24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 33:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T493,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Cryxos.JS Sample 33dbb7d0c78b… — Score 83/100 — Hybrid Analysis","description":"Malicious verdict for sample 33dbb7d0c78b…. Malware family: Trojan.Cryxos.JS. Threat score 83/100. 6/27 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/33dbb7d0c78bfa2e124b78409ecc7152a80016bbcccf39e960a2790d1efb8a22","keywords":["Malicious","Trojan.Cryxos.JS","malware analysis","sandbox report","threat intelligence","33dbb7d0c78bfa2e124b78409ecc7152a80016bbcccf39e960a2790d1efb8a22"],"about":{"@type":"SoftwareApplication","name":"103_ETT177321458.JS.js","applicationCategory":["script","javascript"],"identifier":"33dbb7d0c78bfa2e124b78409ecc7152a80016bbcccf39e960a2790d1efb8a22","additionalType":"Malicious sample"},"threatScore":83,"malwareFamily":"Trojan.Cryxos.JS","antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tba8,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{000C10F1-0000-0000-C000-000000000046}") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{000C10F1-0000-0000-C000-000000000046}") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{06C9E010-38CE-11D4-A2A3-00104BD35090}") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{06C9E010-38CE-11D4-A2A3-00104BD35090}") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTSIPDLLPUTSIGNEDDATAMSG") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETCAPS") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETCAPS") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETCAPS\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}")26:T44a,"UQWCKSUOOCSVIHXQ.exe" queried SystemProcessInformation at 00000000-00007944-00000C15-1713785128 [PID: 7944] "UQWCKSUOOCSVIHXQ.exe" queried SystemProcessInformation at 00000000-00007944-00000C15-1713792967 [PID: 7944] "UQWCKSUOOCSVIHXQ.exe" queried SystemProcessInformation at 00000000-00007944-00000C15-1713947823 [PID: 7944] "UQWCKSUOOCSVIHXQ.exe" queried SystemProcessInformation at 00000000-00007944-00000C15-1713955156 [PID: 7944] "UQWCKSUOOCSVIHXQ.exe" queried SystemProcessInformation at 00000000-00007944-00000C15-1714069905 [PID: 7944] "UQWCKSUOOCSVIHXQ.exe" queried SystemProcessInformation at 00000000-00007944-00000C15-1714077191 [PID: 7944] "UQWCKSUOOCSVIHXQ.exe" queried SystemProcessInformation at 00000000-00007944-00000C15-1715390793 [PID: 7944] "UQWCKSUOOCSVIHXQ.exe" queried SystemProcessInformation at 00000000-00007944-00000C15-1715707051 [PID: 7944] "UQWCKSUOOCSVIHXQ.exe" queried SystemProcessInformation at 00000000-00007944-00000C15-1715952512 [PID: 7944] "UQWCKSUOOCSVIHXQ.exe" queried SystemProcessInformation at 00000000-00007944-00000C15-1716209806 [PID: 7944]27:T24f7,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000704) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000704) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ace2de9e020000000000000000000051ed00c1f97f0000000000009e02000000000000000000006765ef009cd500002a0000000000000040386cdb9e0200008fec00c1f97f0000e0ace2de9e020000e0ace2de9e020000000000000000000000000000f97f0000ffffff7fc8e9000000000000000000000000000000000000d8ced6de9e0200002a0000000000000069c38fde9e0200003100000000000000e802000000000000ec02000000000000110001100000000050d03e64c700000003a3eec0f97f000050d03e64c700000000000000000000002b00000000000000000000000000000020b095de9e020000b43f94de9e020000e0ced6de (UID: 00000000-00000704) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000360d000000000000d0a73e64c70000000400000000000000e00b3177d701000006000000000000000300000000000000a740febdf97f0000f0a83e64c7000000e0a83e64c70000000000000000000000010100000000000090b66fdb9e0200000a000000000000007cb03e64c7000000b9eefdbdf97f000043003a005c005500730065007200730000004c0044004100500049002e0064006c006c00000000000000000000000000e0a83e64c7000000f07807bff97f00000000000000000000e0a83e64c70000000400000000000000b8a83e64c700000050a83e64c70000000498fec0f97f0000b8a83e64c700000014a93e64c700000000000000 (UID: 00000000-00000704) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000fc710000020000000000000000000000c01286db9e0200000000000000000000000086db9e02000000c04764c7000000003e6ebef97f0000003e6ebef97f0000103469db9e020000b06669db9e02000028002a0000000000c00c86db9e0200001700000000000000400000000000000070a03e64c70000000000000000000000000000000000000000000000000000000000000000000000040000000000000040000000000000003200000000000000000069db9e0200003289fec0f97f000040000000000000000000000000000000320000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00000704) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000002a0d000000000000a0a03e64c7000000b83dd359327f000050c93077d701000002ffff7f000000000800000000000000a740febdf97f000050a13e64c7000000000000000000000002cd2309af090000fb00000000000000206a6fdb9e020000100000000000000044a43e64c7000000c0a43e64c700000043003a005c00550073006500720073005c005000750062006c0069006300000068a43e64c700000036fbfdbdf97f0000340000c0c7000000d0a13e64c7000000ca03000000000000b10efebdf97f000090000000c700000028a13e64c700000020a13e64c70000000498fec0f97f000000000000c7000000ca0300000000000000000000 (UID: 00000000-00000704) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000009dfd00000000000002000000000000000000000000000000000f86db9e02000000000000f97f0000000086db9e02000000c04764c70000002400000000000000a8973e64c7000000d0e769db9e020000f2e79eaff97f0000360038008d9d0000c00c86db9e0200000200000000000000500000000000000040993e64c70000000000000000000000000000000000000000000000000000000000000000000000050000000000000050000000000000004000000000000000000069db9e0200003289fec0f97f000040000000000000000000000000000000400000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00000704) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000001c0d00000000000070993e64c7000000da44d359327f000010732f77d701000009ffff7f000000000f00000000000000a740febdf97f000040993e64c700000060993e64c700000000f26fdb02000000f40000000000000000116edb9e02000018000000000000000200000000000000340037003100370043003a005c00550073006500720073005c005000750062006c00690063005c004400650073006b0074006f007000000043003a005c00550073006500720073005c005000750062006c00690063005c006400650073006b0074006f0070002e0069006e00690000000498fec0f97f00007dcdfdf8a53a0000000000000000000070356fdb (UID: 00000000-00000704) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000009dfd00000000000002000000000000000000000000000000400e86db9e02000000000000f97f0000000086db9e02000000c04764c7000000240000000000000078903e64c7000000d0e769db9e020000f2e79eaff97f0000460048008d9d0000c00c86db9e0200001900000000000000600000000000000010923e64c70000000000000000000000000000000000000000000000000000000000000000000000060000000000000060000000000000005000000000000000000069db9e0200003289fec0f97f000040000000000000000000000000000000500000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00000704) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000001e0d000000000000a0a03e64c7000000ac3dd359327f0000e06b2f77d701000008ffff7f000000000e00000000000000a740febdf97f00000900000000000000b001000000000000040369db9e020000f500000000000000c0116edb9e0200001900000000000000000086db9e02000000c04764c700000043003a005c00500072006f006700720061006d0044006100740061005c004d006900630072006f0073006f00660074000000002d000000003001000000000000020000029e02000000000000000000000000000000000000d0376edb9e02000000000000000000000498fec0f97f00003001000000000000230100000000000009000009 (UID: 00000000-00000704) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000009dfd00000000000002000000000000000000000000000000400e86db9e02000000000000f97f0000000086db9e02000000c04764c70000002400000000000000a8973e64c7000000d0e769db9e020000f2e79eaff97f000048004a008d9d0000c00c86db9e0200000600000000000000600000000000000040993e64c70000000000000000000000000000000000000000000000000000000000000000000000060000000000000060000000000000005200000000000000000069db9e0200003289fec0f97f000040000000000000000000000000000000520000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00000704) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000069db9e020000000070db9e020000daf26fdb9e020000520000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000009e020000e0f26fdb9e02000010000000000000007f0300009e0200000000000000000000d0f26fdb9e020000d0f26fdb9e020000ff030000000000000101000000000000f81b000000000000ce30000000000000ce30000000000000ff03000000000000000000000000000062636ddb9e02000000000000000000000000000000000000000000000000000032cfffffff000000520000000000000040993e64c7000000147869db9e020000500169db (UID: 00000000-00000704) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000fa0c00000000000040923e64c7000000e84bd359327f000090ca2e77d70100001affff7f000000002000000000000000a740febdf97f00000000000000000000000270db9e020000f00270db9e020000e300000000000000f05d6ddb9e0200002c00000000000000390032006400620000e4fec0f97f000043003a005c00500072006f006700720061006d0044006100740061005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e00750000000000000000000000001b0000000000000498fec0f97f000000000000a53a0000f00270db9e02000004000105 (UID: 00000000-00000704) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000140000140000000002000000000000003f30000f00000000b0913e64c700000002000002f97f000060ff69db9e020000a73dfdc0f97f0000240000000000000002000002c7000000d0e769db9e02000002000002f97f00006e0070008d9d0000c0e06fdb9e0200003700000000000000983cfdc0f97f0000e08a3e64c7000000b68b3e64c7000000000000000000000000000000000000000000000000000000000000000000000008000000000000008000000000000000000069db9e0200000b8efec0f97f0000000069db9e0200000200000000000000780000000000000080000000000000000000000000000000ffffffffc700000000000000 (UID: 00000000-00000704) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000b68b3e64c7000000000000000000000000000000000000000000000000000000000000000000000008000000000000008000000000000000000069db9e0200000b8efec0f97f0000000069db9e0200000200000000000000780000000000000080000000000000000000000000000000ffffffffc7000000000000000000000000010100000000000000000000000000401d6fdb9e020000581d6fdb9e020000401d6fdb9e020000861d6fdb9e0200000000000000000000000000000000000000000000000000000000000000000000401d6fdb9e020000581d6fdb9e020000401d6fdb9e0200000000000000000000ffffffff0000000000000000 (UID: 00000000-00000704)28:T8c8,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000006b81f67f000000000000000000001800000000000000000000000000000000000000000000005750ef009cd50000d2e7914e0f37000000006b81f67f000011c697aff97f000006000000c70000000000000000000000011f69db9e0200001f000000000000000000100006000000000000000000000000006b81 (UID: 00000000-00000704) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7b00bef97f00000000a9a3f97f0000000000000000000000000000000000000806aaa3f97f00000001000000000000f098edc0f97f00000001000000000000000100000000000000000000000000000006aaa3f97f000001000000000000000f18a9a3f97f000000000000000000000006aaa3f97f000000000000 (UID: 00000000-00000704) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c31cda1f97f0000708bcfa1f97f00000200000000000000708bcfa1f97f000000000000000000000300000000000000b131cda1f97f0000a815d0a1f97f0000c0c9a1db9e020000d0c9a1db9e020000888bcfa1f97f00000100000000000000239fefc0f97f00000000000000000000888bcfa1f97f000006000000 (UID: 00000000-00000704) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303d1f9ef97f0000c0fe209ef97f00000400000000000000c0fe209ef97f000000000000000000000500000000000000453d1f9ef97f0000286a219ef97f0000be5a01bef97f0000f827dbdd9e0200005806219ef97f0000b08e01bef97f0000239fefc0f97f00000100000000000000d1321f9ef97f0000e0fe209e (UID: 00000000-00000704) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000be5a01bef97f00000000669ef97f000000000000000000000000000000000000883f679ef97f00000001000000000000f098edc0f97f0000000100000000000000010000000000000000000000000000803f679ef97f00000100000000000000bf10669ef97f00000000000000000000803f679ef97f000000000000 (UID: 00000000-00000704) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000080996dd9e02000000000000000000000200000000000000200000000000000010000000000000000000a1db9e0200003289fec0f97f0000401a8adb9e02000000000000f97f000000008adb9e020000102c95dd9e020000000000000000000010333064c7000000080996dd (UID: 