26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T492,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious GT:VB.Methuselah.20 Sample f0e4e2656467… — Score 45/100 — Hybrid Analysis","description":"Malicious verdict for sample f0e4e2656467…. Malware family: GT:VB.Methuselah.20. Threat score 45/100. 4/24 AV engines flagged this file. 1 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f0e4e2656467459bfde295f51d68f5b1de5c03a504c2c7c8dc4f0d635ed0da26","keywords":["Malicious","GT:VB.Methuselah.20","malware analysis","sandbox report","threat intelligence","f0e4e2656467459bfde295f51d68f5b1de5c03a504c2c7c8dc4f0d635ed0da26"],"about":{"@type":"SoftwareApplication","name":"damaged_item.vbs","applicationCategory":["script","vbs"],"identifier":"f0e4e2656467459bfde295f51d68f5b1de5c03a504c2c7c8dc4f0d635ed0da26","additionalType":"Malicious sample"},"threatScore":45,"malwareFamily":"GT:VB.Methuselah.20","antivirusDetections":{"malicious":4,"total":24},"behavioralIndicators":{"malicious":1,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1a94,"WScript.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "a3ea80f0" "pszBlobType": "OpaqueKeyBlob" "phKey": "2091eaa39a010000" "pbKeyObject": "be0c000052555555f080eaa39a0100004091eaa39a0100000000000000000000800c00004b53534d02000100050000001000000001000000800000000100000020bea2a19a0100000000000000000000000000000000000010000000dea1760a19f4b03f7f4f55f8aba6595a0000000000000000000000000000000000000000dea1760a19f4b03f7f4f55f8aba6595afb6ac868e29e78579dd12daf367774f50cf82e6dee66563a73b77b9545c00f60b28efe035ce8a8392f5fd3ac6a9fdccc6108b5013de01d3812bfce9478201258c6c1dfbdfb21c285e99e0c1191be1e4948b3e43cb39226b95a0c2aa8cbb234e13fab1c238c393a9ad63510321d8724d3a89d7a8724a4401df291502fef1674fcf40fca58d0ab8a45223ada6acd2cae96b3eb5ae56340d0a0417a0aca8c56a45cedd50150361f1f824025f33ec8a602b575f22c63dbca1ed2763aecbc8883f18b044c6a89ae3832b1adf0f26efeb91d370337e9feaa74583803c8c0df5349ef59cc761fc0a943b1c6a9bc98e750812f86a122d48a6535ae0600ff2921f93db76172ffa7ebc4177a8c65ca8727f9c29e400f5558b5b6e8dd67a1ddfdab9c081967ac9ffdffb9bd85d2173520cc3dd5e4ccdea1760a19f4b03f7f4f55f8aba6595a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004092eaa39a010000e092eaa39a010000000000000000000000000000000000005d2ee2603634b098015906191ef5f4da5c77e47928c14442015906191ef5f4da1c6b453c76d7d2640a4f8ea7b44665d61624cb9bc291b7b20a4f8ea7b44665d6eba32d4382ff95d49af9c863c0e398dd715ae520421c0d099af9c863c0e398ddd59716d2d3f867d5c26bd9eae8b2c0e417fccf383b4aa731c26bd9eae8b2c0e491f92c07ee77ec4542cadd3d9dea2683d333f13a739dcac642cadd3d9dea268334c19f814a3a47000e950ab83f2076823a549539751a31820e950ab83f207682a4c92b681c2e99294cadcd8cce3cb04be864e6e4d21229624cadcd8cce3cb04bf7ae3b9a30b142e649723d8a655257e4bedc061055e3150249723d8a655257e4e4767846562136d3db5200dd7b55c4803f24789b2d74f253db5200dd7b55c4808f46be346b78975a258169dda11b795eaac7d7e9ca63ee04258169dda11b795e92c86f740bb1928690aa25c9cd08c78902624abdc6b9550f90aa25c9cd08c7890489618fd866837b05227bd15d1288f001ab1a5e85740b8b05227bd15d1288f0720e801493ebffa5641112e07ac9251d" "cbKeyObject": "3262" "pbInput": "300200004b53534d0200010005