Analysis
- max time kernel
40s - max time network
43s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/09/2026, 16:47
Static task
static1
Behavioral task
behavioral1
Sample
06e77487f3691ee558be861227f3eafb01c3a53253b12a4b8bcf295ea4fb07c4.js
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
40 seconds
Behavioral task
behavioral2
Sample
06e77487f3691ee558be861227f3eafb01c3a53253b12a4b8bcf295ea4fb07c4.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
40 seconds
General
- Target 06e77487f3691ee558be861227f3eafb01c3a53253b12a4b8bcf295ea4fb07c4.js
- Size 13.5MB
- Sample260903-vamwlaxycs
- SHA256 06e77487f3691ee558be861227f3eafb01c3a53253b12a4b8bcf295ea4fb07c4
- MD5 72094f5fb3cf768ddc343cd101eec369
- SHA1 b94b354c24e5f0092d151ad25f3f9b2eee436bb9
- SHA512 486e19d8c8dc41590318b6b826afa20c16fbdb73710a0392992e64a53d6a09d0d91810e00c74bab894d65c89252237cf9b326379bd6df471f60f9d02cb5e429f
- SSDEEP 49152:38Mi+S3DO8h+R5qJWgXc/twoG7ITxzBw9la65/q5Pxz+KwnIkDV1EMuEDlZ9UvPd:R
- TLSH T1E9E6D0759DD3A913E38E422AD08FD91A9615007DBB38415D906FEC222FF7AE4F263706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4180 WMIC.exe 4180 WMIC.exe 4180 WMIC.exe 4180 WMIC.exe 3560 WMIC.exe 3560 WMIC.exe 3560 WMIC.exe 3560 WMIC.exe 2532 WMIC.exe 2532 WMIC.exe 2532 WMIC.exe 2532 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4180 WMIC.exe Token: SeSecurityPrivilege 4180 WMIC.exe Token: SeTakeOwnershipPrivilege 4180 WMIC.exe Token: SeLoadDriverPrivilege 4180 WMIC.exe Token: SeSystemProfilePrivilege 4180 WMIC.exe Token: SeSystemtimePrivilege 4180 WMIC.exe Token: SeProfSingleProcessPrivilege 4180 WMIC.exe Token: SeIncBasePriorityPrivilege 4180 WMIC.exe Token: SeCreatePagefilePrivilege 4180 WMIC.exe Token: SeBackupPrivilege 4180 WMIC.exe Token: SeRestorePrivilege 4180 WMIC.exe Token: SeShutdownPrivilege 4180 WMIC.exe Token: SeDebugPrivilege 4180 WMIC.exe Token: SeSystemEnvironmentPrivilege 4180 WMIC.exe Token: SeRemoteShutdownPrivilege 4180 WMIC.exe Token: SeUndockPrivilege 4180 WMIC.exe Token: SeManageVolumePrivilege 4180 WMIC.exe Token: 33 4180 WMIC.exe Token: 34 4180 WMIC.exe Token: 35 4180 WMIC.exe Token: 36 4180 WMIC.exe Token: SeIncreaseQuotaPrivilege 4180 WMIC.exe Token: SeSecurityPrivilege 4180 WMIC.exe Token: SeTakeOwnershipPrivilege 4180 WMIC.exe Token: SeLoadDriverPrivilege 4180 WMIC.exe Token: SeSystemProfilePrivilege 4180 WMIC.exe Token: SeSystemtimePrivilege 4180 WMIC.exe Token: SeProfSingleProcessPrivilege 4180 WMIC.exe Token: SeIncBasePriorityPrivilege 4180 WMIC.exe Token: SeCreatePagefilePrivilege 4180 WMIC.exe Token: SeBackupPrivilege 4180 WMIC.exe Token: SeRestorePrivilege 4180 WMIC.exe Token: SeShutdownPrivilege 4180 WMIC.exe Token: SeDebugPrivilege 4180 WMIC.exe Token: SeSystemEnvironmentPrivilege 4180 WMIC.exe Token: SeRemoteShutdownPrivilege 4180 WMIC.exe Token: SeUndockPrivilege 4180 WMIC.exe Token: SeManageVolumePrivilege 4180 WMIC.exe Token: 33 4180 WMIC.exe Token: 34 4180 WMIC.exe Token: 35 4180 WMIC.exe Token: 36 4180 WMIC.exe Token: SeIncreaseQuotaPrivilege 3560 WMIC.exe Token: SeSecurityPrivilege 3560 WMIC.exe Token: SeTakeOwnershipPrivilege 3560 WMIC.exe Token: SeLoadDriverPrivilege 3560 WMIC.exe Token: SeSystemProfilePrivilege 3560 WMIC.exe Token: SeSystemtimePrivilege 3560 WMIC.exe Token: SeProfSingleProcessPrivilege 3560 WMIC.exe Token: SeIncBasePriorityPrivilege 3560 WMIC.exe Token: SeCreatePagefilePrivilege 3560 WMIC.exe Token: SeBackupPrivilege 3560 WMIC.exe Token: SeRestorePrivilege 3560 WMIC.exe Token: SeShutdownPrivilege 3560 WMIC.exe Token: SeDebugPrivilege 3560 WMIC.exe Token: SeSystemEnvironmentPrivilege 3560 WMIC.exe Token: SeRemoteShutdownPrivilege 3560 WMIC.exe Token: SeUndockPrivilege 3560 WMIC.exe Token: SeManageVolumePrivilege 3560 WMIC.exe Token: 33 3560 WMIC.exe Token: 34 3560 WMIC.exe Token: 35 3560 WMIC.exe Token: 36 3560 WMIC.exe Token: SeIncreaseQuotaPrivilege 3560 WMIC.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5840 wrote to memory of 5928 5840 wscript.exe 90 PID 5840 wrote to memory of 4180 5840 wscript.exe 92 PID 5840 wrote to memory of 3560 5840 wscript.exe 95 PID 5840 wrote to memory of 2532 5840 wscript.exe 97 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 5928 attrib.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\06e77487f3691ee558be861227f3eafb01c3a53253b12a4b8bcf295ea4fb07c4.js1⤵
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\System32\attrib.exe"C:\Windows\System32\attrib.exe" +h +s "C:\Users\Public\IIPaint\ladeyet"2⤵
- Views/modifies file attributes
PID:5928
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4180
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Public\IIPaint\ladeyet"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3560
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2532
-