Analysis
- max time kernel
40s - max time network
25s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/08/2026, 02:44
Static task
static1
Behavioral task
behavioral1
Sample
cce51ae71c056fbd149f0d9ba817fcac74015fb4f800e59f1cc5cd4b5a3b361f.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
cce51ae71c056fbd149f0d9ba817fcac74015fb4f800e59f1cc5cd4b5a3b361f.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target cce51ae71c056fbd149f0d9ba817fcac74015fb4f800e59f1cc5cd4b5a3b361f.js
- Size 13.5MB
- Sample260824-c79grasdng
- SHA256 cce51ae71c056fbd149f0d9ba817fcac74015fb4f800e59f1cc5cd4b5a3b361f
- MD5 bc8ef8432556d27d36bc7356ca995c2b
- SHA1 62725f24c3fa2ae8528e3d4236ca3c8a5cd19d41
- SHA512 760e98fa589d8402788b3d3833e5388feba52adeac4ca6a1783972e8345b6655f055cd04bb0d7207144a883bd90f5b4c2f627b18b78699957c6635f5f9903461
- SSDEEP 49152:5H2Gm+lbrpdHJkmc1VuLeN3oce6vE/T64Jkk3Kv49KVQBrbM3aE2ovMEnn5A+FKU:i
- TLSH T127E6D0BB18C77665D43895FAC6531CCC0608BAC2781902E471B7C5C6649AB8DF0BE9EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 6132 WMIC.exe 6132 WMIC.exe 6132 WMIC.exe 6132 WMIC.exe 5744 WMIC.exe 5744 WMIC.exe 5744 WMIC.exe 5744 WMIC.exe 2432 WMIC.exe 2432 WMIC.exe 2432 WMIC.exe 2432 WMIC.exe 3968 WMIC.exe 3968 WMIC.exe 3968 WMIC.exe 3968 WMIC.exe 2020 WMIC.exe 2020 WMIC.exe 2020 WMIC.exe 2020 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 6132 WMIC.exe Token: SeSecurityPrivilege 6132 WMIC.exe Token: SeTakeOwnershipPrivilege 6132 WMIC.exe Token: SeLoadDriverPrivilege 6132 WMIC.exe Token: SeSystemProfilePrivilege 6132 WMIC.exe Token: SeSystemtimePrivilege 6132 WMIC.exe Token: SeProfSingleProcessPrivilege 6132 WMIC.exe Token: SeIncBasePriorityPrivilege 6132 WMIC.exe Token: SeCreatePagefilePrivilege 6132 WMIC.exe Token: SeBackupPrivilege 6132 WMIC.exe Token: SeRestorePrivilege 6132 WMIC.exe Token: SeShutdownPrivilege 6132 WMIC.exe Token: SeDebugPrivilege 6132 WMIC.exe Token: SeSystemEnvironmentPrivilege 6132 WMIC.exe Token: SeRemoteShutdownPrivilege 6132 WMIC.exe Token: SeUndockPrivilege 6132 WMIC.exe Token: SeManageVolumePrivilege 6132 WMIC.exe Token: 33 6132 WMIC.exe Token: 34 6132 WMIC.exe Token: 35 6132 WMIC.exe Token: 36 6132 WMIC.exe Token: SeIncreaseQuotaPrivilege 6132 WMIC.exe Token: SeSecurityPrivilege 6132 WMIC.exe Token: SeTakeOwnershipPrivilege 6132 WMIC.exe Token: SeLoadDriverPrivilege 6132 WMIC.exe Token: SeSystemProfilePrivilege 6132 WMIC.exe Token: SeSystemtimePrivilege 6132 WMIC.exe Token: SeProfSingleProcessPrivilege 6132 WMIC.exe Token: SeIncBasePriorityPrivilege 6132 WMIC.exe Token: SeCreatePagefilePrivilege 6132 WMIC.exe Token: SeBackupPrivilege 6132 WMIC.exe Token: SeRestorePrivilege 6132 WMIC.exe Token: SeShutdownPrivilege 6132 WMIC.exe Token: SeDebugPrivilege 6132 WMIC.exe Token: SeSystemEnvironmentPrivilege 6132 WMIC.exe Token: SeRemoteShutdownPrivilege 6132 WMIC.exe Token: SeUndockPrivilege 6132 WMIC.exe Token: SeManageVolumePrivilege 6132 WMIC.exe Token: 33 6132 WMIC.exe Token: 34 6132 WMIC.exe Token: 35 6132 WMIC.exe Token: 36 6132 WMIC.exe Token: SeIncreaseQuotaPrivilege 5744 WMIC.exe Token: SeSecurityPrivilege 5744 WMIC.exe Token: SeTakeOwnershipPrivilege 5744 WMIC.exe Token: SeLoadDriverPrivilege 5744 WMIC.exe Token: SeSystemProfilePrivilege 5744 WMIC.exe Token: SeSystemtimePrivilege 5744 WMIC.exe Token: SeProfSingleProcessPrivilege 5744 WMIC.exe Token: SeIncBasePriorityPrivilege 5744 WMIC.exe Token: SeCreatePagefilePrivilege 5744 WMIC.exe Token: SeBackupPrivilege 5744 WMIC.exe Token: SeRestorePrivilege 5744 WMIC.exe Token: SeShutdownPrivilege 5744 WMIC.exe Token: SeDebugPrivilege 5744 WMIC.exe Token: SeSystemEnvironmentPrivilege 5744 WMIC.exe Token: SeRemoteShutdownPrivilege 5744 WMIC.exe Token: SeUndockPrivilege 5744 WMIC.exe Token: SeManageVolumePrivilege 5744 WMIC.exe Token: 33 5744 WMIC.exe Token: 34 5744 WMIC.exe Token: 35 5744 WMIC.exe Token: 36 5744 WMIC.exe Token: SeIncreaseQuotaPrivilege 5744 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4316 wrote to memory of 5452 4316 wscript.exe 90 PID 4316 wrote to memory of 6132 4316 wscript.exe 92 PID 4316 wrote to memory of 5744 4316 wscript.exe 95 PID 4316 wrote to memory of 2432 4316 wscript.exe 97 PID 4316 wrote to memory of 3968 4316 wscript.exe 99 PID 4316 wrote to memory of 2020 4316 wscript.exe 101 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 5452 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\cce51ae71c056fbd149f0d9ba817fcac74015fb4f800e59f1cc5cd4b5a3b361f.js1⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\rukaqeg"2⤵
- Views/modifies file attributes
PID:5452
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6132
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\rukaqeg"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5744
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2432
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3968
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2020
-