34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 48:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T48d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 0ac637abca78… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0ac637abca78…. Malware family: Trojan.Generic. Threat score 100/100. 6/24 AV engines flagged this file. 3 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67"],"about":{"@type":"SoftwareApplication","name":"BBK Transfer-SOA.JS","applicationCategory":["script","javascript"],"identifier":"0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":6,"total":24},"behavioralIndicators":{"malicious":3,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T84c,"WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCHANDLER") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCHANDLER") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\TREATAS") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\TREATAS") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCHANDLER32") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCHANDLER32") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\LOCALSERVER32") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\LOCALSERVER32") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\LOCALSERVER") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\LOCALSERVER") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\ELEVATION") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\ELEVATION") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\PROGID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\PROGID") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\PROGID")37:Ta22,"WScript.exe" queried SystemProcessInformation at 00000000-00005136-00000C15-997191909 [PID: 5136] "WScript.exe" queried SystemProcessInformation at 00000000-00005136-00000C15-997198533 [PID: 5136] "WScript.exe" queried SystemProcessInformation at 00000000-00005136-00000C15-997413557 [PID: 5136] "WScript.exe" queried SystemProcessInformation at 00000000-00005136-00000C15-997419952 [PID: 5136] "WScript.exe" queried SystemProcessInformation at 00000000-00005136-00000C15-998472709 [PID: 5136] "WScript.exe" queried SystemProcessInformation at 00000000-00005136-00000C15-998479386 [PID: 5136] "WScript.exe" queried SystemProcessInformation at 00000000-00005136-00000C15-999047477 [PID: 5136] "WScript.exe" queried SystemProcessInformation at 00000000-00005136-00000C15-999058026 [PID: 5136] "WScript.exe" queried SystemProcessInformation at 00000000-00005136-00000C15-1001154769 [PID: 5136] "WScript.exe" queried SystemProcessInformation at 00000000-00005136-00000C15-1001162046 [PID: 5136] "cmd.exe" queried SystemProcessInformation at 00000000-00000300-00000C15-1000623685 [PID: 300] "cmd.exe" queried SystemProcessInformation at 00000000-00000300-00000C15-1000646497 [PID: 300] "cmd.exe" queried SystemProcessInformation at 00000000-00000300-00000C15-1000912214 [PID: 300] "cmd.exe" queried SystemProcessInformation at 00000000-00000300-00000C15-1000918865 [PID: 300] "TNZSOLLUCUPMVOMN.exe" queried SystemProcessInformation at 00000000-00004980-00000C15-1009430693 [PID: 4980] "TNZSOLLUCUPMVOMN.exe" queried SystemProcessInformation at 00000000-00004980-00000C15-1009439159 [PID: 4980] "TNZSOLLUCUPMVOMN.exe" queried SystemProcessInformation at 00000000-00004980-00000C15-1009659945 [PID: 4980] "TNZSOLLUCUPMVOMN.exe" queried SystemProcessInformation at 00000000-00004980-00000C15-1009666587 [PID: 4980] "TNZSOLLUCUPMVOMN.exe" queried SystemProcessInformation at 00000000-00004980-00000C15-1009847825 [PID: 4980] "TNZSOLLUCUPMVOMN.exe" queried SystemProcessInformation at 00000000-00004980-00000C15-1009854657 [PID: 4980] "TNZSOLLUCUPMVOMN.exe" queried SystemProcessInformation at 00000000-00004980-00000C15-1012715517 [PID: 4980] "TNZSOLLUCUPMVOMN.exe" queried SystemProcessInformation at 00000000-00004980-00000C15-1012721984 [PID: 4980] "TNZSOLLUCUPMVOMN.exe" queried SystemProcessInformation at 00000000-00004980-00000C15-1013218494 [PID: 4980] "TNZSOLLUCUPMVOMN.exe" queried SystemProcessInformation at 00000000-00004980-00000C15-1013225222 [PID: 4980] "TNZSOLLUCUPMVOMN.exe" queried SystemProcessInformation at 00000000-00004980-00000C15-1013565270 [PID: 4980]38:T1d92,"WScript.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005136) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005136) "WScript.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938846efd7f00008000000000000000000000000000000000958779f80100001033c070fd7f000000000000000000000000e46ffd7f0000e0b91946a80000001041816efd7f0000307b8779f8010000a0b91946a8000000000000000000000000000000000000000100000000000000b840816efd7f0000000000000000000001000000000000000000e46ffd7f00003b4d486efd7f0000000000000000000098be1946a80000000000000000000000d02af66ffd7f000010b35c70fd7f0000e8f8806efd7f000010b35c70fd7f0000d02af66ffd7f00000d000000fd7f00000d00000000000000a0f64c70fd7f0000f587f16ffd7f0000d02af66f (UID: 00000000-00005136) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000000060b68d79f80100001ac28b79f801000030c18b79f801000088aacf46a800000078aacf46a800000078aacf460100000088accf46a800000048739c70fd7f0000000000000000000060b68d79f8010000ef5e166cfd7f0000801d676cfd7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000d6c18b79f8010000ecc18b79f8010000d6c18b79f80100001ac28b79f8010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d6c18b79 (UID: 00000000-00005136) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000b0ac8d79f80100000cd28b79f801000020d18b79f801000088aacf46a800000078aacf46a800000078aacf460100000088accf46a800000048739c70fd7f00000000000000000000b0ac8d79f8010000ef5e166cfd7f0000801d676cfd7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000c6d18b79f8010000ded18b79f8010000c6d18b79f80100000cd28b79f8010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d18b79 (UID: 00000000-00005136) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000000000b28d79f801000088378e79f8010000a0368e79f801000088aacf46a800000078aacf46a800000078aacf460100000088accf46a800000048739c70fd7f0000000000000000000000b28d79f8010000ef5e166cfd7f0000801d676cfd7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000046378e79f80100005a378e79f801000046378e79f801000088378e79f801000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000046378e79 (UID: 00000000-00005136) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000a0b28d79f80100001cc28b79f801000030c18b79f801000088aacf46a800000078aacf46a800000078aacf460100000088accf46a800000048739c70fd7f00000000000000000000a0b28d79f8010000ef5e166cfd7f0000801d676cfd7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000d6c18b79f8010000eec18b79f8010000d6c18b79f80100001cc28b79f8010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d6c18b79 (UID: 00000000-00005136) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000a0b78d79f80100000ad28b79f801000020d18b79f801000088aacf46a800000078aacf46a800000078aacf460100000088accf46a800000048739c70fd7f00000000000000000000a0b78d79f8010000ef5e166cfd7f0000801d676cfd7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000c6d18b79f8010000dcd18b79f8010000c6d18b79f80100000ad28b79f8010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d18b79 (UID: 00000000-00005136) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000000030b98d79f80100001cc28b79f801000030c18b79f801000088aacf46a800000078aacf46a800000078aacf460100000088accf46a800000048739c70fd7f0000000000000000000030b98d79f8010000ef5e166cfd7f0000801d676cfd7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000d6c18b79f8010000eec18b79f8010000d6c18b79f80100001cc28b79f8010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d6c18b79 (UID: 00000000-00005136) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000d0b48d79f80100000cd28b79f801000020d18b79f801000088aacf46a800000078aacf46a800000078aacf460100000088accf46a800000048739c70fd7f00000000000000000000d0b48d79f8010000ef5e166cfd7f0000801d676cfd7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000c6d18b79f8010000ded18b79f8010000c6d18b79f80100000cd28b79f8010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d18b79 (UID: 00000000-00005136) "WScript.