24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T466,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Valyria Sample d4e0c08a1835… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d4e0c08a1835…. Malware family: Valyria. Threat score 100/100. 3/27 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5","keywords":["Malicious","Valyria","malware analysis","sandbox report","threat intelligence","d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5"],"about":{"@type":"SoftwareApplication","name":"GL9001-800322.vbs","applicationCategory":["script","vbs"],"identifier":"d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Valyria","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4d0,"*****************************************************************'*********************Criando Conexao com o Regedit****************************const HKEY_LOCAL_MACHINE = &H80000002strKeyPath = "SYSTEM\CurrentControlSet\Services\USBSTOR"Set oReg=GetObject( _"winmgmts:{impersonationLevel=impersonate}!\\" & _strComputador & "\root\default:StdRegProv")'****************************FIM DA CONEXAO*******************************'****************************************************************************'*****************************Formatando a Data******************************Dim dataAtual, dataFormatadadataAtual = now ( )dataFormatada = FormatDateTime(dataAtual, 1)On Error Resume NextSet bzHYak = WScript.CreateObject("WScript.Shell")Dim base64_exebase64_exe = base64_exe & "TVqQAAMAAA" base64_exe = base64_exe & "AEAAAA//8A" base64_exe = base64_exe & "ALgAAAAAAA" base64_exe = base64_exe & "AAQAAAAAAA" base64_exe = base64_exe & "AAAAAAAAAA" base64_exe = base64_exe & "AAAAAAAAAA" base64_exe = b" in Source: d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5.vbs.bin "strKeyPath = "SYSTEM\CurrentControlSet\Services\USBSTOR"" in Source: d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5.vbs.bin26:T4b5,"WScript.exe" loaded module "OLEAUT32.DLL" at base 76ff0000 "WScript.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77390000 "WScript.exe" loaded module "DWMAPI.DLL" at base 73bb0000 "WScript.exe" loaded module "MSISIP.DLL" at base 70410000 "WScript.exe" loaded module "RPCRTREMOTE.DLL" at base 750d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6ea80000 "WScript.exe" loaded module "KERNEL32.DLL" at base 76070000 "WScript.exe" loaded module "SXS.DLL" at base 75040000 "WScript.exe" loaded module "CLBCATQ.DLL" at base 76150000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 6cf50000 "WScript.exe" loaded module "OLE32.DLL" at base 761e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 773c0000 "WScript.exe" loaded module "WINTRUST.DLL" at base 75390000 "WScript.exe" loaded module "CRYPTSP.DLL" at base 74b40000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 748d0000 "WScript.exe" loaded module "ADVAPI32.DLL" at base 773c0000 "WScript.exe" loaded module "CRYPTBASE.DLL" at base 75030000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 751c000027:T5f4,"WScript.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32") "WScript.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}") "WScript.exe" touched "Multi Language Support" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}") "WScript.exe" touched "Wbem Scripting Object Path" (Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS") "WScript.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WScript.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "WScript.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "WScript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WScript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "WScript.