Analysis
- max time kernel
38s - max time network
40s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/08/2026, 02:02
Static task
static1
Behavioral task
behavioral1
Sample
aa06c6b9f0676b66664593106f88cb8ce719f40be1a0372156f64f4dbed84c8b.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
aa06c6b9f0676b66664593106f88cb8ce719f40be1a0372156f64f4dbed84c8b.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target aa06c6b9f0676b66664593106f88cb8ce719f40be1a0372156f64f4dbed84c8b.js
- Size 13.5MB
- Sample260825-cf8fda1zaz
- SHA256 aa06c6b9f0676b66664593106f88cb8ce719f40be1a0372156f64f4dbed84c8b
- MD5 99ea0ba43286edf00b192f5a8364b26c
- SHA1 6afcb44dd693399278b61289a8601804dd0bcaf2
- SHA512 532d9008c020dd1f248dfde52353d1fb911ae2024e736afd58bef2b7b9adbabe77fb296f19e0f489e9f57ab3d2ede965d34d7b6c7dd9d8a81a7e49476a5e28d1
- SSDEEP 49152:BHi0tb8OUC/bebFpJH744B/r3yUk+CGBsvA1SiwqXzSLqeUdFZ0hiyGe7MdUOKD3:3
- TLSH T177E6CF62C16E73719559623836BEBA8BE7E037C74D0A35FC3492AD78DA694C6383500F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation wscript.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4472 WMIC.exe Token: SeSecurityPrivilege 4472 WMIC.exe Token: SeTakeOwnershipPrivilege 4472 WMIC.exe Token: SeLoadDriverPrivilege 4472 WMIC.exe Token: SeSystemProfilePrivilege 4472 WMIC.exe Token: SeSystemtimePrivilege 4472 WMIC.exe Token: SeProfSingleProcessPrivilege 4472 WMIC.exe Token: SeIncBasePriorityPrivilege 4472 WMIC.exe Token: SeCreatePagefilePrivilege 4472 WMIC.exe Token: SeBackupPrivilege 4472 WMIC.exe Token: SeRestorePrivilege 4472 WMIC.exe Token: SeShutdownPrivilege 4472 WMIC.exe Token: SeDebugPrivilege 4472 WMIC.exe Token: SeSystemEnvironmentPrivilege 4472 WMIC.exe Token: SeRemoteShutdownPrivilege 4472 WMIC.exe Token: SeUndockPrivilege 4472 WMIC.exe Token: SeManageVolumePrivilege 4472 WMIC.exe Token: 33 4472 WMIC.exe Token: 34 4472 WMIC.exe Token: 35 4472 WMIC.exe Token: 36 4472 WMIC.exe Token: SeIncreaseQuotaPrivilege 4472 WMIC.exe Token: SeSecurityPrivilege 4472 WMIC.exe Token: SeTakeOwnershipPrivilege 4472 WMIC.exe Token: SeLoadDriverPrivilege 4472 WMIC.exe Token: SeSystemProfilePrivilege 4472 WMIC.exe Token: SeSystemtimePrivilege 4472 WMIC.exe Token: SeProfSingleProcessPrivilege 4472 WMIC.exe Token: SeIncBasePriorityPrivilege 4472 WMIC.exe Token: SeCreatePagefilePrivilege 4472 WMIC.exe Token: SeBackupPrivilege 4472 WMIC.exe Token: SeRestorePrivilege 4472 WMIC.exe Token: SeShutdownPrivilege 4472 WMIC.exe Token: SeDebugPrivilege 4472 WMIC.exe Token: SeSystemEnvironmentPrivilege 4472 WMIC.exe Token: SeRemoteShutdownPrivilege 4472 WMIC.exe Token: SeUndockPrivilege 4472 WMIC.exe Token: SeManageVolumePrivilege 4472 WMIC.exe Token: 33 4472 WMIC.exe Token: 34 4472 WMIC.exe Token: 35 4472 WMIC.exe Token: 36 4472 WMIC.exe Token: SeIncreaseQuotaPrivilege 4864 WMIC.exe Token: SeSecurityPrivilege 4864 WMIC.exe Token: SeTakeOwnershipPrivilege 4864 WMIC.exe Token: SeLoadDriverPrivilege 4864 WMIC.exe Token: SeSystemProfilePrivilege 4864 WMIC.exe Token: SeSystemtimePrivilege 4864 WMIC.exe Token: SeProfSingleProcessPrivilege 4864 WMIC.exe Token: SeIncBasePriorityPrivilege 4864 WMIC.exe Token: SeCreatePagefilePrivilege 4864 WMIC.exe Token: SeBackupPrivilege 4864 WMIC.exe Token: SeRestorePrivilege 4864 WMIC.exe Token: SeShutdownPrivilege 4864 WMIC.exe Token: SeDebugPrivilege 4864 WMIC.exe Token: SeSystemEnvironmentPrivilege 4864 WMIC.exe Token: SeRemoteShutdownPrivilege 4864 WMIC.exe Token: SeUndockPrivilege 4864 WMIC.exe Token: SeManageVolumePrivilege 4864 WMIC.exe Token: 33 4864 WMIC.exe Token: 34 4864 WMIC.exe Token: 35 4864 WMIC.exe Token: 36 4864 WMIC.exe Token: SeIncreaseQuotaPrivilege 4864 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4548 wrote to memory of 4380 4548 wscript.exe 91 PID 4548 wrote to memory of 4472 4548 wscript.exe 93 PID 4548 wrote to memory of 4864 4548 wscript.exe 96 PID 4548 wrote to memory of 204 4548 wscript.exe 98 PID 4548 wrote to memory of 3096 4548 wscript.exe 100 PID 4548 wrote to memory of 1032 4548 wscript.exe 102 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4380 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\aa06c6b9f0676b66664593106f88cb8ce719f40be1a0372156f64f4dbed84c8b.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\mukewaq"2⤵
- Views/modifies file attributes
PID:4380
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4472
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\mukewaq"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵PID:204
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵PID:3096
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵PID:1032
-