00000000-00000704)29:Ta3e,"WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000704) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00000704) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00000704) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000704) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000704) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000704) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000704) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00000704) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000704) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000704) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000704) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00000704) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00000704) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00000704) "WScript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00000704) "WScript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000704) "UQWCKSUOOCSVIHXQ.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007944)2a:T3566,"WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter SetCriticalSectionSpinCount (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00000704) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00000704) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter NtQueryVirtualMemory (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter RtlCompareMemory (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter NtProtectVirtualMemory (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter NtFlushInstructionCache (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemory (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter CreateRemoteThread (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00007944) "UQWCKSUOOCSVIHXQ.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007944)2b:Tfa0,"WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff99a540000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff9bb950000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7ff9bf4a0000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7ff9befc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 7ff99a1e0000 "WScript.exe" loaded module "AMSI.DLL" at base 7ff9a7d20000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff9b4af0000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff9a4b40000 "WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff9bdfa0000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff9bdfa0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff9bdfa0000 "WScript.exe" loaded module "KERNEL32" at base 7ff9befc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\KQMNG001.DLL" at base 7ff9a3ab0000 "WScript.exe" loaded module "WLDP.DLL" at base 7ff9bc370000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff9bf280000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff9be3b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff9bc750000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff9a7d90000 "WScript.exe" loaded module "OLE32.DLL" at base 7ff9bf130000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff9bdc80000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff9a3a90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ff9a1cd0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ff99e660000 "WScript.exe" loaded module "NTDLL.DLL" at base 7ff9c0fc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff9b97c0000 "WScript.exe" loaded module "SHELL32.DLL" at base 29ede840000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff9bd3c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base 7ff99e1f0000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff99a100000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff9befc0000 "WScript.exe" loaded module "USERENV.DLL" at base 7ff9bd240000 "WScript.exe" loaded module "VERSION.DLL" at base 7ff9b4af0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 7ff9980e0000 "WScript.exe" loaded module "%COMMONPROGRAMFILES%\SYSTEM\ADO\MSADO15.DLL" at base 7ff997fa0000 "WScript.exe" loaded module "USER32.DLL" at base 7ff9be6c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ff9a7f30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 29ede840000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ff9b2860000 "WScript.exe" loaded module "MSISO.DLL" at base 7ff9afb80000 "WScript.exe" loaded module "SSPICLI.DLL" at base 7ff9bd210000 "WScript.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff9bdfa0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ff9bb710000 "UQWCKSUOOCSVIHXQ.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73730000 "UQWCKSUOOCSVIHXQ.exe" loaded module "KERNEL32.DLL" at base 74700000 "UQWCKSUOOCSVIHXQ.exe" loaded module "USER32.DLL" at base 76b80000 "UQWCKSUOOCSVIHXQ.exe" loaded module "NTDLL.DLL" at base 76e90000 "UQWCKSUOOCSVIHXQ.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73f30000 "UQWCKSUOOCSVIHXQ.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73f30000 "UQWCKSUOOCSVIHXQ.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73f30000 "UQWCKSUOOCSVIHXQ.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72f600002c:Tbd1,"WScript.exe" called "WScript.ScriptName" with result: "S0_283723919.JS" ... "WScript.exe" called "Microsoft.XMLDOM.1.0.CreateObject" ... "WScript.exe" called "Microsoft.XMLDOM.1.0.createElement" with result: "IDispatch" ... "WScript.exe" called "Microsoft.XMLDOM.1.0("createElement").dataType" ... "WScript.exe" called "Microsoft.XMLDOM.1.0("createElement").text" ... "WScript.exe" called "ADODB.Stream.6.0.CreateObject" ... "WScript.exe" called "ADODB.Stream.6.0.Type" ... "WScript.exe" called "Microsoft.XMLDOM.1.0("createElement").nodeTypedValue" with result: "local UQWCK = "|E=;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;?8LroUmy:V?viRJ/x.0j:so4m8|`Vp!Woj6+OKOrHM3pYokf8J>Jw:Op|/K58:G320ZRf7?q?1X7/gGK1+Zg60nV>xVLr>mwRuMr67:tfqKGm6o<8nMOs`:UI:g;2T6ZWQIvK syX?V3iSGsG1++.xVGSLp<39vqX>fY`J7TkRJUmTyTt7jVLgXzRp9HJG8uPl:o/xl7U.?Q5HWNR:V;<4eYLHJMUt!s>pJxPxjW5 7?1s:w/>vh+H;GPY>Sw ;YZx!7HW7f:05Pu0 m>sLMwi.;HL7mXT4n`rRoswIXW|sQ3qnmnngjh m67i7:lUfe:T`WlKjPJ<+oRvjj6K5XZw3IG7vpR`9!0vlfkM?rf;83l3:Q./Um3MhUt/Os6 oS18:Y+x ff0XJ+UIpXtOQ`1ykJ7RVLGgRHow8SMgM5MQg<988S.