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005136) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000feffff7f00000000660c000000000000fc000000000000008eb91946a800000000000000000000000400000000000000be39466efd7f000048739c70fd7f000000000000000000009056c97bf801000020ad1946a80000000a000000000000009052c97bf80100000000000000000000000000000000000043003a005c005500730065007200730000004c005300490044003a002500770073000000000000000000000000000000000000000000000000000000000000000000000000000000c9d2be70fd7f000059006b000000000020000000000000000037c87bf801000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005136)39:T8c8,"WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000000000000000d4aff67f00000000000000000000180000000000000000000000000000000000000000000000d9bef4ea6cf30000908cbd613c66000000000000000000003abda441fd7f00000600000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000d4af (UID: 00000000-00005136) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000070e88379f8010000c0fb7c49fd7f00000001000000000000b8fb7c49fd7f0000000000000000000080cb7c6ffd7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a7c49fd7f00000000000000000000b8fb7c49fd7f000000000000 (UID: 00000000-00005136) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000863c1f49fd7f0000104c1f49fd7f000040b32149fd7f0000104c1f49fd7f000040b32149fd7f000020b32149fd7f00009d3c1f49fd7f000060262249fd7f000040beaf79f801000050beaf79f80100000000596ffd7f00000100000000000000bddb7e6ffd7f0000000000000000000038b32149fd7f000000000000 (UID: 00000000-00005136) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000000000002a42bf70fd7f0000e802af79f8010000593e0b46a80000000000af79f80100002800000000000000a020a57bf80100009020a57bf80100008000000000000000c8f2be70fd7f00000000af79f8010000593e0b46a8000000801ca57bf801000069000000000000002800000000000000280000000000000000000000 (UID: 00000000-00005136) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000ba48f448fd7f00006055f448fd7f0000b067f648fd7f00006055f448fd7f0000b067f648fd7f00009067f648fd7f0000d148f448fd7f0000000000000000000044614c6efd7f0000480db37bf80100000000bd70fd7f00000100000000000000bddb7e6ffd7f00000100000000000000743bf448fd7f0000a0d88779 (UID: 00000000-00005136) "WScript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000f07e8779f801000018371d49fd7f0000000100000000000010371d49fd7f0000000000000000000080cb7c6ffd7f000000000000000000000001000000000000f6ac6717e3ba00000000f448fd7f000001000000000000003f111c49fd7f0000000000000000000010371d49fd7f000000000000 (UID: 00000000-00005136)3a:T120a,"WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005136) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005136) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005136) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005136) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005136) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005136) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005136) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00005136) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005136) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00005136) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00005136) "WScript.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005136) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005136) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005136) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter Psapi (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter shcore (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter Shell32 (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter Shlwapi (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter Iphlpapi (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter Advapi32.dll (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004980)3b:T3e1f,"WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter LogStagedFeatureUsage (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiNotify (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter SetCriticalSectionSpinCount (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00005136) "WScript.exe" called "GetProcAddress" with a parameter NtUpdateWnfStateData (UID: 00000000-00005136) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000300) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000300) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000300) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000300) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000300) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000300) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter NtQueryVirtualMemory (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter RtlCompareMemory (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter NtProtectVirtualMemory (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter NtFlushInstructionCache (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemory (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter NtFreeVirtualMemory (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter NtSetInformationThread (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter NtSetInformationProcess (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter FlushInstructionCache (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter SetPriorityClass (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004980) "TNZSOLLUCUPMVOMN.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004980)3c:T8fc,Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5136:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5136:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5136:120:WilError_03" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5136:120:WilError_03" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process WScript.exe created mutex with name "SM0:5136:304:WilStaging_02" Process WScript.exe created mutex with name "Local\SM0:5136:304:WilStaging_02" Process WScript.exe created mutex with name "Local\SM0:5136:120:WilError_03" Process WScript.exe created mutex with name "Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "SM0:5136:120:WilError_03" Process WScript.exe created mutex with name "Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process WScript.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:300:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:300:304:WilStaging_02" Process cmd.exe created mutex with name "SM0:300:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:300:304:WilStaging_02" Process TNZSOLLUCUPMVOMN.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4980:168:WilStaging_02" Process TNZSOLLUCUPMVOMN.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4980:168:WilStaging_02" Process TNZSOLLUCUPMVOMN.exe created mutex with name "\Sessions\1\BaseNamedObjects\Rmc-767GE7" Process TNZSOLLUCUPMVOMN.exe created mutex with name "Local\SM0:4980:168:WilStaging_02" Process TNZSOLLUCUPMVOMN.exe created mutex with name "SM0:4980:168:WilStaging_02" Process TNZSOLLUCUPMVOMN.exe created mutex with name "Rmc-767GE7"3d:T1722,"WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd41990000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffd6b600000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7ffd6f880000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7ffd6ec90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 7ffd40db0000 "WScript.exe" loaded module "AMSI.DLL" at base 7ffd60bf0000 "WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd6e440000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd6e440000 "WScript.exe" loaded module "KERNEL32" at base 7ffd6ec90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffd64550000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ffd60950000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd6e440000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\D7IR84EC.DLL" at base 7ffd517c0000 "WScript.exe" loaded module "WLDP.DLL" at base 7ffd6d7c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffd6fa50000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffd6cf90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffd497e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffd6e2d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffd497c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ffd491f0000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7ffd49d40000 "WScript.exe" loaded module "USER32.DLL" at base 7ffd6f590000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffd6ec90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ffd491c0000 "WScript.exe" loaded module "SHELL32.DLL" at base 7ffd6fe40000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffd6bfd0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffd67a20000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffd5a840000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffd5edd0000 "WScript.exe" loaded module "SSPICLI.DLL" at base 7ffd6d270000 "WScript.