Analysis
- max time kernel
40s - max time network
31s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/08/2026, 15:51
Static task
static1
Behavioral task
behavioral1
Sample
4ca357df0aaaee10131092025e55bdee4faf3e4055216e77a5407f9f39d8a08c.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
4ca357df0aaaee10131092025e55bdee4faf3e4055216e77a5407f9f39d8a08c.js
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target 4ca357df0aaaee10131092025e55bdee4faf3e4055216e77a5407f9f39d8a08c.js
- Size 13.5MB
- Sample260824-tasleaeb26
- SHA256 4ca357df0aaaee10131092025e55bdee4faf3e4055216e77a5407f9f39d8a08c
- MD5 31570ecfc1e52a0615a066aecda446bb
- SHA1 86e2d35cc41c985a8d0aeee8df1e17e67732c9f5
- SHA512 83d205b838d4960b4a211a2cf7b827db3b228f47d261c8416270d9323c1162b6af0d5fcdc2c7e134abc308a63aa6e2e8af40048c0f7d00b4a7333ba37205aca7
- SSDEEP 49152:pVYz1wF3hCVK+SZ+y9Zha0uxNoSNEdyezekG9dbI1IOu4D9f5xOgAiDCU1btNI6o:G
- TLSH T19FE6CF53B94F192792EF5B892C4D9E37BE630F93994B887FC02AE6B7B780140311E564
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 984 WMIC.exe 984 WMIC.exe 984 WMIC.exe 984 WMIC.exe 1992 WMIC.exe 1992 WMIC.exe 1992 WMIC.exe 1992 WMIC.exe 252 WMIC.exe 252 WMIC.exe 252 WMIC.exe 252 WMIC.exe 6052 WMIC.exe 6052 WMIC.exe 6052 WMIC.exe 6052 WMIC.exe 2208 WMIC.exe 2208 WMIC.exe 2208 WMIC.exe 2208 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 984 WMIC.exe Token: SeSecurityPrivilege 984 WMIC.exe Token: SeTakeOwnershipPrivilege 984 WMIC.exe Token: SeLoadDriverPrivilege 984 WMIC.exe Token: SeSystemProfilePrivilege 984 WMIC.exe Token: SeSystemtimePrivilege 984 WMIC.exe Token: SeProfSingleProcessPrivilege 984 WMIC.exe Token: SeIncBasePriorityPrivilege 984 WMIC.exe Token: SeCreatePagefilePrivilege 984 WMIC.exe Token: SeBackupPrivilege 984 WMIC.exe Token: SeRestorePrivilege 984 WMIC.exe Token: SeShutdownPrivilege 984 WMIC.exe Token: SeDebugPrivilege 984 WMIC.exe Token: SeSystemEnvironmentPrivilege 984 WMIC.exe Token: SeRemoteShutdownPrivilege 984 WMIC.exe Token: SeUndockPrivilege 984 WMIC.exe Token: SeManageVolumePrivilege 984 WMIC.exe Token: 33 984 WMIC.exe Token: 34 984 WMIC.exe Token: 35 984 WMIC.exe Token: 36 984 WMIC.exe Token: SeIncreaseQuotaPrivilege 984 WMIC.exe Token: SeSecurityPrivilege 984 WMIC.exe Token: SeTakeOwnershipPrivilege 984 WMIC.exe Token: SeLoadDriverPrivilege 984 WMIC.exe Token: SeSystemProfilePrivilege 984 WMIC.exe Token: SeSystemtimePrivilege 984 WMIC.exe Token: SeProfSingleProcessPrivilege 984 WMIC.exe Token: SeIncBasePriorityPrivilege 984 WMIC.exe Token: SeCreatePagefilePrivilege 984 WMIC.exe Token: SeBackupPrivilege 984 WMIC.exe Token: SeRestorePrivilege 984 WMIC.exe Token: SeShutdownPrivilege 984 WMIC.exe Token: SeDebugPrivilege 984 WMIC.exe Token: SeSystemEnvironmentPrivilege 984 WMIC.exe Token: SeRemoteShutdownPrivilege 984 WMIC.exe Token: SeUndockPrivilege 984 WMIC.exe Token: SeManageVolumePrivilege 984 WMIC.exe Token: 33 984 WMIC.exe Token: 34 984 WMIC.exe Token: 35 984 WMIC.exe Token: 36 984 WMIC.exe Token: SeIncreaseQuotaPrivilege 1992 WMIC.exe Token: SeSecurityPrivilege 1992 WMIC.exe Token: SeTakeOwnershipPrivilege 1992 WMIC.exe Token: SeLoadDriverPrivilege 1992 WMIC.exe Token: SeSystemProfilePrivilege 1992 WMIC.exe Token: SeSystemtimePrivilege 1992 WMIC.exe Token: SeProfSingleProcessPrivilege 1992 WMIC.exe Token: SeIncBasePriorityPrivilege 1992 WMIC.exe Token: SeCreatePagefilePrivilege 1992 WMIC.exe Token: SeBackupPrivilege 1992 WMIC.exe Token: SeRestorePrivilege 1992 WMIC.exe Token: SeShutdownPrivilege 1992 WMIC.exe Token: SeDebugPrivilege 1992 WMIC.exe Token: SeSystemEnvironmentPrivilege 1992 WMIC.exe Token: SeRemoteShutdownPrivilege 1992 WMIC.exe Token: SeUndockPrivilege 1992 WMIC.exe Token: SeManageVolumePrivilege 1992 WMIC.exe Token: 33 1992 WMIC.exe Token: 34 1992 WMIC.exe Token: 35 1992 WMIC.exe Token: 36 1992 WMIC.exe Token: SeIncreaseQuotaPrivilege 1992 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3316 wrote to memory of 2744 3316 wscript.exe 90 PID 3316 wrote to memory of 984 3316 wscript.exe 92 PID 3316 wrote to memory of 1992 3316 wscript.exe 95 PID 3316 wrote to memory of 252 3316 wscript.exe 97 PID 3316 wrote to memory of 6052 3316 wscript.exe 99 PID 3316 wrote to memory of 2208 3316 wscript.exe 101 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2744 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\4ca357df0aaaee10131092025e55bdee4faf3e4055216e77a5407f9f39d8a08c.js1⤵
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\rukaqeg"2⤵
- Views/modifies file attributes
PID:2744
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:984
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\rukaqeg"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:252
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6052
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2208
-