`M.Rk3V9:rIPO0SfMMtjjJ4q|26w`vyySNUQi6?vtnZnJ+wViGwWrZ8vsel+1h.jk+14I?;i9;KsMjYm8`y;3N3`VrSu|LWrj|Zz`ntU3nY:IoX69TtR5hotYLLM>xwo>MIM:TS9N< ?`O/G/RJl9zn::g|G5wLNv6k41ORzIxL|+g01?of2HMpPT.ThGY<9Hy:1zZwozmXPjRZtzY68>!M6zXMiONSnsP1Ug2:>j8h?I6emjvOul4>5NhZvl8Zf7MHoJ9MsI:?|eU1xwRl4rKzH?9>PpPuP0vl4?GWWflxZW5vwZw:hSLXu6pUJSKNehx!jzuhU!+re9y:!QVpsjUJ0M.r05?Mp JsMt2h >|st0Qmxl8yG4QjfO1LiuXqhrpjOjg9s:hH`.QKswxt;Q7+8fnpMNx|M159l.imMyIGnjXg>8oUj:e6mT4n:VyH;+03:K+nk4/1QsKnwx>>jueTyt1xv1:Oz!n;kf?NH+I5RsU4xTTSG6:m9k8S8q<1J/s2tMlP4JzSN1lYJG+xGzJXNt4x1hrVII" ..., "WScript.exe" called "ADODB.Stream.6.0.Write" ... , "WScript.exe" called "ADODB.Stream.6.0.Position" ... , "WScript.exe" called "ADODB.Stream.6.0.SaveToFile" ... , "WScript.exe" called "Microsoft.XMLDOM.1.0("createElement").nodeTypedValue" with result: "MZ" ..., "WScript.exe" called "WScript.CreateObject" with result: "IDispatch" ..., "WScript.exe" called "WScript.Shell.1.CreateObject" ... 2d:T739,"WScript.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "WScript.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "WScript.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "WScript.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WScript.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "WScript.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "WScript.exe" touched "JScript Language" (Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\TREATAS") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "WScript.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "WScript.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "WScript.exe" touched "XML DOM Document" (Path: "HKCU\CLSID\{2933BF90-7B36-11D2-B20E-00C04F983E60}\TREATAS") "WScript.exe" touched "ADODB.Stream" (Path: "HKCU\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\TREATAS")2e:T620,"WScript.exe" reads file "C:\Users\desktop.ini" "WScript.exe" reads file "C:\Users\Public\desktop.ini" "WScript.exe" reads file "C:\Users\Public\Desktop\desktop.ini" "WScript.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "WScript.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini" "WScript.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini" "WScript.exe" reads file "C:\Windows\Fonts\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini"2f:T7ee,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\KINDMAP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\PROGID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\PROGID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE\CURVER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\CURVER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE\SHELLEX\ICONHANDLER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELLEX\ICONHANDLER"; Key: ""; Value: "")30:Ta9b,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "ALLOWFILECLSIDJUNCTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "ALLOWFILECLSIDJUNCTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\KINDMAP"; Key: ".EXE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.EXE"; Key: "CONTENT TYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE"; Key: "DOCOBJECT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE"; Key: "DOCOBJECT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE"; Key: "BROWSEINPLACE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE"; Key: "BROWSEINPLACE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE"; Key: "ISSHORTCUT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE"; Key: "ISSHORTCUT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE"; Key: "ALWAYSSHOWEXT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE"; Key: "ALWAYSSHOWEXT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE"; Key: "NEVERSHOWEXT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE"; Key: "NEVERSHOWEXT"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "")31:T818,"WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SLC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\SLC.dll" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SPPC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\sppc.dll" "WScript.exe" trying to access non-existent file "C:\Program Files\Common Files\system\ado\MSDART.DLL" "UQWCKSUOOCSVIHXQ.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "UQWCKSUOOCSVIHXQ.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "UQWCKSUOOCSVIHXQ.exe" trying to access non-existent file "C:\Users\%OSUSER%\Documents\FLTLIB.DLL" "UQWCKSUOOCSVIHXQ.exe" trying to access non-existent file "C:\Users\a03pf7A\Documents\FLTLIB.DLL" "UQWCKSUOOCSVIHXQ.exe" trying to access non-existent file "C:\Users\%OSUSER%\Documents\MSVCP140.DLL" "UQWCKSUOOCSVIHXQ.exe" trying to access non-existent file "C:\Users\a03pf7A\Documents\MSVCP140.dll" "UQWCKSUOOCSVIHXQ.exe" trying to access non-existent file "C:\Users\%OSUSER%\Documents\VCRUNTIME140.DLL" "UQWCKSUOOCSVIHXQ.exe" trying to access non-existent file "C:\Users\a03pf7A\Documents\VCRUNTIME140.dll" "UQWCKSUOOCSVIHXQ.exe" trying to access non-existent file "C:\Users\%OSUSER%\Documents\CRYPTSP.DLL" "UQWCKSUOOCSVIHXQ.exe" trying to access non-existent file "C:\Users\a03pf7A\Documents\CRYPTSP.DLL" "UQWCKSUOOCSVIHXQ.exe" trying to access non-existent file "C:\Users\%OSUSER%\Documents\VCRUNTIME140_CLR0400.DLL" "UQWCKSUOOCSVIHXQ.exe" trying to access non-existent file "C:\Users\a03pf7A\Documents\VCRUNTIME140_CLR0400.dll" "UQWCKSUOOCSVIHXQ.exe" trying to access non-existent file "C:\Users\%OSUSER%\Documents\UCRTBASE_CLR0400.DLL" "UQWCKSUOOCSVIHXQ.exe" trying to access non-existent file "C:\Users\a03pf7A\Documents\ucrtbase_clr0400.dll"32:T42b,"WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "DA0C000000000000040004000102040000000000630000000D787900010000006B507E000200000087DE830046000000A19F5E000400010000006D00000056737D00070000006B507E00010000009829B70007000000E6C53100010004000000020000001A9CB2000100050000000100000016F0B20001006500000078030000E6C5310000")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"33dbb7d0c78bfa2e124b78409ecc7152a80016bbcccf39e960a2790d1efb8a22","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":83,"unified_at_epoch_ms":1791600591015,"unified_at":"2026-10-10T02:49:51.015Z","metadata":{"hashes":{"sha256":"33dbb7d0c78bfa2e124b78409ecc7152a80016bbcccf39e960a2790d1efb8a22","sha1":"a302e6d2cb4e97fcdd352ac51606583b748d4f82","md5":"93d2a83d9b1440fd27d7722fe6aeafc2","sha512":"bc1f5188268987430e1d126bc474fa762ddc9ad5ba80ffdf741b88fa87792c5c60689431d12ee8986f383bc990914d7813d356f1e58bfb4b698bb48d30f6a5ea","ssdeep":"98304:jJo8tAZz9IsWLx52IGabKH1kjKRCnfFfW4oKKHIknP61vLgRV9iX:3Gb1keofFfW4ozPZVM","ssdeep_chunks":["98304:jJo8tAZ","98304:Jo8tAZz","98304:o8tAZz9","98304:8tAZz9I","98304:tAZz9Is","98304:AZz9IsW","98304:Zz9IsWL","98304:z9IsWLx","98304:9IsWLx5","98304:IsWLx52","98304:sWLx52I","98304:WLx52IG","98304:Lx52IGa","98304:x52IGab","98304:52IGabK","98304:2IGabKH","98304:IGabKH1","98304:GabKH1k","98304:abKH1kj","98304:bKH1kjK","98304:KH1kjKR","98304:H1kjKRC","98304:1kjKRCn","98304:kjKRCnf","98304:jKRCnfF","98304:KRCnfFf","98304:RCnfFfW","98304:CnfFfW4","98304:nfFfW4o","98304:fFfW4oK","98304:FfW4oKK","98304:fW4oKKH","98304:W4oKKHI","98304:4oKKHIk","98304:oKKHIkn","98304:KKHIknP","98304:KHIknP6","98304:HIknP61","98304:IknP61v","98304:knP61vL","98304:nP61vLg","98304:P61vLgR","98304:61vLgRV","98304:1vLgRV9","98304:vLgRV9i","98304:LgRV9iX","196608:jJo8tAZ","196608:Jo8tAZz","196608:o8tAZz9","196608:8tAZz9I","196608:tAZz9Is","196608:AZz9IsW","196608:Zz9IsWL","196608:z9IsWLx","196608:9IsWLx5","196608:IsWLx52","196608:sWLx52I","196608:WLx52IG","196608:Lx52IGa","196608:x52IGab","196608:52IGabK","196608:2IGabKH","196608:IGabKH1","196608:GabKH1k","196608:abKH1kj","196608:bKH1kjK","196608:KH1kjKR","196608:H1kjKRC","196608:1kjKRCn","196608:kjKRCnf","196608:jKRCnfF","196608:KRCnfFf","196608:RCnfFfW","196608:CnfFfW4","196608:nfFfW4o","196608:fFfW4oK","196608:FfW4oKK","196608:fW4oKKH","196608:W4oKKHI","196608:4oKKHIk","196608:oKKHIkn","196608:KKHIknP","196608:KHIknP6","196608:HIknP61","196608:IknP61v","196608:knP61vL","196608:nP61vLg","196608:P61vLgR","196608:61vLgRV","196608:1vLgRV9","196608:vLgRV9i","196608:LgRV9iX","98304:3Gb1keo","98304:Gb1keof","98304:b1keofF","98304:1keofFf","98304:keofFfW","98304:eofFfW4","98304:ofFfW4o","98304:fFfW4oz","98304:FfW4ozP","98304:fW4ozPZ","98304:W4ozPZV","98304:4ozPZVM"],"imphash":"Unknown"},"file_info":{"file_name":"103_ETT177321458.JS.js","file_type":["script","javascript"],"file_type_id":"js","file_size":3867537,"entropy":5.92,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791558068000,"last_seen":1791600475000,"last_multi_scan":1791600475000}},"detections":{"summary":{"verdict":"malicious","score":83,"tags":["evasive"]},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":41},"sandbox_signatures":{"informative_count":75,"suspicious_count":9,"malicious_count":3,"total":87},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"JS:Trojan.Cryxos.16865","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"JS:Trojan.Cryxos.16865 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"JS/TrojanDropper.ModiLoader.BZ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"JS/Agent.ECX2!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.JS.Agent.DSN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Cryxos.JS","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"},{"type":"informative","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Scripts code detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"Executes a JavaScript file"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Calls an API typically used to create a thread in another process"},{"type":"suspicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to use AES encryption instructions"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files"},{"type":"informative","value":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)"},{"type":"informative","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"informative","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"suspicious","value":"Loads syscall stubs from disk during runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops executable files inside user directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"WScript.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00000704)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00000704)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00000704)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00000704)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"WScript.exe\" called \"LoadResource with parameter {'hModule': '2881351712769', 'hResInfo': '2881351714016'}\" (UID: 00000000-00000704)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2881351712769', 'hResInfo': '2881351714048'}\" (UID: 00000000-00000704)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2881351712769', 'hResInfo': '2881351714064'}\" (UID: 00000000-00000704)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2881351712769', 'hResInfo': '2881351714032'}\" (UID: 00000000-00000704)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"WScript.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"WScript.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"UQWCKSUOOCSVIHXQ.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"UQWCKSUOOCSVIHXQ.