dftw

23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T48c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious VBS_SCA.6974FEAA Sample 8a9728267c3f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8a9728267c3f…. Malware family: VBS_SCA.6974FEAA. Threat score 100/100. 16/27 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8a9728267c3facb34c92e769a5d70392d9393752bd030bf2e8679319b12ccce5","keywords":["Malicious","VBS_SCA.6974FEAA","malware analysis","sandbox report","threat intelligence","8a9728267c3facb34c92e769a5d70392d9393752bd030bf2e8679319b12ccce5"],"about":{"@type":"SoftwareApplication","name":"Scan_005287.vbs","applicationCategory":["script","vbs"],"identifier":"8a9728267c3facb34c92e769a5d70392d9393752bd030bf2e8679319b12ccce5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"VBS_SCA.6974FEAA","antivirusDetections":{"malicious":16,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T502,"\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!mfiqplz!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!mfiqplz!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!mfiqplz!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" "\Sessions\1\BaseNamedObjects\Local\c:!users!mfiqplz!appdata!roaming!microsoft!windows!ietldcache!" "\Sessions\1\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "Local\c:!users!mfiqplz!appdata!local!microsoft!windows!history!history.ie5!" "Local\!IETld!Mutex" "Local\ZonesLockedCacheCounterMutex" "Local\c:!users!mfiqplz!appdata!roaming!microsoft!windows!cookies!" "Local\WininetConnectionMutex" "Local\WininetStartupMutex"25:T673,"wscript.exe" touched file "C:\Windows\System32\en-US\wscript.exe.mui" "wscript.exe" touched file "C:\Windows\System32\wscript.exe" "wscript.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "wscript.exe" touched file "C:\Windows\System32\rsaenh.dll" "wscript.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "wscript.exe" touched file "C:\Windows\System32\msxml3r.dll" "wscript.exe" touched file "C:\Windows\System32\scrrun.dll" "wscript.exe" touched file "C:\Windows\System32\msxml3.dll\1" "wscript.exe" touched file "C:\Windows\System32\msxml3.dll" "wscript.exe" touched file "C:\Users\mfiQplZ\AppData\Local\Microsoft\Windows\Temporary Internet Files" "wscript.exe" touched file "C:\Users\mfiQplZ\AppData\Roaming\Microsoft\Windows\Cookies" "wscript.exe" touched file "C:\Users\mfiQplZ\AppData\Local\Microsoft\Windows\History" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\index.dat" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "wscript.exe" touched file "C:\Windows\System32\en-US\urlmon.dll.mui" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\JKHhgdf72[1].txt" "wscript.exe" touched file "C:\Windows\System32\wshom.ocx" "wscript.exe" touched file "C:\Windows\System32\oleaccrc.dll"26:T50d,Pattern match: "peopleiknow.org/JKHhgdf72?,ericajoy.com/JKHhgdf72?,highlandfamily.org/JKHhgdf72" Pattern match: "http://www.usertrust.com1" Pattern match: "crl.usertrust.com/UTN-USERFirst-Object.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://crl.thawte.com/ThawtePCA.crl0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "http://th.symcb.com/th.crl0" Pattern match: "https://www.thawte.com/cps0/" Pattern match: "https://www.thawte.com/repository0W" Pattern match: "http://th.symcd.com0&" Pattern match: "http://th.symcb.com/th.crt0" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://sv.symcb.com/sv.crl0W" Pattern match: "http://sv.symcd.com0&" Pattern match: "http://sv.s" Pattern match: "ymcb.com/sv.crt0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Heuristic match: "peopleiknow.org" Pattern match: "http://www.w3.org/TR/html4/strict.dtd" Pattern match: "https://www.torproject.org/projects/torbrowser.html.en" Pattern match: "http://n224ezvhg4sgyamb.onion/sup.php"27:T71c,"RxfIOYRYC.exe" opened "C:\8a9728267c3facb34c92e769a5d70392d9393752bd030bf2e8679319b12ccce5.vbs" with delete access "RxfIOYRYC.exe" opened "C:\autoexec.bat" with delete access "RxfIOYRYC.exe" opened "C:\config.sys" with delete access "RxfIOYRYC.exe" opened "C:\Users\desktop.ini" with delete access "RxfIOYRYC.exe" opened "C:\Users\Public\desktop.ini" with delete access "RxfIOYRYC.exe" opened "C:\Users\Public\Videos\desktop.ini" with delete access "RxfIOYRYC.exe" opened "C:\Users\Public\Videos\Sample Videos\desktop.ini" with delete access "RxfIOYRYC.exe" opened "C:\Users\Public\Videos\Sample Videos\Wildlife.wmv" with delete access "RxfIOYRYC.exe" opened "C:\Users\Public\Recorded TV\desktop.ini" with delete access "RxfIOYRYC.exe" opened "C:\Users\Public\Recorded TV\Sample Media\desktop.ini" with delete access "RxfIOYRYC.exe" opened "C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv" with delete access "RxfIOYRYC.exe" opened "C:\Users\Public\Pictures\desktop.ini" with delete access "RxfIOYRYC.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg" with delete access "RxfIOYRYC.