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffd6e440000 "WScript.exe" loaded module "VIRTDISK.DLL" at base 7ffd58da0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ffd6be90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffd54980000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffd66f10000 "WScript.exe" loaded module "NTDLL.DLL" at base 7ffd70bb0000 "WScript.exe" loaded module "KERNELBASE" at base 7ffd6e440000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base 7ffd48f40000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 7ffd405e0000 "WScript.exe" loaded module "%COMMONPROGRAMFILES%\SYSTEM\ADO\MSADO15.DLL" at base 7ffd38820000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffd6b460000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd41990000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffd6d020000 "TNZSOLLUCUPMVOMN.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74760000 "TNZSOLLUCUPMVOMN.exe" loaded module "KERNEL32.DLL" at base 76630000 "TNZSOLLUCUPMVOMN.exe" loaded module "USER32.DLL" at base 76480000 "TNZSOLLUCUPMVOMN.exe" loaded module "NTDLL.DLL" at base 774e0000 "TNZSOLLUCUPMVOMN.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76960000 "TNZSOLLUCUPMVOMN.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76960000 "TNZSOLLUCUPMVOMN.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76960000 "TNZSOLLUCUPMVOMN.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76960000 "TNZSOLLUCUPMVOMN.exe" loaded module "KERNEL32" at base 76630000 "TNZSOLLUCUPMVOMN.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 73f80000 "TNZSOLLUCUPMVOMN.exe" loaded module "ADVAPI32.DLL" at base 75780000 "TNZSOLLUCUPMVOMN.exe" loaded module "GDI32.DLL" at base 76830000 "TNZSOLLUCUPMVOMN.exe" loaded module "AMSI.DLL" at base 73e80000 "TNZSOLLUCUPMVOMN.exe" loaded module "WININET.DLL" at base 74ab0000 "TNZSOLLUCUPMVOMN.exe" loaded module "MSCOREE.DLL" at base 73e40000 "TNZSOLLUCUPMVOMN.exe" loaded module "SHELL32.DLL" at base 76d70000 "TNZSOLLUCUPMVOMN.exe" loaded module "WINMM.DLL" at base 75190000 "TNZSOLLUCUPMVOMN.exe" loaded module "URLMON.DLL" at base 73c90000 "TNZSOLLUCUPMVOMN.exe" loaded module "GDIPLUS.DLL" at base 738c0000 "TNZSOLLUCUPMVOMN.exe" loaded module "PSAPI" at base 75b30000 "TNZSOLLUCUPMVOMN.exe" loaded module "SHCORE" at base 756c0000 "TNZSOLLUCUPMVOMN.exe" loaded module "NTDLL" at base 774e0000 "TNZSOLLUCUPMVOMN.exe" loaded module "SHELL32" at base 76d70000 "TNZSOLLUCUPMVOMN.exe" loaded module "SHLWAPI" at base 75800000 "TNZSOLLUCUPMVOMN.exe" loaded module "IPHLPAPI" at base 74a80000 "TNZSOLLUCUPMVOMN.exe" loaded module "RPCRT4.DLL" at base 75b40000 "TNZSOLLUCUPMVOMN.exe" loaded module "SSPICLI.DLL" at base 73890000 "TNZSOLLUCUPMVOMN.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 76960000 "TNZSOLLUCUPMVOMN.exe" loaded module "BCRYPT.DLL" at base 73870000 "TNZSOLLUCUPMVOMN.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76be0000 "TNZSOLLUCUPMVOMN.exe" loaded module "IPHLPAPI.DLL" at base 74a80000 "TNZSOLLUCUPMVOMN.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73710000 "TNZSOLLUCUPMVOMN.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 736e00003e:Tbf2,"WScript.exe" called "WScript.ScriptFullName" with result: "C:\BBKTransfer-SOA.JS" ... "WScript.exe" called "WScript.ScriptName" with result: "BBKTransfer-SOA.JS" ... "WScript.exe" called "Microsoft.XMLDOM.1.0.CreateObject" ... "WScript.exe" called "Microsoft.XMLDOM.1.0.createElement" with result: "IDispatch" ... "WScript.exe" called "Microsoft.XMLDOM.1.0("createElement").dataType" ... "WScript.exe" called "Microsoft.XMLDOM.1.0("createElement").text" ... "WScript.exe" called "ADODB.Stream.6.0.CreateObject" ... "WScript.exe" called "ADODB.Stream.6.0.Type" ... "WScript.exe" called "Microsoft.XMLDOM.1.0("createElement").nodeTypedValue" with result: "local TNZSOLLU = "|J;;;;;;;;;;;;;;;;;;wwKL>. xtziI.3MKO|TOVPZ:o+g14;imwgi4jH.xt2iGNxYSXI8LW.:xNziM.3QLO|TGvY5k:|hIh0///Pso/1INyQ|j9////PvojQ|j9fN2LSR H;4 qQiHgew;wQjNJwi;;;;HwQNH`Qi:;Tj?kY;2+g LO:ZJXI 1k4/w0I?<1I 9sI?xN2ivIU.3OJ?TM?gY;KiR| tIgi3jn8LSxYvHt;:PY;hPILyR|zsIIxN2izHG:5PIMUw4M+5I:LWX|jtYplW>pJL?LiR|`tIHxN2iU.3OLW>plWK.xtWjGttIg.3YLW.R?xR| tIGxNziQw+g T:x q.TN500Le8i////RR4 2XY7iotIQ.3MLy;x ivI;;;;uh+PGhR|z0oQ5<3YJ?S|zkYN ;ew5<3YL?R|zsIG.PI;;Mw0o/ ;ZJ+?NUk3OImxYvg/geMWy.i; KWX|7sYexNWi2LSext2iGxQ|zkY7iU.R;LS|xt0i?R:7 OMTN<8iZTGw|0+P;" ..., "WScript.exe" called "ADODB.Stream.6.0.Write" ... , "WScript.exe" called "ADODB.Stream.6.0.Position" ... , "WScript.exe" called "ADODB.Stream.6.0.SaveToFile" ... , "WScript.exe" called "Microsoft.XMLDOM.1.0("createElement").nodeTypedValue" with result: "MZ" ..., "WScript.exe" called "WScript.CreateObject" with result: "IDispatch" ...3f:T1376,"WScript.exe" touched "Activation Layout Preferences" (Path: "HKCU\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}\TREATAS") "WScript.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "WScript.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "WScript.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\PROGID") "WScript.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\PROGID") "WScript.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\PROGID") "WScript.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\PROGID") "WScript.exe" touched "JScript Language" (Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\TREATAS") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "WScript.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "WScript.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "WScript.exe" touched "XML DOM Document" (Path: "HKCU\CLSID\{2933BF90-7B36-11D2-B20E-00C04F983E60}\TREATAS") "WScript.exe" touched "ADODB.Stream" (Path: "HKCU\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\TREATAS") "WScript.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "WScript.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "WScript.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "WScript.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "WScript.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "WScript.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "WScript.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "WScript.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "WScript.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "WScript.exe" touched "This Device" (Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "WScript.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "WScript.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "WScript.exe" touched "StreamBackedFolder" (Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "WScript.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "WScript.exe" touched "Removable Drives" (Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER")40:T620,"WScript.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "WScript.exe" reads file "C:\Users\desktop.ini" "WScript.exe" reads file "C:\Users\Public\desktop.ini" "WScript.exe" reads file "C:\Users\Public\Desktop\desktop.ini" "WScript.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini" "WScript.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini" "WScript.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" "WScript.exe" reads file "C:\Windows\Fonts\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini"41:Tab9,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "")42:Tf3d,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINBROKERFORMEDIUMILCONTAINER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "")43:T4b2,"WScript.exe" trying to touch file "C:\Windows\System32\VERSION.dll" "WScript.exe" trying to touch file "C:\Windows\System32\version.dll" "WScript.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "WScript.exe" trying to touch file "C:\Windows\System32\imm32.dll" "WScript.exe" trying to touch file "C:\Windows\System32\en-US\wscript.exe.mui" "WScript.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "WScript.exe" trying to touch file "C:\Windows\System32\FLTLIB.DLL" "WScript.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "WScript.exe" trying to touch file "C:\Windows\System32\MSVCP140.dll" "WScript.exe" trying to touch file "C:\Windows\System32\msvcp140.dll" "WScript.exe" trying to touch file "C:\Windows\System32\VCRUNTIME140.dll" "WScript.exe" trying to touch file "C:\Windows\System32\vcruntime140.dll" "WScript.exe" trying to touch file "C:\Windows\System32\VCRUNTIME140_1.dll" "WScript.exe" trying to touch file "C:\Windows\System32\vcruntime140_1.dll" "WScript.exe" trying to touch file "C:\Windows\System32\WScript.exe" "WScript.exe" trying to touch file "\Global??