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$25","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$26","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Scripts code detected via AMSI (Antimalware Scan Interface)","description":"Script name: C:\\S0_283723919.JS contents: \nfunction anonymous() {\ndebugger\n}\n\n","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059.001","relevance":5,"id":"amsi-2","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)","description":"Process \"WScript.exe\" executed suspicious script","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059","relevance":3,"id":"amsi-0","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to use AES encryption instructions","description":"file/memory contains long string with (Indicator: \"AESNI\"; File: \"S0_283723919.JS\")\n Found string \"'UQWCKSUOOCSVIHXQOOO':'AESNI'\" (Indicator: \"AESNI\"; File: \"S0_283723919.JS\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":3,"id":"string-584","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use AES encryption instructions\n Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"UQWCKSUOOCSVIHXQ.exe\" at offset 198463; code bytes = 30d0\n Found XOR loop in file \"UQWCKSUOOCSVIHXQ.exe\" at offset 345809; code bytes = 30d0\n Found XOR loop in file \"UQWCKSUOOCSVIHXQ.exe\" at offset 355782; code bytes = 30d0\n Found XOR loop in file \"UQWCKSUOOCSVIHXQ.exe\" at offset 412488; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WScript.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000704)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WScript.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000704)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WScript.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000704)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"WScript.exe\" called \"GetForegroundWindow\" (UID: 00000000-00000704)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"WScript.exe\" called \"IsWow64Process\" with parameter \"704\" - (UID: 00000000-00000704)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000704)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WScript.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00000704)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00000704)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00000704)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"UQWCKSUOOCSVIHXQ.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\UQWCKSUOOCSVIHXQ.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"WScript.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%USERPROFILE%\\Documents\\UQWCKSUOOCSVIHXQ.exe\" %USERPROFILE%\\Documents\\QXHIVSCOOUSKCWQU\" - (UID: 00000000-00000704)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process WScript.exe created mutex with name \"\\BaseNamedObjects\\SyncRootManager\"\n Process WScript.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:704:120:WilError_01\"\n Process WScript.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:704:304:WilStaging_02\"\n Process WScript.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process WScript.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n Process WScript.exe created mutex with name \"Local\\SM0:704:304:WilStaging_02\"\n Process WScript.exe created mutex with name \"Local\\ZonesCacheCounterMutex\"\n Process WScript.exe created mutex with name \"Local\\ZonesLockedCacheCounterMutex\"\n Process WScript.exe created mutex with name \"Local\\SM0:704:120:WilError_01\"\n Process UQWCKSUOOCSVIHXQ.exe created mutex with name \"\\BaseNamedObjects\\7-O1179BD08XJy0-\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"UQWCKSUOOCSVIHXQ.exe\" as clean (type is \"PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 10 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Executes a JavaScript file","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\S0_283723919.JS\"\" (UID: 00000000-00000704)","origin":"Monitored Target","mitre_attack_id":"T1059.007","relevance":3,"id":"target-167","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"UQWCKSUOOCSVIHXQ.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" - [base:0; Status:c000007b]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at A7D20000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at BE410000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at BCE70000\n \"UQWCKSUOOCSVIHXQ.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74110000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"UQWCKSUOOCSVIHXQ.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72F60000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at BF4A0000\n \"UQWCKSUOOCSVIHXQ.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74180000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"$2c","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00c700000040c711bef97f0000@ntdll.dll\"\n \"22002300c700000018c711bef97f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"S0_283723919.JS\" was detected as \"plain text\" and name: \"Format\"\n \"UQWCKSUOOCSVIHXQ.exe\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"UQWCKSUOOCSVIHXQ.exe\" (UID: 00000000-00007944) was launched with new environment variables: \"USERDNSDOMAIN=\"N7Q5bRQzrg46c2r\"\"\n Process \"UQWCKSUOOCSVIHXQ.exe\" (UID: 00000000-00007944) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Reads configuration files (.ini files)","description":"$2e","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"UQWCKSUOOCSVIHXQ.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00000704-00000C2B-1709165812]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00000704-00000C2B-1709292712]\n Observed system executable string:\"%WINDIR%\\system32\\kernel32.dll\" [Source: 00000000-00000704-00000C2B-1710030979]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" [Source: 00000000-00007944-00000C2B-1714200940]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" [Source: 00000000-00007944-00000C2B-1714311857]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"UQWCKSUOOCSVIHXQ.exe\" with commandline \"%USERPROFILE%\\\\Documents\\\\QXHIVSCOOUSKCWQU\" (UID: 00000000-00007944)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"UQWCKSUOOCSVIHXQ.exe\" with commandline \"%USERPROFILE%\\\\Documents\\\\QXHIVSCOOUSKCWQU\" (UID: 00000000-00007944)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"UQWCKSUOOCSVIHXQ.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"UQWCKSUOOCSVIHXQ.