Analysis
- max time kernel
40s - max time network
26s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 02:02
Static task
static1
Behavioral task
behavioral1
Sample
aa06c6b9f0676b66664593106f88cb8ce719f40be1a0372156f64f4dbed84c8b.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
aa06c6b9f0676b66664593106f88cb8ce719f40be1a0372156f64f4dbed84c8b.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target aa06c6b9f0676b66664593106f88cb8ce719f40be1a0372156f64f4dbed84c8b.js
- Size 13.5MB
- Sample260825-cf8fda1zaz
- SHA256 aa06c6b9f0676b66664593106f88cb8ce719f40be1a0372156f64f4dbed84c8b
- MD5 99ea0ba43286edf00b192f5a8364b26c
- SHA1 6afcb44dd693399278b61289a8601804dd0bcaf2
- SHA512 532d9008c020dd1f248dfde52353d1fb911ae2024e736afd58bef2b7b9adbabe77fb296f19e0f489e9f57ab3d2ede965d34d7b6c7dd9d8a81a7e49476a5e28d1
- SSDEEP 49152:BHi0tb8OUC/bebFpJH744B/r3yUk+CGBsvA1SiwqXzSLqeUdFZ0hiyGe7MdUOKD3:3
- TLSH T177E6CF62C16E73719559623836BEBA8BE7E037C74D0A35FC3492AD78DA694C6383500F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 5188 WMIC.exe 5188 WMIC.exe 5188 WMIC.exe 5188 WMIC.exe 4152 WMIC.exe 4152 WMIC.exe 4152 WMIC.exe 4152 WMIC.exe 2128 WMIC.exe 2128 WMIC.exe 2128 WMIC.exe 2128 WMIC.exe 4132 WMIC.exe 4132 WMIC.exe 4132 WMIC.exe 4132 WMIC.exe 4992 WMIC.exe 4992 WMIC.exe 4992 WMIC.exe 4992 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5188 WMIC.exe Token: SeSecurityPrivilege 5188 WMIC.exe Token: SeTakeOwnershipPrivilege 5188 WMIC.exe Token: SeLoadDriverPrivilege 5188 WMIC.exe Token: SeSystemProfilePrivilege 5188 WMIC.exe Token: SeSystemtimePrivilege 5188 WMIC.exe Token: SeProfSingleProcessPrivilege 5188 WMIC.exe Token: SeIncBasePriorityPrivilege 5188 WMIC.exe Token: SeCreatePagefilePrivilege 5188 WMIC.exe Token: SeBackupPrivilege 5188 WMIC.exe Token: SeRestorePrivilege 5188 WMIC.exe Token: SeShutdownPrivilege 5188 WMIC.exe Token: SeDebugPrivilege 5188 WMIC.exe Token: SeSystemEnvironmentPrivilege 5188 WMIC.exe Token: SeRemoteShutdownPrivilege 5188 WMIC.exe Token: SeUndockPrivilege 5188 WMIC.exe Token: SeManageVolumePrivilege 5188 WMIC.exe Token: 33 5188 WMIC.exe Token: 34 5188 WMIC.exe Token: 35 5188 WMIC.exe Token: 36 5188 WMIC.exe Token: SeIncreaseQuotaPrivilege 5188 WMIC.exe Token: SeSecurityPrivilege 5188 WMIC.exe Token: SeTakeOwnershipPrivilege 5188 WMIC.exe Token: SeLoadDriverPrivilege 5188 WMIC.exe Token: SeSystemProfilePrivilege 5188 WMIC.exe Token: SeSystemtimePrivilege 5188 WMIC.exe Token: SeProfSingleProcessPrivilege 5188 WMIC.exe Token: SeIncBasePriorityPrivilege 5188 WMIC.exe Token: SeCreatePagefilePrivilege 5188 WMIC.exe Token: SeBackupPrivilege 5188 WMIC.exe Token: SeRestorePrivilege 5188 WMIC.exe Token: SeShutdownPrivilege 5188 WMIC.exe Token: SeDebugPrivilege 5188 WMIC.exe Token: SeSystemEnvironmentPrivilege 5188 WMIC.exe Token: SeRemoteShutdownPrivilege 5188 WMIC.exe Token: SeUndockPrivilege 5188 WMIC.exe Token: SeManageVolumePrivilege 5188 WMIC.exe Token: 33 5188 WMIC.exe Token: 34 5188 WMIC.exe Token: 35 5188 WMIC.exe Token: 36 5188 WMIC.exe Token: SeIncreaseQuotaPrivilege 4152 WMIC.exe Token: SeSecurityPrivilege 4152 WMIC.exe Token: SeTakeOwnershipPrivilege 4152 WMIC.exe Token: SeLoadDriverPrivilege 4152 WMIC.exe Token: SeSystemProfilePrivilege 4152 WMIC.exe Token: SeSystemtimePrivilege 4152 WMIC.exe Token: SeProfSingleProcessPrivilege 4152 WMIC.exe Token: SeIncBasePriorityPrivilege 4152 WMIC.exe Token: SeCreatePagefilePrivilege 4152 WMIC.exe Token: SeBackupPrivilege 4152 WMIC.exe Token: SeRestorePrivilege 4152 WMIC.exe Token: SeShutdownPrivilege 4152 WMIC.exe Token: SeDebugPrivilege 4152 WMIC.exe Token: SeSystemEnvironmentPrivilege 4152 WMIC.exe Token: SeRemoteShutdownPrivilege 4152 WMIC.exe Token: SeUndockPrivilege 4152 WMIC.exe Token: SeManageVolumePrivilege 4152 WMIC.exe Token: 33 4152 WMIC.exe Token: 34 4152 WMIC.exe Token: 35 4152 WMIC.exe Token: 36 4152 WMIC.exe Token: SeIncreaseQuotaPrivilege 4152 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2548 wrote to memory of 3300 2548 wscript.exe 90 PID 2548 wrote to memory of 5188 2548 wscript.exe 92 PID 2548 wrote to memory of 4152 2548 wscript.exe 95 PID 2548 wrote to memory of 2128 2548 wscript.exe 97 PID 2548 wrote to memory of 4132 2548 wscript.exe 99 PID 2548 wrote to memory of 4992 2548 wscript.exe 101 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3300 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\aa06c6b9f0676b66664593106f88cb8ce719f40be1a0372156f64f4dbed84c8b.js1⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\mukewaq"2⤵
- Views/modifies file attributes
PID:3300
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5188
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\mukewaq"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4152
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2128
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4132
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4992
-