\FltMgrMsg" "WScript.exe" trying to touch file "C:\Windows\System32\CRYPTSP.DLL"44:T839,"WScript.exe" trying to access non-existent file "C:\Windows\System32\MsMpLics.dll" "WScript.exe" trying to access non-existent file "C:\Program Files\Common Files\System\ado\MSDART.DLL" "TNZSOLLUCUPMVOMN.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "TNZSOLLUCUPMVOMN.exe" trying to access non-existent file "C:\Users\qZjEXO7\Documents\FLTLIB.DLL" "TNZSOLLUCUPMVOMN.exe" trying to access non-existent file "C:\Users\qZjEXO7\Documents\MSVCP140.dll" "TNZSOLLUCUPMVOMN.exe" trying to access non-existent file "C:\Users\qZjEXO7\Documents\VCRUNTIME140.dll" "TNZSOLLUCUPMVOMN.exe" trying to access non-existent file "C:\Users\qZjEXO7\Documents\CRYPTSP.DLL" "TNZSOLLUCUPMVOMN.exe" trying to access non-existent file "C:\Users\qZjEXO7\Documents\VCRUNTIME140_CLR0400.dll" "TNZSOLLUCUPMVOMN.exe" trying to access non-existent file "C:\Users\qZjEXO7\Documents\ucrtbase_clr0400.dll" "TNZSOLLUCUPMVOMN.exe" trying to access non-existent file "C:\Users\qZjEXO7\Documents\amsi.dll" "TNZSOLLUCUPMVOMN.exe" trying to access non-existent file "C:\Users\qZjEXO7\Documents\wininet.dll" "TNZSOLLUCUPMVOMN.exe" trying to access non-existent file "C:\Users\qZjEXO7\Documents\mscoree.dll" "TNZSOLLUCUPMVOMN.exe" trying to access non-existent file "C:\Users\qZjEXO7\Documents\WINMM.dll" "TNZSOLLUCUPMVOMN.exe" trying to access non-existent file "C:\Users\qZjEXO7\Documents\urlmon.dll" "TNZSOLLUCUPMVOMN.exe" trying to access non-existent file "C:\Users\qZjEXO7\Documents\iertutil.dll" "TNZSOLLUCUPMVOMN.exe" trying to access non-existent file "C:\Users\qZjEXO7\Documents\srvcli.dll" "TNZSOLLUCUPMVOMN.exe" trying to access non-existent file "C:\Users\qZjEXO7\Documents\netutils.dll" "TNZSOLLUCUPMVOMN.exe" trying to access non-existent file "C:\Users\qZjEXO7\Documents\Iphlpapi.DLL" "TNZSOLLUCUPMVOMN.exe" trying to access non-existent file "C:\Users\qZjEXO7\Documents\SspiCli.dll" "TNZSOLLUCUPMVOMN.exe" trying to access non-existent file "C:\Users\qZjEXO7\Documents\bcrypt.dll" "TNZSOLLUCUPMVOMN.exe" trying to access non-existent file "C:\Users\qZjEXO7\Documents\CRYPTBASE.dll"45:Tc9b,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\DOCUMENTS\TNZSOLLUCUPMVOMN.EXE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "TNZSOLLUCUPMVOMN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "TNZSOLLUCUPMVOMN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "TNZSOLLUCUPMVOMN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "TNZSOLLUCUPMVOMN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "TNZSOLLUCUPMVOMN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "TNZSOLLUCUPMVOMN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "TNZSOLLUCUPMVOMN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "TNZSOLLUCUPMVOMN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "TNZSOLLUCUPMVOMN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "TNZSOLLUCUPMVOMN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "TNZSOLLUCUPMVOMN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "TNZSOLLUCUPMVOMN.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "")46:T1e6a,"WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT\SETTINGS\TELEMETRY\WSCRIPT.EXE"; Key: "JSCRIPTSETSCRIPTSTATESTARTED"; Value: "162D3D000000000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "2307000000000000040004000102050000000000010000002FD60F02010000006B507E00150000007953440258000000A19F5E0001000000F062570204000100000041000000276B69012700000056737D00060000006B507E0006000000E6C5310002000400000001000000C49B7B0201000000EFBA8302020065000000020B0000E6C5310008000000F0E0B60000") "WScript.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "9D19000000000000040004000100F9010200000000B31C0200F76A010152B6010212F80002388F020285C70102E8C20103A63A0203CBE40103F91B02043E8E02045F9A0204931A0104AF630104DADC0105DE850205F9E70106C42802079A1902088D4201089E1902095E2F0209A336010A6B6C010BE8C5010BF99C020C3131020CE9C2000D28C7010D7879000D7E3E020D7E4F020DD3F9000E091A020E303E020E9F67020F168C01101755021043E800104C8E02112969021142C20011AB3D0212E5F800130A360213951B0213E9780014FD160215E07E0216D134021793380117C06F0117DE370118208A02186C1E0219C0E2001A2D42021AE8EC011BF60B001C955C001D3083021D3BC5011D5819021E451E021EC330021ED770011F34CC011F626C022018F200213AC301223BED0122A7730123116E01237AF80123CC4F01246B460124ACC70024C18B0125023802254F6E01262B9401264BA801267F9D022834190228A11B012919DA0129450101297DA90129861F0229CE33022AC7DE002B2499002BD8E5012C9F7A022CA603022D22DA012D5838012E1EF0012E4A1C022E6974012E7714022F4CE5012FA8FF0131484F003257A400329F7A0232D1A70032D45F0133FB2A0233FE38023542CC0135602102361EE10139A7C20139AFDE013A99D9013B8031023CB352003D121F023D218F023DC47F023E1CB7013E5BED01403D670140A28E0141A8760041BC3A02420D510242264A0042B3AE0042C54D0243AB210144A4C401454ED30045668A024677300146AB2E02483BDB0148C24F0048F9A60049CBA30149DA1B0249EAB7004AAA81004AC433024ADEE1014B2A91014B6EE3014B7207024BF474024C15AA014C41B4004CC84B014D3ED9014E50C2014F14C2004FA53302508F00025276930253467301536A3A025408340254302F0254B7DC0054DFE20155DB8C0155E6E10157426B01577AF801578A1B0257AD120158021202589E270258BB5C025953940059C43C025A0189025A0289025A0A83025AE213025AF783025B1203025C3598015E83D7015EF05F025F83500261D42A0261D98C0162DC300262EF34026396770063EC740263FD310264054E0264C9260164D4190164F42B0265C4850265ED1D0267ABEE0167BA6B0268130102682C90006957EA0169592A0269CC4F016A3683026A61E8016A7365016A95E2016BF42B026C0B76026C137F026C6F66026D2390026DEE2C026E4538027052E20170A32C0271014902718C9A02726E4A0072A2420172CD990173422F0274A3A3017691CF0177D52F0277F98F01785DD30179F99C027A5B7C027C82C9017CBAFC017DBBD6017E1044017E3732027E5030027EEE89027F16AA017F88CA008001840281B0690281B942028227730082409702825B8A0282FB2A02833AC50183F16000844D260184D7780284E11E0284E6830085311B028550AE0085E34102861BDE0186ECB6018754990287D5140287F0250187FC380288818702890CE901892F830289DC8B018A8093008AFAE3008BEEF2008BFD6E018C1D88028C8F94028E78A2008E90C6018ED891018FEAF9019123D30091C335029259160092603302928271009369C70093CA3D0293CE8C019439F701945AE001945B270294A15B0195126E01959F33019697E30196A26E0198C7F10198D7780299429B02996776029A0B73019B4A72029C429B029C4D22029CE0A8009D9D92009E1E90019F8230029F8314029FF47702A1236602A19D2A01A2050600A2065D02A2961002A3998D02A3C4E200A3C88302A4580200A4778D02A4AEE901A5092E02A5ADCF00A644A600A7B8AD00A7C23301A7E23E02A8EA4E02AAB1FC01AAF63F02AB9FC901ABF42B02AC4D1C02AC54F900AC930202AD2DB801AD73BF00AE4D5702AEE69101AF086501AF9C0202B09E9702B0F13802B2376E01B2827902B2BAFC01B3732002B3742D02B392FB00B4D7C501B51B6701B5661202B7750C02B7E23E02B8C37F02B91AF300B9B92A02B9FA7702BB51DD01BB8E1602BB8E8B00BBF42B02BD388F00BEAF8A02BF674602BFDC4602C0079A00C03A8E02C1BCF101C2151602C2610B01C2DEE401C2FD7C02C33EA300C36D8100C399F300C535C900C58D9002C5EA1602C6331902C75DD700C85C5902C8B83902C9389700CA072E02CB533302CB74DA00CC495600CCEFEF00CDBA8302CE99E001CEE23E02CF1C0402CFF36501D0175600D0B00802D1D2A700D2C12702D2CF9D02D2E67302D2ED3702D3140C02D3826100D3834B01D4489A01D4A04002D5398801D5F78602D6231F02D6EF5802D737C501D7D2C501D7E86C02D8E79C01D940E901D997E001DA0B7301DA38C801DB7A1402DB87DD01DBE23E02DBE56F02DC451502DC5C2B02DD1B1901DE0F8702DE692702DF294302E0093602E01FA101E0BC0102E1417E02E16D9901E17E8C00E193B001E1E3D801E21B5600E2BC8802E2DB2C02E4402701E469C900E4EF1B02E5BD5C01E5E03902E6109902E63E2B0DE66C8100E6BD3902E7A3E901E7A4D900E7E23E02E88E2401E98C0A01E9D36601E9EA3402EB3B9402EB8D3302EB908D02EC63C501EC95E101ECBC3602EDAA2E02EE165502EE5F9902EE930202EEAF9B02EFD67202F0694F02F07F0B02F0B91402F0E0B600F133E901F13A9102F1728102F17D5F00F1AD3D01F20E9302F2B4FA00F2FFA501F308DB00F3492A02F3658E02F3894001F3B82102F458EC01F4EA9502F5500D01F577C201F64DE701F6F12B02F7125E00F7EC8302F7ED6A00F8C13D02F9DFA101FA667802FAFB8402FB8CC601FC3A4701FC75BA01FD148602FDB0D900FE784F02FE8D5E02FEDC8C01FEE26301FF10DD01FF3400023600060000000DEAFC0112F7C70113F7C7011A6F93021BA02E02212E4D0225C5010228614B022E240F022EDD89023C6AF901410189024BFC6D0251B2340261057C0263CB2E0269B992026A23E20170FC8802786C6D0279DE98027E018902877B32028B2894028EE3780299345802996776029E306B02A1866302A6749502AFA32E02B0D58102B5235202B6F13B02B7F15002BB635C02C1239D01C3445D02C8D15D02CF6C8502CFF42B02D88C3F02DBB95D02DCEF8E02DFD47602E2077F02E4718902EA5B9402EBAC7502EDF38E02EF007702F02A7402F7CC9002FC998D020500400100001ED770014B11B400682C9000A5ADCF00CE99E0010100420100009E1E9001010043010000C0EC7C0000") "WScript.