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"UQWCKSUOOCSVIHXQ.exe\" has type \"PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 10 sections\"- Location: [%USERPROFILE%\\Documents\\UQWCKSUOOCSVIHXQ.exe]- [targetUID: 00000000-00000704]\n \"QXHIVSCOOUSKCWQU\" has type \"ASCII text with very long lines (65536) with no line terminators\"- Location: [%USERPROFILE%\\Documents\\QXHIVSCOOUSKCWQU]- [targetUID: 00000000-00000704]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops executable files","description":"\"UQWCKSUOOCSVIHXQ.exe\" has type \"PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 10 sections\"- Location: [%USERPROFILE%\\Documents\\UQWCKSUOOCSVIHXQ.exe]- [targetUID: 00000000-00000704]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\wscript.exe\" (UID: 704)\n \"UQWCKSUOOCSVIHXQ.exe\" queries basic process information of the \"C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE\" (UID: 7944)\n \"UQWCKSUOOCSVIHXQ.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\dfrgui.exe\" (UID: 7944)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"UQWCKSUOOCSVIHXQ.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007944)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\s0_283723919.js\"\n \"WScript.exe\" reads file \"c:\\windows\\system32\\wshom.ocx\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\version.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\VERSION.dll\"\n \"WScript.exe\" trying to touch file \"\\Device\\CNG\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"WScript.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\kernelbase.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\ole32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\ole32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"WScript.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"WScript.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$31","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\AppLocker\\MDM\"\n \"WScript.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\DESKTOP.INI\"\n \"WScript.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\DESKTOP.INI\"\n \"WScript.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\Documents\\QXHIVSCOOUSKCWQU\"\n \"WScript.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\Documents\\S0_283723919.JS\"\n \"WScript.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\Documents\\UQWCKSUOOCSVIHXQ.exe:ZONE.IDENTIFIER\"\n \"WScript.exe\" trying to access non-existent file \"C:\\Users\\a03pf7A\\Documents\\UQWCKSUOOCSVIHXQ.exe:Zone.Identifier\"\n \"UQWCKSUOOCSVIHXQ.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\Documents\\UQWCKSUOOCSVIHXQ.MUI\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"WScript.exe\" wrote 2048 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\Documents\\UQWCKSUOOCSVIHXQ.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"WScript.exe\" writes file \"c:\\users\\%osuser%\\documents\\qxhivscoouskcwqu\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"x2066\\x20/r\\x20ib','uqwcksuoocsvihxqoo512_fp16'],[uqwcksuoocsvihxq39368(0x2*0x397+-0x1*-0xb1d+0x4d*-0x35),uqwcksuoocsvihxq39368(-0x855+0xbf7+-0x25c),uqwcksuoocsvihxq39368(-0x892*0x1+0x2100+-0x169f),uqwcksuoocsvihxq39368(-0x22c4+-0x24a*0xf+0x4767),uqwcksuoo\"\n Heuristic match: \"0x2aeb),uqwcksuoocsvihxq51613(0x25ec+0x1e5b+-0x4219)],[uqwcksuoocsvihxq51613(-0x1e0e+-0x7*-0xe7+-0x3a1*-0x7),uqwcksuoocsvihxq51613(-0x18*0x133+0x7*-0x3d7+0x389d),uqwcksuoocsvihxq51613(0x1099*-0x1+0x228c+-0xc9*0x15),'uqwcksuoocsvihxqty.128.np.map5.w0\\x2059\\\"\n Pattern match: \"http://luajit.org/=\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"UQWCKSUOOCSVIHXQ.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; File: \"S0_283723919.JS\")\n Found string \"'UQWCKSUOOCSVIHXQOOO':'AESNI'\" (Indicator: \"aes\"; File: \"S0_283723919.JS\")\n Found string \"'UQWCKSUOOCSVIHXQOOO':'VAES'\" (Indicator: \"aes\"; File: \"S0_283723919.JS\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\USERS\\HAPUBWS\\DOCUMENTS\\UQWCKSUOOCSVIHXQ.EXE\"; Value: \"\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGLEVEL\"; Value: \"\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGMATCHANYMASK\"; Value: \"\")\n \"UQWCKSUOOCSVIHXQ.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"QXHIVSCOOUSKCWQU\" contains indicator \".Sleep(\" (Line: 1; Offset: 568758)\n \"QXHIVSCOOUSKCWQU\" contains indicator \".Run\" (Line: 1; Offset: 128546)","origin":"Binary File","mitre_attack_id":"T1105","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside user directory","description":"\"UQWCKSUOOCSVIHXQ.exe\" has type \"PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 10 sections\"- Location: [%USERPROFILE%\\Documents\\UQWCKSUOOCSVIHXQ.exe]- [targetUID: 00000000-00000704]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-32","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"UQWCKSUOOCSVIHXQ.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%USERPROFILE%\\Documents\\UQWCKSUOOCSVIHXQ.exe\" %USERPROFILE%\\Documents\\QXHIVSCOOUSKCWQU\" - (UID: 00000000-00000704)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Loads syscall stubs from disk during runtime","description":"\"UQWCKSUOOCSVIHXQ.exe\" trying to read a file \"C:\\Windows\\SysWOW64\\ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1027.007","relevance":3,"id":"api-298","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"WScript.exe\" at 00000000-00000704-00000C15-1713314732\n \"UQWCKSUOOCSVIHXQ.exe\" at 00000000-00007944-00000C15-1715364974","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"UQWCKSUOOCSVIHXQ.exe queries ProcessDebugPort (UID: 7944)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"UQWCKSUOOCSVIHXQ.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\wscript.exe\" queried ProcessMitigationPolicy\n \"C:\\Users\\%OSUSER%\\Documents\\UQWCKSUOOCSVIHXQ.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"6/27 Antivirus vendors marked sample as malicious (22% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"UQWCKSUOOCSVIHXQ.