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Desert.jpg" with delete access "RxfIOYRYC.exe" opened "C:\Users\Public\Pictures\Sample Pictures\desktop.ini" with delete access "RxfIOYRYC.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg" with delete access "RxfIOYRYC.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg" with delete access "RxfIOYRYC.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Koala.jpg" with delete access "RxfIOYRYC.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg" with delete access "RxfIOYRYC.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg" with delete access28:T50d,Found malicious artifacts related to "67.210.102.240" (ASN: , Owner: ): ... URL: http://peopleiknow.org/nhfys52 (AV positives: 6/66 scanned on 12/15/2017 04:34:28) URL: http://peopleiknow.org/Nhfys52 (AV positives: 9/66 scanned on 12/15/2017 04:29:02) URL: http://qxr33qxr.com/JIKJHgft (AV positives: 9/67 scanned on 12/14/2017 21:39:04) URL: http://peopleiknow.org/jhgf54y6 (AV positives: 14/67 scanned on 12/14/2017 21:07:46) URL: http://qxr33qxr.com/3936jkgHGdcm (AV positives: 8/67 scanned on 12/14/2017 17:26:05) File SHA256: 621d7c1d19ccbaa8d56dbcb37e46f4437fa425ce92895acd87a6df9710f8b391 (AV positives: 8/69 scanned on 12/07/2017 12:33:36) File SHA256: 749e1dac2ab443059e8444d9b4556e18c18f13a7236c82c644cd02eddf36f77e (Scanned on 11/29/2017 06:25:26) File SHA256: 3fd66cbb34e75cf5a0cf2b12d34de68ff51794ae033208c42ac0eaa7f68cf6e3 (AV positives: 43/65 scanned on 10/19/2017 17:00:29) File SHA256: 70d06bd4e6a91b60bc8515e327fa1f9fb7ac82125e3c8a06359b5bb3f96e48f3 (AV positives: 52/66 scanned on 10/13/2017 03:05:11) File SHA256: 79a40ac47ea2b57727437a7a9365e860cc1fa1c7c96900f5a2a90133959c4694 (AV positives: 36/64 scanned on 10/12/2017 10:06:34) File SHA256: aace7044f2f3cd7bb109a2e5d494ac86d952e0eaa13ce8d6abd7e4744f2ede10 (AV positives: 13/66 scanned on 10/10/2017 14:13:21)1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"8a9728267c3facb34c92e769a5d70392d9393752bd030bf2e8679319b12ccce5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790301625389,"unified_at":"2026-09-25T02:00:25.389Z","metadata":{"hashes":{"sha256":"8a9728267c3facb34c92e769a5d70392d9393752bd030bf2e8679319b12ccce5","sha1":"c338199bfaa6d86d6763e741a82eca817824e340","md5":"a6e5cb94ca9a10b598dedde50daabccd","sha512":"19f352c385227315d4a87008e21f045e238111c6a50cbd9c4983d36ebd5d879693d8c9b3ff1d720b0dc481e0377714852898ae3baa788661365dc26dc259afb4","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"Scan_005287.vbs","file_type":["script","vbs"],"file_type_id":"vbs","file_size":4711,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1513325048000,"last_seen":1678095587000,"last_multi_scan":1678095587000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["globeimposter","locky","ransomware"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":25,"suspicious_count":15,"malicious_count":7,"total":47},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"VBS/Downloader.S14","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/VBS.Agent.pkq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"VBS/Dldr.Agent.udsw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"VB:Trojan.Downloader.JUAY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.VBS.TrojanDownloader.Agent.FER","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"VBS/Downldr.HM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"VB:Trojan.Downloader.JUAY (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"VBS/TrojanDownloader.Agent.PLS trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/VBS.Vibrio.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Script.Agent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.ExpKit.eweubo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"VBS/DwnLdr-UXQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"VBS_SCA.6974FEAA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"VBS_SCA.6974FEAA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.JS.Dropper.HDO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"VBS_SCA.6974FEAA","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"wscript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)\" (SID: 2015744, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"peopleiknow.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"67.210.102.240:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"mi_exe_stub.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"wscript.exe\" created file \"%TEMP%\\RxfIOYRYC.exe\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$24","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"wscript.exe\" called \"Microsoft.XMLHTTP.1.0.CreateObject\" ... \n \"wscript.exe\" called \"ADODB.Stream.6.0.CreateObject\" ... \n \"wscript.exe\" called \"WScript.Shell.1.CreateObject\" ... \n \"wscript.exe\" called \"WScript.Name\" with result: \"Windows Script Host\" ...\n \"wscript.exe\" called \"Microsoft.XMLHTTP.1.0.open\" ... \n \"wscript.exe\" called \"Microsoft.XMLHTTP.1.0.status\" with result: \"200\" ...