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\SOFTWARE\MICROSOFT\TIP\AGGREGATERESULTS"; Key: "DATA"; Value: "D9A7A80101000300EC03F46F00000000070000000000000049A8A801010203005C4614A6000000000300000000000000D1A8A8010102030064B65611000000000500000000000000D1A8A80101000400FB3B54EB000000000A0000000000000023ACAD0102020400546DD0B400000000010000007D0000002B7ABA010202070017EB54670000000002000000050000009F49DD010100008045734BE10000000002000000000000004959DD0101000400F34A296B0000000002000000E20100000C84EA010102010077F4574600000000010000000F000000BFDE08020100008065B49D6B0000000004000000120000005F37110201000080856D77FF000000000200000004000000FDBE49020100008003520DB6000000000100000049050000487C4D0201000080127A123700000000280000000300000093FE59020100010098FBB9D600000000010000000000000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "69FD2A24606BDD010000000000000000000000000200000000") "TNZSOLLUCUPMVOMN.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\RMC-767GE7"; Key: "EXEPATH"; Value: "60B556E13A91F7BD86EEEFC2BF2E8F4A8471561D073E6E85A83CB917F6FF011904AB3D687D276190B614006B10989CB0832C2441AE4AC447A8D9C2419B2C09296B776BE94E3DD674AE1E6D31AB0D725A739E91EB9C35E25B3FE058C6AC2A49DE00") "TNZSOLLUCUPMVOMN.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\RMC-767GE7"; Key: "LICENCE"; Value: "B8001255AA00C20F488A69437B1A5919") "TNZSOLLUCUPMVOMN.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\RMC-767GE7"; Key: "TIME"; Value: "2885E96A00") "TNZSOLLUCUPMVOMN.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\RMC-767GE7"; Key: "UID"; Value: "C8BA4C5D00")47:Tf9f,"TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "`D"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "00459d0050569c00"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "18469d0050569c00"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "@F"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "a8479d0050569c00"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "a0459d0050569c00"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "d0479d0050569c00"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "e0469d0050569c00"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "0G"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "80479d0050569c00"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "f0459d0050569c00"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "f8479d0050569c00"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "H"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "hF"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "c8459d0050569c00"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "90469d0050569c00"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "b8469d0050569c00"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "HH"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "08479d0050569c00"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "XG"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "40e29e0050569c00"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "48e49e0050569c00"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "b8e29e0050569c00"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "e0e29e0050569c00"} "TNZSOLLUCUPMVOMN.exe" called "getaddrinfo" with parameters {"pNodeName": "46.183.222.106" "pServiceName": "2404" "pHints": "0" "ppResult": "10e59e0050569c00"}30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793887578578,"unified_at":"2026-11-05T14:06:18.578Z","metadata":{"hashes":{"sha256":"0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67","sha1":"4bab2f0621d5d07b00092c552ef55d933fcb21de","md5":"df114e107d2c133898fe0f8e5c598141","sha512":"bc28f435c146ebe246e039a003b366c45367a720ab418c1c34db275ec597923b132b20561e4e051a162d923283c7509d1b89c86e2f3dbfbb21e8ffd10f13780b","ssdeep":"98304:tMGunUTwHa502LsKptYp79p7cdxjBrWrkThkl1h7UIoRz+1STkLdW6bIwg/2IVKK:tMGunUTwHQ02LsKptYp79p7cdxjBrWrG","ssdeep_chunks":["98304:tMGunUT","98304:MGunUTw","98304:GunUTwH","98304:unUTwHa","98304:nUTwHa5","98304:UTwHa50","98304:TwHa502","98304:wHa502L","98304:Ha502Ls","98304:a502LsK","98304:502LsKp","98304:02LsKpt","98304:2LsKptY","98304:LsKptYp","98304:sKptYp7","98304:KptYp79","98304:ptYp79p","98304:tYp79p7","98304:Yp79p7c","98304:p79p7cd","98304:79p7cdx","98304:9p7cdxj","98304:p7cdxjB","98304:7cdxjBr","98304:cdxjBrW","98304:dxjBrWr","98304:xjBrWrk","98304:jBrWrkT","98304:BrWrkTh","98304:rWrkThk","98304:WrkThkl","98304:rkThkl1","98304:kThkl1h","98304:Thkl1h7","98304:hkl1h7U","98304:kl1h7UI","98304:l1h7UIo","98304:1h7UIoR","98304:h7UIoRz","98304:7UIoRz+","98304:UIoRz+1","98304:IoRz+1S","98304:oRz+1ST","98304:Rz+1STk","98304:z+1STkL","98304:+1STkLd","98304:1STkLdW","98304:STkLdW6","98304:TkLdW6b","98304:kLdW6bI","98304:LdW6bIw","98304:dW6bIwg","98304:W6bIwg/","98304:6bIwg/2","98304:bIwg/2I","98304:Iwg/2IV","98304:wg/2IVK","98304:g/2IVKK","196608:tMGunUT","196608:MGunUTw","196608:GunUTwH","196608:unUTwHa","196608:nUTwHa5","196608:UTwHa50","196608:TwHa502","196608:wHa502L","196608:Ha502Ls","196608:a502LsK","196608:502LsKp","196608:02LsKpt","196608:2LsKptY","196608:LsKptYp","196608:sKptYp7","196608:KptYp79","196608:ptYp79p","196608:tYp79p7","196608:Yp79p7c","196608:p79p7cd","196608:79p7cdx","196608:9p7cdxj","196608:p7cdxjB","196608:7cdxjBr","196608:cdxjBrW","196608:dxjBrWr","196608:xjBrWrk","196608:jBrWrkT","196608:BrWrkTh","196608:rWrkThk","196608:WrkThkl","196608:rkThkl1","196608:kThkl1h","196608:Thkl1h7","196608:hkl1h7U","196608:kl1h7UI","196608:l1h7UIo","196608:1h7UIoR","196608:h7UIoRz","196608:7UIoRz+","196608:UIoRz+1","196608:IoRz+1S","196608:oRz+1ST","196608:Rz+1STk","196608:z+1STkL","196608:+1STkLd","196608:1STkLdW","196608:STkLdW6","196608:TkLdW6b","196608:kLdW6bI","196608:LdW6bIw","196608:dW6bIwg","196608:W6bIwg/","196608:6bIwg/2","196608:bIwg/2I","196608:Iwg/2IV","196608:wg/2IVK","196608:g/2IVKK","98304:unUTwHQ","98304:nUTwHQ0","98304:UTwHQ02","98304:TwHQ02L","98304:wHQ02Ls","98304:HQ02LsK","98304:Q02LsKp","98304:xjBrWrG"],"imphash":"Unknown"},"file_info":{"file_name":"BBK Transfer-SOA.JS","file_type":["script","javascript"],"file_type_id":"js","file_size":4183031,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793606728000,"last_seen":1793688822000,"last_multi_scan":1793688822000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","rat","loader","donut","remcos","credentialharvesting","opensource","criminal","evasive"]},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":3,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":43},"sandbox_signatures":{"informative_count":89,"suspicious_count":17,"malicious_count":3,"total":109},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/JS.Modiloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.82035718","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.82035718 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"JS/TrojanDropper.ModiLoader.BY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"JS/ModiLoader.E!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Remcos","sources":[{"report_type":"qsp","report_id":""}]},{"value":"Donut","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"suspicious","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to use AES encryption instructions"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Scripts code detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"},{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"Executes a JavaScript file"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"},{"type":"suspicious","value":"Script file shows a combination of malicious behaviors"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"},{"type":"suspicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"suspicious","value":"Attempts to retrieve geographical location information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the windows installation date"},{"type":"suspicious","value":"Attempts to retrieve NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Opens a handle to the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Read windows product name from registry"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Sets the 'ThreadHideFromDebugger' thread data structure"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping multiple times"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Writes a PE file header to disc"},{"type":"informative","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"informative","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"malicious","value":"Known malware detected"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"malicious","value":"Creates a mutant that is known to appear in malware"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"suspicious","value":"Loads syscall stubs from disk during runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops executable files inside user directory"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]}],"sandbox_signatures":[{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to use AES encryption instructions","description":"file/memory contains long string with (Indicator: \"AESNI\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573.001","id":"string-584","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"WScript.