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WScript.exe" touched "WbemStatusCode" (Path: "HKCU\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS")28:Td02,"'--- Usuario----objClass = "Win32_ComputerSystem"strQuery = "SELECT " & strPropriedades & " FROM " & objClassSet colSys = objWMIService.ExecQuery(strQuery, , wbemFlagReturnImmediately + wbemFlagForwardOnly)For Each objItem in colSysUsuario = (objItem.UserName)Next '--- Identifica" (Indicator: "win32_computersystem"; File: "d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5.vbs.bin") ""Select * From Win32_ComputerSystem",,48)" (Indicator: "win32_computersystem"; File: "d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5.vbs.bin") "o da placa de redestrPropriedades = "Description MACAddress IPAddress IPSubnet DefaultIPGateway DNSServerSearchOrder DNSDomain DNSDomainSuffixSearchOrder DHCPEnabled DHCPServer WINSPrimaryServer WINSSecondaryServer ServiceName"objClass = "Win32_NetworkAdapterConfiguration"strQuery = "SELECT " & strPropriedades & " FROM " & objClass & " WHERE IPEnabled = True AND ServiceName <> 'AsyncMac' AND ServiceName <> 'VMnetx' AND ServiceName <> 'VMnetadapter' AND ServiceName <> 'Rasl2tp' AND ServiceName <> 'PptpMiniport' AND ServiceName <> 'Raspti' AND ServiceName <> 'NDISWan' AND ServiceName <> 'RasPppoe' AND ServiceName <> 'NdisIP' AND ServiceName <> ''"Set colAdapters = objWMIService.ExecQuery(strQuery, , wbemFlagReturnImmediately + wbemFlagForwardOnly) '-----redeFor Each objItem in colAdapters '----- IPIP_Address = objItem.IPAddressIP = (IP_Address(i))NextSet objShell = CreateObject("WScript.Shell")'********************************FIM****************************************'***********" (Indicator: "win32_networkadapterconfiguration"; File: "d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5.vbs.bin") "objClass = "Win32_ComputerSystem"" (Indicator: "win32_computersystem"; File: "d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5.vbs.bin") "objClass = "Win32_NetworkAdapterConfiguration"" (Indicator: "win32_networkadapterconfiguration"; File: "d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5.vbs.bin") "objClass = "Win32_OperatingSystem"" (Indicator: "win32_operatingsystem"; File: "d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5.vbs.bin") "strComputador = "."Dim NomeComputador, SO, Usuario, IP, SPK, strPropriedadesSet objWMIService = GetObject("winmgmts:\\" & strComputador & "\root\CIMV2")Set colItems = objWMIService.execQuery(_"Select * From Win32_ComputerSystem",,48)For Each objItem in colItemsNomeComputador = objItem.captionNext'******************************FIM****************************************'**************************************************************************'*******************Criando leitura do computador**************************strPropriedades = "*"'"CSName Caption OSType Version OSProductSuite BuildNumber ProductType OSLanguage CSDVersion InstallDate RegisteredUser Organization SerialNumber WindowsDirectory SystemDirectory"objClass = "Win32_OperatingSystem"strQuery = "SELECT " & strPropriedades & " FROM " & objClassSet colOS = objWMIService.ExecQuery(strQuery, , wbemFlagReturnImmediately + wbemFlagForwardOnly)For Each objItem in colOSSPK = (objItem.CSDVersion)SO = (objItem.Caption)Next" (Indicator: "win32_computersystem"; File: "d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5.vbs.bin")29:T470,"Set objWMIService = GetObject("winmgmts:\\" & strComputador & "\root\CIMV2")" (Indicator: "root\cimv2") "strComputador = "."Dim NomeComputador, SO, Usuario, IP, SPK, strPropriedadesSet objWMIService = GetObject("winmgmts:\\" & strComputador & "\root\CIMV2")Set colItems = objWMIService.execQuery(_"Select * From Win32_ComputerSystem",,48)For Each objItem in colItemsNomeComputador = objItem.captionNext'******************************FIM****************************************'**************************************************************************'*******************Criando leitura do computador**************************strPropriedades = "*"'"CSName Caption OSType Version OSProductSuite BuildNumber ProductType OSLanguage CSDVersion InstallDate RegisteredUser Organization SerialNumber WindowsDirectory SystemDirectory"objClass = "Win32_OperatingSystem"strQuery = "SELECT " & strPropriedades & " FROM " & objClassSet colOS = objWMIService.ExecQuery(strQuery, , wbemFlagReturnImmediately + wbemFlagForwardOnly)For Each objItem in colOSSPK = (objItem.CSDVersion)SO = (objItem.Caption)Next" (Indicator: "root\cimv2")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790729025802,"unified_at":"2026-09-30T00:43:45.802Z","metadata":{"hashes":{"sha256":"d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5","sha1":"28c7b88d5856e270beca853485303e0112f9cc2b","md5":"e9c707cf9736d676f3ca512cc0d808f3","sha512":"b6c5d6c9a3609a3fba76905a276ae9745ae1924c71cc1efc894bbfa3aba5b5436bd06966d9bbe967052191136bd4aed9d5a8586fdd06e2b6514fdc066f6e687d","ssdeep":"768:EPSdlWm4lEdbWEbKyOt2Jy81SB11l+LVzO6u:uSdlKEdbWEc2Jy8czsTu","ssdeep_chunks":["768:EPSdlWm","768:PSdlWm4","768:SdlWm4l","768:dlWm4lE","768:lWm4lEd","768:Wm4lEdb","768:m4lEdbW","768:4lEdbWE","768:lEdbWEb","768:EdbWEbK","768:dbWEbKy","768:bWEbKyO","768:WEbKyOt","768:EbKyOt2","768:bKyOt2J","768:KyOt2Jy","768:yOt2Jy8","768:Ot2Jy81","768:t2Jy81S","768:2Jy81SB","768:Jy81SB1","768:y81SB11","768:81SB11l","768:1SB11l+","768:SB11l+L","768:B11l+LV","768:11l+LVz","768:1l+LVzO","768:l+LVzO6","768:+LVzO6u","1536:EPSdlWm","1536:PSdlWm4","1536:SdlWm4l","1536:dlWm4lE","1536:lWm4lEd","1536:Wm4lEdb","1536:m4lEdbW","1536:4lEdbWE","1536:lEdbWEb","1536:EdbWEbK","1536:dbWEbKy","1536:bWEbKyO","1536:WEbKyOt","1536:EbKyOt2","1536:bKyOt2J","1536:KyOt2Jy","1536:yOt2Jy8","1536:Ot2Jy81","1536:t2Jy81S","1536:2Jy81SB","1536:Jy81SB1","1536:y81SB11","1536:81SB11l","1536:1SB11l+","1536:SB11l+L","1536:B11l+LV","1536:11l+LVz","1536:1l+LVzO","1536:l+LVzO6","1536:+LVzO6u","768:uSdlKEd","768:SdlKEdb","768:dlKEdbW","768:lKEdbWE","768:KEdbWEc","768:EdbWEc2","768:dbWEc2J","768:bWEc2Jy","768:WEc2Jy8","768:Ec2Jy8c","768:c2Jy8cz","768:2Jy8czs","768:Jy8czsT","768:y8czsTu"],"imphash":"Unknown"},"file_info":{"file_name":"GL9001-800322.vbs","file_type":["script","vbs"],"file_type_id":"vbs","file_size":370108,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1678700433000,"last_seen":1678700450000,"last_multi_scan":1678700450000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["fsocietycrypter","modular","evasive"]},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":16,"suspicious_count":4,"malicious_count":2,"total":22},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"VB:Trojan.Valyria.8005","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"PSH/Agent.IE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"VB:Trojan.Valyria.8005 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Valyria","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","identifiers":[{"type":"suspicious","value":"Executes a visual basic script"}],"sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Found WMI keywords in script (string)"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Found a cryptographic related string"}],"sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]}],"sandbox_signatures":[{"level":"informative","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"Found - (Indicator: \"base64\") in Source: d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5.vbs.bin\n Found - (Indicator: \"aes\") in Source: d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5.vbs.bin\n Found - (Indicator: \"des\") in Source: d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5.vbs.bin\n Found - (Indicator: \"rsa\") in Source: d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5.vbs.bin\n Found - (Indicator: \"des\") in Source: 00000000-00003260-00000BC0-12792471616161237","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$25","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"informative","category":"General","name":"Found WMI keywords in script (string)","description":"Observed WMI keyword:\"{impersonationLevel=impersonate}\" [Source: d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5.vbs.bin]","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-155","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"informative","category":"General","name":"Found suspicious keywords in script (string)","description":"Observed keyword:\"ExecQuery\" [Source: d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5.vbs.bin]\n Observed keyword:\"WScript.Shell\" [Source: d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5.vbs.bin]","origin":"File/Memory","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$26","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"17001800f0fae56e@ntdll.dll\"\n \"17001800382d096f@ntdll.dll\"\n \"0d000e00341bec6c@KERNELBASE.dll\"\n \"130014006a6e3176@CRYPTSP.dll\"\n \"11001200b66e3176@ADVAPI32.dll\"\n \"150016002c7a006d@ADVAPI32.dll\"\n \"0e000f00a47a006d@ADVAPI32.dll\"\n \"0e000f00d87a006d@ADVAPI32.dll\"\n \"11001200387f006d@ADVAPI32.dll\"\n \"11001200a47f006d@ADVAPI32.dll\"\n \"12001300b87f006d@ADVAPI32.dll\"\n \"12001300e07f006d@ADVAPI32.dll\"\n \"14001500bc93006d@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$27","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"WScript.exe\" touched file \"C:\\Windows\\system32\\en\\KERNELBASE.dll.mui\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"\n \"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\wbem\\WBEMCOMN.DLL\"\n \"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\wbem\\NTDSAPI.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WSCRIPT.EXE.LOCAL\"\n \"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\en\\KERNELBASE.DLL.MUI\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":5,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$28","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/58 Antivirus vendors marked sample as malicious (24% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Executes a visual basic script","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5.vbs\"\" (UID: 00000000-00003260)","origin":"Monitored Target","mitre_attack_id":"T1059.005","relevance":10,"id":"target-17","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$29","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/58 Antivirus vendors marked sample as malicious (24% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]}],"incidents":[{"name":"Evasive","details_count":1,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":48,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["fsocietycrypter","modular","evasive"],"sandbox_reports":[{"id":"640ef49a209923d5510f016c","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"VB:Trojan.Valyria","submit_name":"d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5.vbs","analysis_start_time":"2023-03-13T10:02:05+00:00","indicators_count":{"informative":16,"suspicious":4,"malicious":2},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}],"processes":[{"pid":3260,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5.vbs\"","sha256":"2160ba6829909eeb1d272ac4a5f43588750c0b4743477bf2b46952033b5d4b3b","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00003260","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="}],"all_imported_dlls":["wbemdisp.dll","wbemsvc.dll","advapi32.dll","msvcrt.dll","user32.dll","vbscript.dll","shlwapi.dll","mlang.dll","sechost.dll","rpcrt4.dll","lpk.dll","cryptbase.dll","cryptsp.dll","netmsg.dll","api-ms-win-core-synch-l1-2-0.dll","usp10.dll","imm32.dll","clbcatq.dll","msasn1.dll","wbemcomn.dll","ws2_32.dll","wintrust.dll","crypt32.dll","shell32.dll","RpcRtRemote.dll","fltLib.dll","version.dll","sxs.dll","rsaenh.dll","wbemprox.dll","fastprox.dll","msisip.dll","KernelBase.dll","rpcss.dll","nsi.dll","wshext.dll","wmiutils.dll","ntdll.dll","dwmapi.dll","gdi32.dll","oleaut32.dll","ole32.dll","msctf.dll","uxtheme.dll","ntdsapi.dll","kernel32.dll","comctl32.dll","scrobj.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"640ef49a209923d5510f016c"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["640ef49a209923d5510f016c"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Valyria Sample d4e0c08a1835… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d4e0c08a1835…. Malware family: Valyria. Threat score 100/100. 3/27 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5"}],["$","meta","4",{"property":"og:title","content":"Malicious Valyria Sample d4e0c08a1835… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d4e0c08a1835…. Malware family: Valyria. Threat score 100/100. 3/27 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d4e0c08a18355d7d49a54faa881b8864b9ede460e8c61fd91591dff2fd11f1e5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Valyria Sample d4e0c08a1835… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d4e0c08a1835…. Malware family: Valyria. Threat score 100/100. 3/27 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]