\n \"wscript.exe\" called \"ADODB.Stream.6.0.Type\" ... \n \"wscript.exe\" called \"Microsoft.XMLHTTP.1.0.responseBody\" with result: \"MZ\" ...\n \"wscript.exe\" called \"ADODB.Stream.6.0.Write\" ... \n \"wscript.exe\" called \"ADODB.Stream.6.0.SaveToFile\" ... \n \"wscript.exe\" called \"WScript.Shell.1.Run\" ...","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"wscript.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"RxfIOYRYC.exe\" (UID: 00010279-00003696) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"General","name":"Requested access to a system service","description":"\"wscript.exe\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"wscript.exe\" called \"OpenService\" to access the \"rasman\" service\n \"wscript.exe\" called \"OpenService\" to access the \"RASMAN\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c START \"\" \"%TEMP%\\RxfIOYRYC.exe\"\" on 2017-12-15.08:52:47.304","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c START \"\" \"%TEMP%\\RxfIOYRYC.exe\"\" (UID: 00010272-00003664)\n Spawned process \"RxfIOYRYC.exe\" (UID: 00010279-00003696)\n Spawned process \"RxfIOYRYC.exe\" (UID: 00010439-00003708)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"US_export_policy.jar\" has type \"data\"\n \"0gakl8ixtWMkw.doc\" has type \"data\"\n \"OTKLOADR.DLL\" has type \"data\"\n \"rpcapd.exe\" has type \"data\"\n \"kdextx86.dll\" has type \"data\"\n \"OIMG.DLL\" has type \"data\"\n \"ONBttnIELinkedNotes.dll\" has type \"data\"\n \"XLMACRO.CHM\" has type \"data\"\n \"SCANPST.EXE\" has type \"data\"\n \"logviewer.exe\" has type \"data\"\n \"XLCALL32.DLL\" has type \"data\"\n \"EKeaJO.doc\" has type \"data\"\n \"SEQCHK10.DLL\" has type \"data\"\n \"psuser.dll\" has type \"data\"\n \"wmitrace.dll\" has type \"data\"\n \"ChessMCE.lnk\" has type \"data\"\n \"STSCOPY.DLL\" has type \"zlib compressed data\"\n \"verify.dll\" has type \"DOS executable (COM)\"\n \"deployJava1.dll\" has type \"data\"\n \"jdwp.dll\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"Installation/Persistance","name":"Executes a visual basic script","description":"Process \"wscript.exe\" with commandline \"\"C:\\8a9728267c3facb34c92e769a5d70392d9393752bd030bf2e8679319b12ccce5.vbs\"\" (UID: 00009518-00003348)","origin":"Monitored Target","relevance":10,"id":"target-17","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"wscript.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"wscript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"RxfIOYRYC.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"wscript.exe\" wrote bytes \"77397c7779a88077be728077d62d80771de27b7705a28077c8687f7757d18677bee37b77616f807768417e7700507e7700000000ad37a3768b2da376b641a37600000000\" to virtual address \"0x75331000\" (part of module \"WSHIP6.DLL\")\n \"wscript.exe\" wrote bytes \"92e67b7779a88077be728077d62d80771de27b7705a28077bee37b77616f807768417e7700507e7700000000ad37a3768b2da376b641a37600000000\" to virtual address \"0x74E61000\" (part of module \"WSHTCPIP.DLL\")\n \"wscript.exe\" wrote bytes \"40537e7758587f77186a7f77653c80770000000000bf93770000000056cc9377000000007cca93770000000037689b756a2c8077d62d80770000000020699b750000000029a6937700000000a48d9b7500000000f70e937700000000\" to virtual address \"0x779D1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"PSPUBWS.bmp\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"RxfIOYRYC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"7/66 reputation engines marked \"http://peopleiknow.org\" as malicious (10% detection rate)\n 5/66 reputation engines marked \"http://highlandfamily.org\" as malicious (7% detection rate)\n 6/66 reputation engines marked \"http://ericajoy.com\" as malicious (9% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"RxfIOYRYC.exe\" read file \"C:\\Users\\desktop.ini\"\n \"RxfIOYRYC.exe\" read file \"%PUBLIC%\\desktop.ini\"\n \"RxfIOYRYC.exe\" read file \"%PUBLIC%\\Videos\\desktop.ini\"\n \"RxfIOYRYC.exe\" read file \"%PUBLIC%\\Videos\\Sample Videos\\desktop.ini\"\n \"RxfIOYRYC.exe\" read file \"%PUBLIC%\\Recorded TV\\desktop.ini\"\n \"RxfIOYRYC.exe\" read file \"%PUBLIC%\\Recorded TV\\Sample Media\\desktop.ini\"\n \"RxfIOYRYC.exe\" read file \"%PUBLIC%\\Pictures\\desktop.ini\"\n \"RxfIOYRYC.exe\" read file \"%PUBLIC%\\Pictures\\Sample Pictures\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"verify.dll\" has type \"DOS executable (COM)\"\n \"dgQJde60mPXhI.exe\" has type \"COM executable for DOS\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"RxfIOYRYC.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"RxfIOYRYC.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"BROWSERUPDATECHECK\"; Value: \"%APPDATA%\\RxfIOYRYC.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5a337ed77ca3e15a8d4f1f24"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"

Your files are Encrypted!

\" (Source: Read___ME.html, Indicator: \"files are encrypted\")\n \" dftw