000000100000008000000010000000dea1760a19f4b03f7f4f55f8aba6595a0000000000000000000000000000000000000000dea1760a19f4b03f7f4f55f8aba6595afb6ac868e29e78579dd12daf367774f50cf82e6dee66563a73b77b9545c00f60b28efe035ce8a8392f5fd3ac6a9fdccc6108b5013de01d3812bfce9478201258c6c1dfbdfb21c285e99e0c1191be1e4948b3e43cb39226b95a0c2aa8cbb234e13fab1c238c393a9ad63510321d8724d3a89d7a8724a4401df291502fef1674fcf40fca58d0ab8a45223ada6acd2cae96b3eb5ae56340d0a0417a0aca8c56a45cedd50150361f1f824025f33ec8a602b575f22c63dbca1ed2763aecbc8883f18b044c6a89ae3832b1adf0f26efeb91d370337e9feaa74583803c8c0df5349ef59cc761fc0a943b1c6a9bc98e750812f86a122d48a6535ae0600ff2921f93db76172ffa7ebc4177a8c65ca8727f9c29e400f5558b5b6e8dd67a1ddfdab9c081967ac9ffdffb9bd85d2173520cc3dd5e4ccdea1760a19f4b03f7f4f55f8aba6595a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000040010000000000000000000000000000000000000000000000000000" "cbInput": "560" "dwFlags": "0"} "WScript.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "a3ea80f0" "pszBlobType": "OpaqueKeyBlob" "phKey": "609eeaa39a010000" "pbKeyObject": "be0c000052555555f080eaa39a010000809eeaa39a0100000000000000000000800c00004b53534d02000100050000001000000001000000800000000100000020bea2a19a010000000000000000000000000000000000001000000026c60bfb4a9a7fef27e5df06ff6bf526000000000000000000000000000000000000000026c60bfb4a9a7fef27e5df06ff6bf5265820fced12ba8302355f5c04ca34a92242f36f995049ec9b6516b09faf2219bdd52715e0856ef97be07849e44f5a50596374de64e61a271f06626efb49383ea274c6e45f92dcc34094beadbbdd869319101a309e82c6f3de16785e65cbfecd7ceba720816961d35f7f198d3ab4e74046ffae7a0c96cfa953e9d624695d31642f23ed6f40b522c6135cf4e27a01c58655b3a9933c068b552f5a7fb7555bba310027d8b2ac3351c4e4727dac93179abe247ba7b04b14897648412c687765e712b7b6eebc096f2ec60355a51e3f24cb7ac0779b044cd9c07a0a3a8bd83c716e64ff3c91be1aae5b7e46e34ba2364be5bcc33dc9c19892cac05c4d10dc70a8ae1ef5384df684af0301c4dfda1c2ce5bec285c62a65ce974ef74070d91de83a64dea9029674895164928ee797eaa84abdc34126c60bfb4a9a7fef27e5df06ff6bf5260000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000809feaa39a01000020a0eaa39a01000000000000000000000000000000000000076ed9caa03f907d0cbf142f658904f20bd1cde5c5b6948f0cbf142f658904f295502d3806c805d13213c28da426ae15a743efb5a2eeabc43213c28da426ae156aa52757859bbe700f0ce9cc8b3e9a2365a9ce9b0ea524530f0ce9cc8b3e9a23b7e8cefdc2aed7dd16888915930c6d4ea16047e851a2ba9316888915930c6d4ea5bcea881670841170567252608bef29d5ea98da76fb6b3870567252608bef2915f28b3ba772515fb1f5c0b8cb6efe21a4074b836c1caf7eb1f5c0b8cb6efe2195ff34ac896bced2b81785a672ff66892de8b10afb94a85bb81785a672ff668989ee3107159d2cc6440b673b53361e70cde5563c46ab32b6440b673b53361e70cb251e37e060404c65694102f3ce107dae4c5f3513ae503165694102f3ce107d2b8565deb7fde993b22b5ef592cd8d9d99ae3b2b2530640eb22b5ef592cd8d9d36a3eaa2ee887e65ad035896cfcee2c49ba0b23421469ca1ad035896cfcee2c4bd99f8eaecd5f853af5f72996f459aa512c68a73839062f6af5f72996f459aa593faadc8021f4e52dd943a9093f24d53" "cbKeyObject": "3262" "pbInput": "300200004b53534d020001000500000010000000800000001000000026c60bfb4a9a7fef27e5df06ff6bf526000000000000000000000000000000000000000026c60bfb4a9a7fef27e5df06ff