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00005136)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00005136)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00005136)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00005136)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"WScript.exe\" called \"LoadResource with parameter {'hModule': '2166728687617', 'hResInfo': '2166728696032'}\" (UID: 00000000-00005136)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2166728687617', 'hResInfo': '2166728696064'}\" (UID: 00000000-00005136)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2166728687617', 'hResInfo': '2166728696080'}\" (UID: 00000000-00005136)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2166728687617', 'hResInfo': '2166728696048'}\" (UID: 00000000-00005136)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"WScript.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"WScript.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$36","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"WScript.exe\" at 00000000-00005136-00000C15-999973150","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$37","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Scripts code detected via AMSI (Antimalware Scan Interface)","description":"Script name: C:\\BBKTransfer-SOA.JS contents: \nfunction anonymous() {\ndebugger\n}\n\n","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059.001","relevance":5,"id":"amsi-2","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)","description":"Process \"WScript.exe\" executed suspicious script","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059","relevance":3,"id":"amsi-0","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use AES encryption instructions\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"TNZSOLLUCUPMVOMN.exe\" at offset 198463; code bytes = 30d0\n Found XOR loop in file \"TNZSOLLUCUPMVOMN.exe\" at offset 345809; code bytes = 30d0\n Found XOR loop in file \"TNZSOLLUCUPMVOMN.exe\" at offset 355782; code bytes = 30d0\n Found XOR loop in file \"TNZSOLLUCUPMVOMN.exe\" at offset 412488; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WScript.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005136)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WScript.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005136)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WScript.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005136)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"WScript.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005136)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"TNZSOLLUCUPMVOMN.exe\" called \"IsWow64Process\" with parameter \"4980\" - (UID: 00000000-00004980)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"WScript.exe\" called \"EnumWindows\" with parameter \"722742537280\" - (UID: 00000000-00005136)\n \"WScript.exe\" called \"EnumWindows\" with parameter \"722742537648\" - (UID: 00000000-00005136)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005136)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$38","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"TNZSOLLUCUPMVOMN.exe\" called \"OpenMutexA\" with parameter \"Rmc-767GE7-Sys\" - (UID: 00000000-00004980)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$39","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WScript.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00005136)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005136)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00005136)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"TNZSOLLUCUPMVOMN.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"TNZSOLLUCUPMVOMN.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"TNZSOLLUCUPMVOMN.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"WScript.exe\" queried token user identity (UID: 00000000-00005136)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"TNZSOLLUCUPMVOMN.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"TNZSOLLUCUPMVOMN.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\TNZSOLLUCUPMVOMN.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"WScript.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /c echo. > \"C:\\BBKTransfer-SOA.JS:Zone.Identifier\"\" - (UID: 00000000-00005136)\n \"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%USERPROFILE%\\Documents\\TNZSOLLUCUPMVOMN.exe\" %USERPROFILE%\\Documents\\NMOVMPUCULLOSZNT\" - (UID: 00000000-00005136)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"46.183.222.106:2404\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3c","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"TNZSOLLUCUPMVOMN.exe\" as clean (type is \"PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 10 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Executes a JavaScript file","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\BBKTransfer-SOA.JS\"\" (UID: 00000000-00005136)","origin":"Monitored Target","mitre_attack_id":"T1059.007","relevance":3,"id":"target-167","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"TNZSOLLUCUPMVOMN.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" - [base:0; Status:c000007b]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 60BF0000\n \"TNZSOLLUCUPMVOMN.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 73E80000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 6E220000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 6D8B0000\n \"TNZSOLLUCUPMVOMN.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73870000\n \"TNZSOLLUCUPMVOMN.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76BE0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"TNZSOLLUCUPMVOMN.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 02F30000\n \"TNZSOLLUCUPMVOMN.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 73F80000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 6F880000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 6F880000\n \"TNZSOLLUCUPMVOMN.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75B40000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"$3e","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000020426b6efd7f0000@ntdll.dll\"\n \"220023000000000040426b6efd7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"BBK Transfer-SOA.JS\" was detected as \"plain text\" and name: \"Format\"\n \"TNZSOLLUCUPMVOMN.exe\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\cmd.exe\" [Source: 00000000-00005136-00000BC1-1000267861]\n Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00005136-00000C47-7523796160]\n Observed system executable string:\"\"%WINDIR%\\System32\\cmd.exe\" /c echo. > \"C:\\BBKTransfer-SOA.JS:Zone.Identifier\"\" [Source: 00000000-00005136-00000C47-7523796160]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00000300-00000BC0-1000377980]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00000300) was launched with new environment variables: \"USERDNSDOMAIN=\"IgyvyzGudUts9xA\"\"\n Process \"cmd.exe\" (UID: 00000000-00000300) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Reads configuration files (.ini files)","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WScript.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\USER PROFILE\"; Key: \"LANGUAGES\")\n \"WScript.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NAME\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"TNZSOLLUCUPMVOMN.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00005136-00000C2B-997816376]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00005136-00000C2B-998143321]\n Observed system executable string:\"%WINDIR%\\system32\\kernel32.dll\" [Source: 00000000-00005136-00000C2B-998725518]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" [Source: 00000000-00004980-00000C2B-1010089934]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" [Source: 00000000-00004980-00000C2B-1010394122]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c echo. > \"C:\\\\BBKTransfer-SOA.JS:Zone.Identifier\"\" (UID: 00000000-00000300)\n Spawned process \"TNZSOLLUCUPMVOMN.exe\" with commandline \"%USERPROFILE%\\\\Documents\\\\NMOVMPUCULLOSZNT\" (UID: 00000000-00004980)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/c echo. > \"C:\\\\BBKTransfer-SOA.JS:Zone.Identifier\"\" (UID: 00000000-00000300)\n Spawned process \"TNZSOLLUCUPMVOMN.exe\" with commandline \"%USERPROFILE%\\\\Documents\\\\NMOVMPUCULLOSZNT\" (UID: 00000000-00004980)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"TNZSOLLUCUPMVOMN.