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to create a thread in another process","description":"\"UQWCKSUOOCSVIHXQ.exe\" called \"CreateRemoteThread\" with parameters {\"hProcess\": \"4294967295\"\n \"lpThreadAttributes\": \"0\"\n \"dwStackSize\": \"0\"\n \"lpStartAddress\": \"89990976\"\n \"lpParameter\": \"0\"\n \"dwCreationFlags\": \"0\"\n \"lpThreadId\": \"87092216\"}","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-106","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"UQWCKSUOOCSVIHXQ.exe\" set thread context in remote process \"%PROGRAMFILES%\\Microsoft Office\\Office14\\ONENOTEM.EXE\" (PID: 1d78)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]}],"intel_graph":{"map":{"File:33dbb7d0c78bfa2e124b78409ecc7152a80016bbcccf39e960a2790d1efb8a22":{"type":"File","value":"33dbb7d0c78bfa2e124b78409ecc7152a80016bbcccf39e960a2790d1efb8a22"},"File:8c39c8b84d63bfd06f160f83aea61bb8aa816285d09dfc633699a4b4d79bca6b":{"type":"File","value":"8c39c8b84d63bfd06f160f83aea61bb8aa816285d09dfc633699a4b4d79bca6b"},"File:d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49":{"type":"File","value":"d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49"}},"chains":[{"id":"sandbox_files","root":"File:33dbb7d0c78bfa2e124b78409ecc7152a80016bbcccf39e960a2790d1efb8a22","edges":[{"edge_kind":"extracted","from_key":"File:33dbb7d0c78bfa2e124b78409ecc7152a80016bbcccf39e960a2790d1efb8a22","to_key":"File:d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49"},{"edge_kind":"extracted","from_key":"File:33dbb7d0c78bfa2e124b78409ecc7152a80016bbcccf39e960a2790d1efb8a22","to_key":"File:8c39c8b84d63bfd06f160f83aea61bb8aa816285d09dfc633699a4b4d79bca6b"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":83,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":4,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6ac9a75ada39f4c49808c322","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":83,"malware_family":"JS:Trojan.Cryxos","submit_name":"S0_283723919.JS","analysis_start_time":"2026-10-10T02:47:55+00:00","indicators_count":{"informative":75,"suspicious":12,"malicious":3},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}],"processes":[{"pid":704,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\S0_283723919.JS\"","sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00000704","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABIklEQVR4Xs2Siw7DIAhF/XQ/rX+25cYxkV58FbOdxLRFhQNbSoqc8yt66fxDcCGSvxBYkjghcF3XvMQJATAtcUoATEn0BOT3nFn6jq3RxRMo8WSi9290KbnM5hd95gYTkFjOia5CLS5TwHvNUlkS4J1b2uJ4l4WYPb0h0O/eK+5JbAn4+N2HCtjOvQnYfEDn0+cpnsAdyVsn0Gx3WBIAJXbvnk2hvcnZFAC1a/aclVgWAOP/wrzElgCImsS2AIiYxCMB8HQSQQK8qH0yiW0B7I0WcmiJMAEvbju1EiECJdbkaNDFC8ETYIn1sxXge59gE6P4Ary4LaTPsuI6TmECAHFc7C2cQQ75xrvNA7YEgD07wt4XtgWi+H8B+9ueWLbuT3kDb24C8Zv/GpsAAAAASUVORK5CYII="},{"pid":7944,"ppid":704,"name":"UQWCKSUOOCSVIHXQ.exe","command_line":"%USERPROFILE%\\Documents\\QXHIVSCOOUSKCWQU","sha256":"d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49","normalized_path":"%USERPROFILE%\\Documents\\UQWCKSUOOCSVIHXQ.exe","parent_uid":"00000000-00000704","uid":"00000000-00007944"}],"all_imported_dlls":["scrrun.dll","ntmarta.dll","iertutil.dll","Windows.StateRepositoryPS.dll","cfgmgr32.dll","ucrtbase_clr0400.dll","mpr.dll","msvcrt.dll","combase.dll","ws2_32.dll","clbcatq.dll","MpClient.dll","slc.dll","apphelp.dll","bcrypt.dll","shell32.dll","gpapi.dll","sspicli.dll","version.dll","fltLib.dll","dwmapi.dll","wldp.dll","SHCore.dll","cldapi.dll","aepic.dll","ntdll.dll","edputil.dll","urlmon.dll","VxSSL64.dll","windows.storage.dll","propsys.dll","wow64cpu.dll","ucrtbase.dll","rpcrt4.dll","win32u.dll","sxs.dll","msxml3.dll","sechost.dll","advapi32.dll","kQmNg001.dll","wshext.dll","vcruntime140_clr0400.dll","bcryptprimitives.dll","imm32.dll","msado15.dll","wow64.dll","clr.dll","msctf.dll","jscript.dll","profapi.dll","wintrust.dll","oleaut32.dll","msasn1.dll","cryptbase.dll","coml2.dll","msIso.dll","ole32.dll","amsi.dll","msvcp_win.dll","vcruntime140.dll","shlwapi.dll","kernel.appcore.dll","scrobj.dll","msdart.dll","imagehlp.dll","VxSSL32.dll","KernelBase.dll","gdi32.dll","cryptsp.dll","uxtheme.dll","crypt32.dll","rsaenh.dll","msisip.dll","wow64win.dll","user32.dll","msvcp140.dll","userenv.dll","MpOAV.dll","powrprof.dll","sppc.dll","kernel32.dll","gdi32full.dll","vcruntime140_1.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"UQWCKSUOOCSVIHXQ.exe","sha256":"d447a06cba8d3dbe80e09d73dd64576836b258961ee0d3ba56cf26cea7962b49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"name":"QXHIVSCOOUSKCWQU","sha256":"8c39c8b84d63bfd06f160f83aea61bb8aa816285d09dfc633699a4b4d79bca6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"path":"%USERPROFILE%\\Documents\\QXHIVSCOOUSKCWQU","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"path":"%USERPROFILE%\\Documents\\UQWCKSUOOCSVIHXQ.exe","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SYNCROOTMANAGER\\\\","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:704:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:704:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"name":"Local\\SM0:704:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"name":"Local\\SM0:704:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]},{"name":"\\BaseNamedObjects\\7-O1179BD08XJy0-","sources":[{"report_type":"sandbox","report_id":"6ac9a75ada39f4c49808c322"}]}]}},"report_ids":{"sandbox_job_ids":["6ac9a75ada39f4c49808c322"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Cryxos.JS Sample 33dbb7d0c78b… — Score 83/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 33dbb7d0c78b…. Malware family: Trojan.Cryxos.JS. Threat score 83/100. 6/27 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/33dbb7d0c78bfa2e124b78409ecc7152a80016bbcccf39e960a2790d1efb8a22"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Cryxos.JS Sample 33dbb7d0c78b… — Score 83/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 33dbb7d0c78b…. Malware family: Trojan.Cryxos.JS. Threat score 83/100. 6/27 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/33dbb7d0c78bfa2e124b78409ecc7152a80016bbcccf39e960a2790d1efb8a22"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Cryxos.JS Sample 33dbb7d0c78b… — Score 83/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 33dbb7d0c78b…. Malware family: Trojan.Cryxos.JS. Threat score 83/100. 6/27 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L33","11",{}]]