Analysis
- max time kernel
40s - max time network
22s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/08/2026, 03:44
Static task
static1
Behavioral task
behavioral1
Sample
dfec0ea9ed7b1e3ceb813604170f47b0376cdeb226b418dee6e636e80f688cb0.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
dfec0ea9ed7b1e3ceb813604170f47b0376cdeb226b418dee6e636e80f688cb0.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target dfec0ea9ed7b1e3ceb813604170f47b0376cdeb226b418dee6e636e80f688cb0.js
- Size 13.5MB
- Sample260824-eammtssfle
- SHA256 dfec0ea9ed7b1e3ceb813604170f47b0376cdeb226b418dee6e636e80f688cb0
- MD5 7cf0ce39473c63302879cf51f62ca160
- SHA1 7dbbd15983f89c0b1e2668ed6b3212ebea6272b5
- SHA512 88a57594191a42940234d60be542ac126fe09519bdbad1975dc431a70b9c4eb0da81a9ae7910b4de8fee7e48ac280edf60345b52e93d614f20cda26ec2263d44
- SSDEEP 49152:0sgpSRoPPkDlT1361h27mWk5HsRgGPqOtWbY4ePGs1M6uAFdjYSJeM+6nIg9Q82z:s
- TLSH T136E6BF7108D506A7C4280C6775A3D8699D07A3876AEFDF4EBF5E61E9E0E2904841CBCF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2036 WMIC.exe 2036 WMIC.exe 2036 WMIC.exe 2036 WMIC.exe 5652 WMIC.exe 5652 WMIC.exe 5652 WMIC.exe 5652 WMIC.exe 6060 WMIC.exe 6060 WMIC.exe 6060 WMIC.exe 6060 WMIC.exe 4896 WMIC.exe 4896 WMIC.exe 4896 WMIC.exe 4896 WMIC.exe 6056 WMIC.exe 6056 WMIC.exe 6056 WMIC.exe 6056 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2036 WMIC.exe Token: SeSecurityPrivilege 2036 WMIC.exe Token: SeTakeOwnershipPrivilege 2036 WMIC.exe Token: SeLoadDriverPrivilege 2036 WMIC.exe Token: SeSystemProfilePrivilege 2036 WMIC.exe Token: SeSystemtimePrivilege 2036 WMIC.exe Token: SeProfSingleProcessPrivilege 2036 WMIC.exe Token: SeIncBasePriorityPrivilege 2036 WMIC.exe Token: SeCreatePagefilePrivilege 2036 WMIC.exe Token: SeBackupPrivilege 2036 WMIC.exe Token: SeRestorePrivilege 2036 WMIC.exe Token: SeShutdownPrivilege 2036 WMIC.exe Token: SeDebugPrivilege 2036 WMIC.exe Token: SeSystemEnvironmentPrivilege 2036 WMIC.exe Token: SeRemoteShutdownPrivilege 2036 WMIC.exe Token: SeUndockPrivilege 2036 WMIC.exe Token: SeManageVolumePrivilege 2036 WMIC.exe Token: 33 2036 WMIC.exe Token: 34 2036 WMIC.exe Token: 35 2036 WMIC.exe Token: 36 2036 WMIC.exe Token: SeIncreaseQuotaPrivilege 2036 WMIC.exe Token: SeSecurityPrivilege 2036 WMIC.exe Token: SeTakeOwnershipPrivilege 2036 WMIC.exe Token: SeLoadDriverPrivilege 2036 WMIC.exe Token: SeSystemProfilePrivilege 2036 WMIC.exe Token: SeSystemtimePrivilege 2036 WMIC.exe Token: SeProfSingleProcessPrivilege 2036 WMIC.exe Token: SeIncBasePriorityPrivilege 2036 WMIC.exe Token: SeCreatePagefilePrivilege 2036 WMIC.exe Token: SeBackupPrivilege 2036 WMIC.exe Token: SeRestorePrivilege 2036 WMIC.exe Token: SeShutdownPrivilege 2036 WMIC.exe Token: SeDebugPrivilege 2036 WMIC.exe Token: SeSystemEnvironmentPrivilege 2036 WMIC.exe Token: SeRemoteShutdownPrivilege 2036 WMIC.exe Token: SeUndockPrivilege 2036 WMIC.exe Token: SeManageVolumePrivilege 2036 WMIC.exe Token: 33 2036 WMIC.exe Token: 34 2036 WMIC.exe Token: 35 2036 WMIC.exe Token: 36 2036 WMIC.exe Token: SeIncreaseQuotaPrivilege 5652 WMIC.exe Token: SeSecurityPrivilege 5652 WMIC.exe Token: SeTakeOwnershipPrivilege 5652 WMIC.exe Token: SeLoadDriverPrivilege 5652 WMIC.exe Token: SeSystemProfilePrivilege 5652 WMIC.exe Token: SeSystemtimePrivilege 5652 WMIC.exe Token: SeProfSingleProcessPrivilege 5652 WMIC.exe Token: SeIncBasePriorityPrivilege 5652 WMIC.exe Token: SeCreatePagefilePrivilege 5652 WMIC.exe Token: SeBackupPrivilege 5652 WMIC.exe Token: SeRestorePrivilege 5652 WMIC.exe Token: SeShutdownPrivilege 5652 WMIC.exe Token: SeDebugPrivilege 5652 WMIC.exe Token: SeSystemEnvironmentPrivilege 5652 WMIC.exe Token: SeRemoteShutdownPrivilege 5652 WMIC.exe Token: SeUndockPrivilege 5652 WMIC.exe Token: SeManageVolumePrivilege 5652 WMIC.exe Token: 33 5652 WMIC.exe Token: 34 5652 WMIC.exe Token: 35 5652 WMIC.exe Token: 36 5652 WMIC.exe Token: SeIncreaseQuotaPrivilege 5652 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1152 wrote to memory of 2016 1152 wscript.exe 89 PID 1152 wrote to memory of 2036 1152 wscript.exe 91 PID 1152 wrote to memory of 5652 1152 wscript.exe 94 PID 1152 wrote to memory of 6060 1152 wscript.exe 96 PID 1152 wrote to memory of 4896 1152 wscript.exe 98 PID 1152 wrote to memory of 6056 1152 wscript.exe 100 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2016 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\dfec0ea9ed7b1e3ceb813604170f47b0376cdeb226b418dee6e636e80f688cb0.js1⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\rukaqeg"2⤵
- Views/modifies file attributes
PID:2016
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\rukaqeg"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5652
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6060
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4896
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6056
-