Analysis
- max time kernel
40s - max time network
34s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 09:26
Static task
static1
Behavioral task
behavioral1
Sample
0d6a30b6733b3e931d6164fd24510ec04f6a9fb876634a9a1879ceb923708349.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
0d6a30b6733b3e931d6164fd24510ec04f6a9fb876634a9a1879ceb923708349.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target 0d6a30b6733b3e931d6164fd24510ec04f6a9fb876634a9a1879ceb923708349.js
- Size 13.5MB
- Sample260823-leabmafp21
- SHA256 0d6a30b6733b3e931d6164fd24510ec04f6a9fb876634a9a1879ceb923708349
- MD5 e9f6b966ac4fe9fc37d4058376010975
- SHA1 e6f320955347c060b0bc7c62a085baf90096141b
- SHA512 6911fd35c2ce8225b3bf73cb09e925a5de7ee9f89b7958f815178c90b407d8fc364e7d85415bf128f9db6f5cda9176a2c94c03b2c4dccc9c23750fe155ce301d
- SSDEEP 49152:WO21G7kGceVyOe9XXFntKbeIu4ztR7qbDHi/86jVcTAS1d4V0jlzmoegCJlz0uYr:S
- TLSH T15FE6C0071F1612C8CF1B4BF933659CD1BA13BFDA75A6452ED3A36258E0993A1270CACD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4236 WMIC.exe 4236 WMIC.exe 4236 WMIC.exe 4236 WMIC.exe 4880 WMIC.exe 4880 WMIC.exe 4880 WMIC.exe 4880 WMIC.exe 1636 WMIC.exe 1636 WMIC.exe 1636 WMIC.exe 1636 WMIC.exe 248 WMIC.exe 248 WMIC.exe 248 WMIC.exe 248 WMIC.exe 2932 WMIC.exe 2932 WMIC.exe 2932 WMIC.exe 2932 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4236 WMIC.exe Token: SeSecurityPrivilege 4236 WMIC.exe Token: SeTakeOwnershipPrivilege 4236 WMIC.exe Token: SeLoadDriverPrivilege 4236 WMIC.exe Token: SeSystemProfilePrivilege 4236 WMIC.exe Token: SeSystemtimePrivilege 4236 WMIC.exe Token: SeProfSingleProcessPrivilege 4236 WMIC.exe Token: SeIncBasePriorityPrivilege 4236 WMIC.exe Token: SeCreatePagefilePrivilege 4236 WMIC.exe Token: SeBackupPrivilege 4236 WMIC.exe Token: SeRestorePrivilege 4236 WMIC.exe Token: SeShutdownPrivilege 4236 WMIC.exe Token: SeDebugPrivilege 4236 WMIC.exe Token: SeSystemEnvironmentPrivilege 4236 WMIC.exe Token: SeRemoteShutdownPrivilege 4236 WMIC.exe Token: SeUndockPrivilege 4236 WMIC.exe Token: SeManageVolumePrivilege 4236 WMIC.exe Token: 33 4236 WMIC.exe Token: 34 4236 WMIC.exe Token: 35 4236 WMIC.exe Token: 36 4236 WMIC.exe Token: SeIncreaseQuotaPrivilege 4236 WMIC.exe Token: SeSecurityPrivilege 4236 WMIC.exe Token: SeTakeOwnershipPrivilege 4236 WMIC.exe Token: SeLoadDriverPrivilege 4236 WMIC.exe Token: SeSystemProfilePrivilege 4236 WMIC.exe Token: SeSystemtimePrivilege 4236 WMIC.exe Token: SeProfSingleProcessPrivilege 4236 WMIC.exe Token: SeIncBasePriorityPrivilege 4236 WMIC.exe Token: SeCreatePagefilePrivilege 4236 WMIC.exe Token: SeBackupPrivilege 4236 WMIC.exe Token: SeRestorePrivilege 4236 WMIC.exe Token: SeShutdownPrivilege 4236 WMIC.exe Token: SeDebugPrivilege 4236 WMIC.exe Token: SeSystemEnvironmentPrivilege 4236 WMIC.exe Token: SeRemoteShutdownPrivilege 4236 WMIC.exe Token: SeUndockPrivilege 4236 WMIC.exe Token: SeManageVolumePrivilege 4236 WMIC.exe Token: 33 4236 WMIC.exe Token: 34 4236 WMIC.exe Token: 35 4236 WMIC.exe Token: 36 4236 WMIC.exe Token: SeIncreaseQuotaPrivilege 4880 WMIC.exe Token: SeSecurityPrivilege 4880 WMIC.exe Token: SeTakeOwnershipPrivilege 4880 WMIC.exe Token: SeLoadDriverPrivilege 4880 WMIC.exe Token: SeSystemProfilePrivilege 4880 WMIC.exe Token: SeSystemtimePrivilege 4880 WMIC.exe Token: SeProfSingleProcessPrivilege 4880 WMIC.exe Token: SeIncBasePriorityPrivilege 4880 WMIC.exe Token: SeCreatePagefilePrivilege 4880 WMIC.exe Token: SeBackupPrivilege 4880 WMIC.exe Token: SeRestorePrivilege 4880 WMIC.exe Token: SeShutdownPrivilege 4880 WMIC.exe Token: SeDebugPrivilege 4880 WMIC.exe Token: SeSystemEnvironmentPrivilege 4880 WMIC.exe Token: SeRemoteShutdownPrivilege 4880 WMIC.exe Token: SeUndockPrivilege 4880 WMIC.exe Token: SeManageVolumePrivilege 4880 WMIC.exe Token: 33 4880 WMIC.exe Token: 34 4880 WMIC.exe Token: 35 4880 WMIC.exe Token: 36 4880 WMIC.exe Token: SeIncreaseQuotaPrivilege 4880 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2576 wrote to memory of 4124 2576 wscript.exe 90 PID 2576 wrote to memory of 4236 2576 wscript.exe 92 PID 2576 wrote to memory of 4880 2576 wscript.exe 95 PID 2576 wrote to memory of 1636 2576 wscript.exe 97 PID 2576 wrote to memory of 248 2576 wscript.exe 99 PID 2576 wrote to memory of 2932 2576 wscript.exe 101 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4124 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\0d6a30b6733b3e931d6164fd24510ec04f6a9fb876634a9a1879ceb923708349.js1⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\renoqom"2⤵
- Views/modifies file attributes
PID:4124
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4236
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\renoqom"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1636
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:248
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2932
-