrivilege 1320 WMIC.exe Token: SeIncBasePriorityPrivilege 1320 WMIC.exe Token: SeCreatePagefilePrivilege 1320 WMIC.exe Token: SeBackupPrivilege 1320 WMIC.exe Token: SeRestorePrivilege 1320 WMIC.exe Token: SeShutdownPrivilege 1320 WMIC.exe Token: SeDebugPrivilege 1320 WMIC.exe Token: SeSystemEnvironmentPrivilege 1320 WMIC.exe Token: SeRemoteShutdownPrivilege 1320 WMIC.exe Token: SeUndockPrivilege 1320 WMIC.exe Token: SeManageVolumePrivilege 1320 WMIC.exe Token: 33 1320 WMIC.exe Token: 34 1320 WMIC.exe Token: 35 1320 WMIC.exe Token: 36 1320 WMIC.exe Token: SeIncreaseQuotaPrivilege 1320 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2432 wrote to memory of 928 2432 wscript.exe 96 PID 2432 wrote to memory of 564 2432 wscript.exe 98 PID 2432 wrote to memory of 1320 2432 wscript.exe 101 PID 2432 wrote to memory of 4364 2432 wscript.exe 103 PID 2432 wrote to memory of 3032 2432 wscript.exe 105 PID 2432 wrote to memory of 5008 2432 wscript.exe 107 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 928 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\0d6a30b6733b3e931d6164fd24510ec04f6a9fb876634a9a1879ceb923708349.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\renoqom"2⤵
- Views/modifies file attributes
PID:928
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:564
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\renoqom"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1320
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵PID:4364
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵PID:3032
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵PID:5008
-