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"TNZSOLLUCUPMVOMN.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"TNZSOLLUCUPMVOMN.exe\" has type \"PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 10 sections\"- Location: [%USERPROFILE%\\Documents\\TNZSOLLUCUPMVOMN.exe]- [targetUID: 00000000-00005136]\n \"NMOVMPUCULLOSZNT\" has type \"ASCII text with very long lines (65536) with no line terminators\"- Location: [%USERPROFILE%\\Documents\\NMOVMPUCULLOSZNT]- [targetUID: 00000000-00005136]\n \"BBKTransfer-SOA.JS%3AZone.Identifier\" has type \"ASCII text with CRLF line terminators\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops executable files","description":"\"TNZSOLLUCUPMVOMN.exe\" has type \"PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 10 sections\"- Location: [%USERPROFILE%\\Documents\\TNZSOLLUCUPMVOMN.exe]- [targetUID: 00000000-00005136]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"WScript.exe\" opens a process \"C:\\Windows\\System32\\wscript.exe\" (UID: 00000000-00005136)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\wscript.exe\" (UID: 5136)\n \"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 5136)\n \"WScript.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\Documents\\TNZSOLLUCUPMVOMN.exe\" (UID: 5136)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 300)\n \"TNZSOLLUCUPMVOMN.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\Documents\\TNZSOLLUCUPMVOMN.exe\" (UID: 4980)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\bbktransfer-soa.js\"\n \"WScript.exe\" reads file \"c:\\windows\\system32\\wshom.ocx\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Possibly tries to evade analysis by sleeping multiple times","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"WScript.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"WScript.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\AppLocker\\MDM\"\n \"WScript.exe\" trying to access non-existent file \"STORAGE#Volume#{5781f570-2b3b-11ee-88a5-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\"\n \"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\cmd.exe:Zone.Identifier\"\n \"WScript.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\desktop.ini\"\n \"WScript.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"WScript.exe\" wrote 2048 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\Documents\\TNZSOLLUCUPMVOMN.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"WScript.exe\" writes file \"c:\\users\\%osuser%\\documents\\nmovmpucullosznt\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"46.183.222.106\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://luajit.org/=\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"TNZSOLLUCUPMVOMN.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"TNZSOLLUCUPMVOMN.exe\" called \"GetUserNameW\" (UID: 00000000-00004980)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\cmd.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005136-00000BC1-1000267861\")\n Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000300-00000BC0-1000377980\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"69FD2A24606BDD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"WScript.exe\" opened \"\\Device\\KsecDD\"\n \"TNZSOLLUCUPMVOMN.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$46","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"NMOVMPUCULLOSZNT\" contains indicator \".Sleep(\" (Line: 1; Offset: 872653)\n \"NMOVMPUCULLOSZNT\" contains indicator \".Run\" (Line: 1; Offset: 38687)","origin":"Binary File","mitre_attack_id":"T1105","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside user directory","description":"\"TNZSOLLUCUPMVOMN.exe\" has type \"PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 10 sections\"- Location: [%USERPROFILE%\\Documents\\TNZSOLLUCUPMVOMN.exe]- [targetUID: 00000000-00005136]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-32","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"TNZSOLLUCUPMVOMN.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /c echo. > \"C:\\BBKTransfer-SOA.JS:Zone.Identifier\"\" - (UID: 00000000-00005136)\n \"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%USERPROFILE%\\Documents\\TNZSOLLUCUPMVOMN.exe\" %USERPROFILE%\\Documents\\NMOVMPUCULLOSZNT\" - (UID: 00000000-00005136)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Loads syscall stubs from disk during runtime","description":"\"TNZSOLLUCUPMVOMN.exe\" trying to read a file \"C:\\Windows\\SysWOW64\\ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1027.007","relevance":3,"id":"api-298","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\"TNZSOLLUCUPMVOMN.exe\" is setting \"ThreadHideFromDebugger\" data for its current thread","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-84","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"TNZSOLLUCUPMVOMN.exe queries ProcessDebugPort (UID: 4980)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"TNZSOLLUCUPMVOMN.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"@l\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531840\"}\n \"TNZSOLLUCUPMVOMN.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"f0879e0000000000\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531840\"}\n \"TNZSOLLUCUPMVOMN.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"PU\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531840\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve geographical location information","description":"$47","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-308","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"TNZSOLLUCUPMVOMN.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping multiple times","description":"\"TNZSOLLUCUPMVOMN.exe\" (Thread ID: 7264) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\wscript.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\System32\\cmd.exe\" queried ProcessMitigationPolicy\n \"C:\\Users\\%OSUSER%\\Documents\\TNZSOLLUCUPMVOMN.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"6/24 Antivirus vendors marked sample as malicious (25% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"WScript.exe\" wrote 000011C0 bytes to a remote process \"C:\\Users\\%OSUSER%\\Documents\\TNZSOLLUCUPMVOMN.exe\" (Handle: 1588)\n \"WScript.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\Documents\\TNZSOLLUCUPMVOMN.exe\" (Handle: 1588)\n \"WScript.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\Documents\\TNZSOLLUCUPMVOMN.exe\" (Handle: 1588)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to retrieve NetBIOS or DNS name associated with the local computer","description":"\"TNZSOLLUCUPMVOMN.exe\" called \"GetComputerNameExW\" with parameters {\"NameType\": \"1\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-287","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%USERPROFILE%\\Documents\\TNZSOLLUCUPMVOMN.exe\" connects to 46.183.222.106 on port 2404 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"suspicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 46.183.222.106 on port 2404","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"TNZSOLLUCUPMVOMN.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"TNZSOLLUCUPMVOMN.