Analysis
- max time kernel
38s - max time network
37s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/08/2026, 03:02
Static task
static1
Behavioral task
behavioral1
Sample
e6d0f0b93c12628872622c103b6fdd5227fc94b432ffe431df6e77cb4676830c.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
e6d0f0b93c12628872622c103b6fdd5227fc94b432ffe431df6e77cb4676830c.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target e6d0f0b93c12628872622c103b6fdd5227fc94b432ffe431df6e77cb4676830c.js
- Size 13.5MB
- Sample260825-djn2kssshv
- SHA256 e6d0f0b93c12628872622c103b6fdd5227fc94b432ffe431df6e77cb4676830c
- MD5 e750308224f7dd39507dfc403a7da7c0
- SHA1 81c079573669fe20bf277a6772db735a5caf5d05
- SHA512 37766769dcc90bc8f43ad6d0d68e45e56f9918546b69bd93253d960c44398b9b8ed87ff30f695ab3e1d4d4813952087b78f2347676ddee79ddf158fef78861f2
- SSDEEP 49152:fnPEKz4oI5R+E9MsV4qpBSTkCpGifZs/ymYnB5KX8qj0npvMmJxAsXIqgIGZJ3DZ:a
- TLSH T146E6E0424F85798BC2182D0573CB6BA320E721A690E2DD8E75F6F17F9A4CF772522E05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation wscript.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4540 WMIC.exe Token: SeSecurityPrivilege 4540 WMIC.exe Token: SeTakeOwnershipPrivilege 4540 WMIC.exe Token: SeLoadDriverPrivilege 4540 WMIC.exe Token: SeSystemProfilePrivilege 4540 WMIC.exe Token: SeSystemtimePrivilege 4540 WMIC.exe Token: SeProfSingleProcessPrivilege 4540 WMIC.exe Token: SeIncBasePriorityPrivilege 4540 WMIC.exe Token: SeCreatePagefilePrivilege 4540 WMIC.exe Token: SeBackupPrivilege 4540 WMIC.exe Token: SeRestorePrivilege 4540 WMIC.exe Token: SeShutdownPrivilege 4540 WMIC.exe Token: SeDebugPrivilege 4540 WMIC.exe Token: SeSystemEnvironmentPrivilege 4540 WMIC.exe Token: SeRemoteShutdownPrivilege 4540 WMIC.exe Token: SeUndockPrivilege 4540 WMIC.exe Token: SeManageVolumePrivilege 4540 WMIC.exe Token: 33 4540 WMIC.exe Token: 34 4540 WMIC.exe Token: 35 4540 WMIC.exe Token: 36 4540 WMIC.exe Token: SeIncreaseQuotaPrivilege 4540 WMIC.exe Token: SeSecurityPrivilege 4540 WMIC.exe Token: SeTakeOwnershipPrivilege 4540 WMIC.exe Token: SeLoadDriverPrivilege 4540 WMIC.exe Token: SeSystemProfilePrivilege 4540 WMIC.exe Token: SeSystemtimePrivilege 4540 WMIC.exe Token: SeProfSingleProcessPrivilege 4540 WMIC.exe Token: SeIncBasePriorityPrivilege 4540 WMIC.exe Token: SeCreatePagefilePrivilege 4540 WMIC.exe Token: SeBackupPrivilege 4540 WMIC.exe Token: SeRestorePrivilege 4540 WMIC.exe Token: SeShutdownPrivilege 4540 WMIC.exe Token: SeDebugPrivilege 4540 WMIC.exe Token: SeSystemEnvironmentPrivilege 4540 WMIC.exe Token: SeRemoteShutdownPrivilege 4540 WMIC.exe Token: SeUndockPrivilege 4540 WMIC.exe Token: SeManageVolumePrivilege 4540 WMIC.exe Token: 33 4540 WMIC.exe Token: 34 4540 WMIC.exe Token: 35 4540 WMIC.exe Token: 36 4540 WMIC.exe Token: SeIncreaseQuotaPrivilege 2804 WMIC.exe Token: SeSecurityPrivilege 2804 WMIC.exe Token: SeTakeOwnershipPrivilege 2804 WMIC.exe Token: SeLoadDriverPrivilege 2804 WMIC.exe Token: SeSystemProfilePrivilege 2804 WMIC.exe Token: SeSystemtimePrivilege 2804 WMIC.exe Token: SeProfSingleProcessPrivilege 2804 WMIC.exe Token: SeIncBasePriorityPrivilege 2804 WMIC.exe Token: SeCreatePagefilePrivilege 2804 WMIC.exe Token: SeBackupPrivilege 2804 WMIC.exe Token: SeRestorePrivilege 2804 WMIC.exe Token: SeShutdownPrivilege 2804 WMIC.exe Token: SeDebugPrivilege 2804 WMIC.exe Token: SeSystemEnvironmentPrivilege 2804 WMIC.exe Token: SeRemoteShutdownPrivilege 2804 WMIC.exe Token: SeUndockPrivilege 2804 WMIC.exe Token: SeManageVolumePrivilege 2804 WMIC.exe Token: 33 2804 WMIC.exe Token: 34 2804 WMIC.exe Token: 35 2804 WMIC.exe Token: 36 2804 WMIC.exe Token: SeIncreaseQuotaPrivilege 2804 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2308 wrote to memory of 2396 2308 wscript.exe 91 PID 2308 wrote to memory of 4540 2308 wscript.exe 93 PID 2308 wrote to memory of 2804 2308 wscript.exe 96 PID 2308 wrote to memory of 3960 2308 wscript.exe 98 PID 2308 wrote to memory of 1360 2308 wscript.exe 100 PID 2308 wrote to memory of 3408 2308 wscript.exe 102 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2396 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\e6d0f0b93c12628872622c103b6fdd5227fc94b432ffe431df6e77cb4676830c.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\mukewaq"2⤵
- Views/modifies file attributes
PID:2396
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4540
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\mukewaq"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵PID:3960
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\cmd.exe"2⤵PID:1360
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionProcess="C:\Windows\System32\clip.exe"2⤵PID:3408
-