Analysis
- max time kernel
40s - max time network
12s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 14:29
Static task
static1
Behavioral task
behavioral1
Sample
4a29a82dabfe78805f6d78d135150cccb5dd5718e5a14568bac87fdc4519656b.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
4a29a82dabfe78805f6d78d135150cccb5dd5718e5a14568bac87fdc4519656b.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target 4a29a82dabfe78805f6d78d135150cccb5dd5718e5a14568bac87fdc4519656b.js
- Size 13.5MB
- Sample260823-rt2bjsxela
- SHA256 4a29a82dabfe78805f6d78d135150cccb5dd5718e5a14568bac87fdc4519656b
- MD5 5851ab58f414e312f523c0dd5a8c1f7d
- SHA1 58d5a2caec32e1d2a09263ba0d78d554eae0198f
- SHA512 cbc5a9197502e985000e9f607e714e6d3fb2e35b2da60af971c0f189198c1ccd8bb621b1c24d6ed4a30b62485714b53d31066400a1b7060c7a0e95bab5b55d9e
- SSDEEP 49152:HefCTYlc4K5GBcT698vyqm1PGdpfyyuHO3lIqIqeZ6b1XVgkR5jjhC5xlLCW4bkE:J
- TLSH T161E6CF12FF30042718D227B5C9DD3459AC5CAEAAB36688462631D797B1DCCE6E70336E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4076 WMIC.exe 4076 WMIC.exe 4076 WMIC.exe 4076 WMIC.exe 3388 WMIC.exe 3388 WMIC.exe 3388 WMIC.exe 3388 WMIC.exe 4672 WMIC.exe 4672 WMIC.exe 4672 WMIC.exe 4672 WMIC.exe 3988 WMIC.exe 3988 WMIC.exe 3988 WMIC.exe 3988 WMIC.exe 2196 WMIC.exe 2196 WMIC.exe 2196 WMIC.exe 2196 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4076 WMIC.exe Token: SeSecurityPrivilege 4076 WMIC.exe Token: SeTakeOwnershipPrivilege 4076 WMIC.exe Token: SeLoadDriverPrivilege 4076 WMIC.exe Token: SeSystemProfilePrivilege 4076 WMIC.exe Token: SeSystemtimePrivilege 4076 WMIC.exe Token: SeProfSingleProcessPrivilege 4076 WMIC.exe Token: SeIncBasePriorityPrivilege 4076 WMIC.exe Token: SeCreatePagefilePrivilege 4076 WMIC.exe Token: SeBackupPrivilege 4076 WMIC.exe Token: SeRestorePrivilege 4076 WMIC.exe Token: SeShutdownPrivilege 4076 WMIC.exe Token: SeDebugPrivilege 4076 WMIC.exe Token: SeSystemEnvironmentPrivilege 4076 WMIC.exe Token: SeRemoteShutdownPrivilege 4076 WMIC.exe Token: SeUndockPrivilege 4076 WMIC.exe Token: SeManageVolumePrivilege 4076 WMIC.exe Token: 33 4076 WMIC.exe Token: 34 4076 WMIC.exe Token: 35 4076 WMIC.exe Token: 36 4076 WMIC.exe Token: SeIncreaseQuotaPrivilege 4076 WMIC.exe Token: SeSecurityPrivilege 4076 WMIC.exe Token: SeTakeOwnershipPrivilege 4076 WMIC.exe Token: SeLoadDriverPrivilege 4076 WMIC.exe Token: SeSystemProfilePrivilege 4076 WMIC.exe Token: SeSystemtimePrivilege 4076 WMIC.exe Token: SeProfSingleProcessPrivilege 4076 WMIC.exe Token: SeIncBasePriorityPrivilege 4076 WMIC.exe Token: SeCreatePagefilePrivilege 4076 WMIC.exe Token: SeBackupPrivilege 4076 WMIC.exe Token: SeRestorePrivilege 4076 WMIC.exe Token: SeShutdownPrivilege 4076 WMIC.exe Token: SeDebugPrivilege 4076 WMIC.exe Token: SeSystemEnvironmentPrivilege 4076 WMIC.exe Token: SeRemoteShutdownPrivilege 4076 WMIC.exe Token: SeUndockPrivilege 4076 WMIC.exe Token: SeManageVolumePrivilege 4076 WMIC.exe Token: 33 4076 WMIC.exe Token: 34 4076 WMIC.exe Token: 35 4076 WMIC.exe Token: 36 4076 WMIC.exe Token: SeIncreaseQuotaPrivilege 3388 WMIC.exe Token: SeSecurityPrivilege 3388 WMIC.exe Token: SeTakeOwnershipPrivilege 3388 WMIC.exe Token: SeLoadDriverPrivilege 3388 WMIC.exe Token: SeSystemProfilePrivilege 3388 WMIC.exe Token: SeSystemtimePrivilege 3388 WMIC.exe Token: SeProfSingleProcessPrivilege 3388 WMIC.exe Token: SeIncBasePriorityPrivilege 3388 WMIC.exe Token: SeCreatePagefilePrivilege 3388 WMIC.exe Token: SeBackupPrivilege 3388 WMIC.exe Token: SeRestorePrivilege 3388 WMIC.exe Token: SeShutdownPrivilege 3388 WMIC.exe Token: SeDebugPrivilege 3388 WMIC.exe Token: SeSystemEnvironmentPrivilege 3388 WMIC.exe Token: SeRemoteShutdownPrivilege 3388 WMIC.exe Token: SeUndockPrivilege 3388 WMIC.exe Token: SeManageVolumePrivilege 3388 WMIC.exe Token: 33 3388 WMIC.exe Token: 34 3388 WMIC.exe Token: 35 3388 WMIC.exe Token: 36 3388 WMIC.exe Token: SeIncreaseQuotaPrivilege 3388 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5980 wrote to memory of 1704 5980 wscript.exe 90 PID 5980 wrote to memory of 4076 5980 wscript.exe 92 PID 5980 wrote to memory of 3388 5980 wscript.exe 95 PID 5980 wrote to memory of 4672 5980 wscript.exe 97 PID 5980 wrote to memory of 3988 5980 wscript.exe 99 PID 5980 wrote to memory of 2196 5980 wscript.exe 101 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1704 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\4a29a82dabfe78805f6d78d135150cccb5dd5718e5a14568bac87fdc4519656b.js1⤵
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\renoqom"2⤵
- Views/modifies file attributes
PID:1704
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4076
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\renoqom"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3388
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4672
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3988
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2196
-