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behaviors","description":"The script produces internet activity. Is obfuscated and/or drops files","origin":"Indicator Combinations","mitre_attack_id":"T1204.002","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Known malware detected","description":"The sample is known malware – Remcos","origin":"Indicator Combinations","mitre_attack_id":"T1219","relevance":10,"id":"summary-5011","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Creates a mutant that is known to appear in malware","description":"\"Rmc-\" in \"Remcos\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":7,"id":"mutant-1","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Possibly tries to evade analysis by sleeping multiple times"},{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]}],"intel_graph":{"map":{"File:0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67":{"type":"File","value":"0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat Donut","confirmed relationship with a Threat Remcos"]}},"File:0c3aa9e8fc5e8b77f38a5aec670d0f4796423968402a595ac42d2de1e3f4db91":{"type":"File","value":"0c3aa9e8fc5e8b77f38a5aec670d0f4796423968402a595ac42d2de1e3f4db91"},"File:6bdf66b5bf2a44e658bea2ee86695ab150a06e600bf67cd5cce245ad54962c61":{"type":"File","value":"6bdf66b5bf2a44e658bea2ee86695ab150a06e600bf67cd5cce245ad54962c61"},"File:d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49":{"type":"File","value":"d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49"},"Ip:46.183.222.106":{"type":"Ip","value":"46.183.222.106"},"Threat:4dc198e48b11a6c344304c8ce54d978444a338f54eebd6128f354009cf10aab3":{"type":"Threat","value":"Remcos","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Threat:cf27745b0afa6d34e6b45fa1940ddef63982f5e01c71c093b871f0d6ffe6f14d":{"type":"Threat","value":"Donut","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1567069255169680641","root":"File:0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat Donut","confirmed relationship with a Threat Remcos"]}},{"id":"1567069255169680640","root":"File:0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67","to_key":"Threat:4dc198e48b11a6c344304c8ce54d978444a338f54eebd6128f354009cf10aab3"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1567069255165486335","root":"File:0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67","to_key":"Threat:cf27745b0afa6d34e6b45fa1940ddef63982f5e01c71c093b871f0d6ffe6f14d"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67","edges":[{"edge_kind":"contacted_ip","from_key":"File:0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67","to_key":"Ip:46.183.222.106"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67","edges":[{"edge_kind":"extracted","from_key":"File:0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67","to_key":"File:d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49"},{"edge_kind":"extracted","from_key":"File:0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67","to_key":"File:0c3aa9e8fc5e8b77f38a5aec670d0f4796423968402a595ac42d2de1e3f4db91"},{"edge_kind":"extracted","from_key":"File:0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67","to_key":"File:6bdf66b5bf2a44e658bea2ee86695ab150a06e600bf67cd5cce245ad54962c61"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":24,"imported_dlls_count":93,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":7,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","rat","loader","donut","remcos","credentialharvesting","opensource","criminal","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6ae984f6cdcd075a820008d7","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"ModiLoader.E","contacted_countries":["LVA"],"submit_name":"BBK Transfer-SOA.JS","analysis_start_time":"2026-11-03T06:53:43+00:00","indicators_count":{"informative":89,"suspicious":18,"malicious":3},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"46.183.222.106","port":2404,"protocol":"TCP","country":"Latvia","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}],"processes":[{"pid":5136,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\BBKTransfer-SOA.JS\"","sha256":"7478b567c9ec9a1e1061f9c6db2993fcdc2ec4e8fb5ca6da80fa307b54116e69","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00005136","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABIklEQVR4Xs2Siw7DIAhF/XQ/rX+25cYxkV58FbOdxLRFhQNbSoqc8yt66fxDcCGSvxBYkjghcF3XvMQJATAtcUoATEn0BOT3nFn6jq3RxRMo8WSi9290KbnM5hd95gYTkFjOia5CLS5TwHvNUlkS4J1b2uJ4l4WYPb0h0O/eK+5JbAn4+N2HCtjOvQnYfEDn0+cpnsAdyVsn0Gx3WBIAJXbvnk2hvcnZFAC1a/aclVgWAOP/wrzElgCImsS2AIiYxCMB8HQSQQK8qH0yiW0B7I0WcmiJMAEvbju1EiECJdbkaNDFC8ETYIn1sxXge59gE6P4Ary4LaTPsuI6TmECAHFc7C2cQQ75xrvNA7YEgD07wt4XtgWi+H8B+9ueWLbuT3kDb24C8Zv/GpsAAAAASUVORK5CYII="},{"pid":300,"ppid":5136,"name":"cmd.exe","command_line":"/c echo. > \"C:\\BBKTransfer-SOA.JS:Zone.Identifier\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00005136","uid":"00000000-00000300"},{"pid":4980,"ppid":5136,"name":"TNZSOLLUCUPMVOMN.exe","command_line":"%USERPROFILE%\\Documents\\NMOVMPUCULLOSZNT","sha256":"d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49","normalized_path":"%USERPROFILE%\\Documents\\TNZSOLLUCUPMVOMN.exe","parent_uid":"00000000-00005136","uid":"00000000-00004980"}],"all_imported_dlls":["nsi.dll","kernel32.dll","ucrtbase.dll","msvcp140.dll","uxtheme.dll","msxml3.dll","VxSSL32.dll","dnsapi.dll","rpcrt4.dll","ws2_32.dll","bcryptprimitives.dll","advapi32.dll","sxs.dll","wintrust.dll","BCP47Langs.dll","OneCoreUAPCommonProxyStub.dll","wow64con.dll","version.dll","clbcatq.dll","wshext.dll","srvcli.dll","msdart.dll","wow64base.dll","IPHLPAPI.DLL","dhcpcsvc6.dll","cryptsp.dll","kernel.appcore.dll","vcruntime140.dll","gpapi.dll","scrrun.dll","MpClient.dll","oleaut32.dll","msvcp_win.dll","gdi32.dll","imm32.dll","msctf.dll","MpOAV.dll","wldp.dll","sechost.dll","iertutil.dll","cryptbase.dll","msisip.dll","shell32.dll","cfgmgr32.dll","bcrypt.dll","wow64cpu.dll","userenv.dll","rsaenh.dll","mpr.dll","edputil.dll","ucrtbase_clr0400.dll","mswsock.dll","vcruntime140_1.dll","shlwapi.dll","ntdll.dll","ole32.dll","fltLib.dll","crypt32.dll","windows.storage.dll","GdiPlus.dll","gdi32full.dll","amsi.dll","wow64.dll","vcruntime140_clr0400.dll","combase.dll","virtdisk.dll","dhcpcsvc.dll","user32.dll","urlmon.dll","AppResolver.dll","msado15.dll","apphelp.dll","clr.dll","mscoree.dll","KernelBase.dll","d7Ir84Ec.dll","propsys.dll","netutils.dll","win32u.dll","Windows.StateRepositoryPS.dll","sspicli.dll","psapi.dll","msvcrt.dll","VxSSL64.dll","profapi.dll","msasn1.dll","scrobj.dll","SHCore.dll","WinTypes.dll","wow64win.dll","jscript.dll","wininet.dll","winmm.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"TNZSOLLUCUPMVOMN.exe","sha256":"d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"NMOVMPUCULLOSZNT","sha256":"0c3aa9e8fc5e8b77f38a5aec670d0f4796423968402a595ac42d2de1e3f4db91","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"BBKTransfer-SOA.JS%3AZone.Identifier","sha256":"6bdf66b5bf2a44e658bea2ee86695ab150a06e600bf67cd5cce245ad54962c61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"path":"%USERPROFILE%\\Documents\\NMOVMPUCULLOSZNT","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"path":"%USERPROFILE%\\Documents\\TNZSOLLUCUPMVOMN.exe","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"path":"C:\\BBKTransfer-SOA.JS:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\RMC-767GE7\\","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"key":"HKCUHKCU\\SOFTWARE\\RMC-767GE7\\\\","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5136:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5136:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5136:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5136:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"SM0:5136:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"Local\\SM0:5136:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"Local\\SM0:5136:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"SM0:5136:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"SM0:300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"Local\\SM0:300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4980:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4980:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Rmc-767GE7","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"Local\\SM0:4980:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"SM0:4980:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]},{"name":"Rmc-767GE7","sources":[{"report_type":"sandbox","report_id":"6ae984f6cdcd075a820008d7"}]}]}},"report_ids":{"sandbox_job_ids":["6ae984f6cdcd075a820008d7"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 0ac637abca78… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0ac637abca78…. Malware family: Trojan.Generic. Threat score 100/100. 6/24 AV engines flagged this file. 3 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 0ac637abca78… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0ac637abca78…. Malware family: Trojan.Generic. Threat score 100/100. 6/24 AV engines flagged this file. 3 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0ac637abca7833bb2941fcc0d82a11ecd00a8b4d3e228a0b4f09d39a3c1dbd67"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 0ac637abca78… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0ac637abca78…. Malware family: Trojan.Generic. Threat score 100/100. 6/24 AV engines flagged this file. 3 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L48","11",{}]] 32:null