6bf5265820fced12ba8302355f5c04ca34a92242f36f995049ec9b6516b09faf2219bdd52715e0856ef97be07849e44f5a50596374de64e61a271f06626efb49383ea274c6e45f92dcc34094beadbbdd869319101a309e82c6f3de16785e65cbfecd7ceba720816961d35f7f198d3ab4e74046ffae7a0c96cfa953e9d624695d31642f23ed6f40b522c6135cf4e27a01c58655b3a9933c068b552f5a7fb7555bba310027d8b2ac3351c4e4727dac93179abe247ba7b04b14897648412c687765e712b7b6eebc096f2ec60355a51e3f24cb7ac0779b044cd9c07a0a3a8bd83c716e64ff3c91be1aae5b7e46e34ba2364be5bcc33dc9c19892cac05c4d10dc70a8ae1ef5384df684af0301c4dfda1c2ce5bec285c62a65ce974ef74070d91de83a64dea9029674895164928ee797eaa84abdc34126c60bfb4a9a7fef27e5df06ff6bf5260000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000040010000000000000000000000000000000000000000000000000000" "cbInput": "560" "dwFlags": "0"}28:T13b6,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005964) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005964) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac4864fc7f0000000000000000000051ed3f66fc7f0000000000009a0100000000000000000000665033ec5f3c00002a0000000000000090ff96a19a0100008fec3f66fc7f0000e0ac4864fc7f0000e0ac4864fc7f0000000000000000000000000000fc7f0000ffffff7ff018000000000000000000000000000000000000d8ce3c64fc7f00002a0000000000000069c3f563fc7f00003100000000000000ec02000000000000f002000000000000110001100000000060cb0ff37d00000003a3ff65fc7f000060cb0ff37d00000000000000000000002b00000000000000000000000000000020b0fb63fc7f0000b43ffa63fc7f0000e0ce3c64 (UID: 00000000-00005964) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000008000000000000000000000000000000000000000000000081010000000000001020000000000000000094a19a0100000b8e3d66fc7f0000000094a19a0100000a000000fc7f000000200000000000001020000000000000807994a19a01000078ba0ff37d00000049bb0ff37d00000003000000fc7f000040d898a19a01000069ee4166fc7f0000000000000000000020f697a19a010000385db5dc00000000400000000000000000000000000000008403fe7f0000000040d898a19a0100008503fe7f00000000000000000000000000000644fc7f0000000000000000000000290644fc7f00000000000000000000f7d90744fc7f000000000000 (UID: 00000000-00005964) "WScript.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005964) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000040000000000000000000cea19a0100000b8e3d66fc7f00000000cea19a010000020000009a010000380000000000000040000000000000003003cea19a01000048d20ff37d0000000100000000000000030000000000000001000000000000000e02000000000000e0108fa19a010000000000000000000000008fa19a0100000000e7f27d000000000000000000000000000000010000000000000000000000ff03000000000000040000000000000000000000000000001845eba39a01000004000000000000003800000000000000f098fe65fc7f000038000000000000003800000000000000c0d30ff37d000000c00c0544fc7f000000000000 (UID: 00000000-00005964) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0e852fc7f0000070000000000000000000000000000000100000000000000f0aacea19a010000000000000000000070c67aa39a0100004c98fe65fc7f000030ba7aa39a010000b3cefb43fc7f000010cb7aa39a010000004fe852fc7f0000d0b0e852fc7f00000000000000000000000000000000000010cb7aa39a010000f0aacea19a01000080e7cea19a01000018d40ff37d0000004c98fe65fc7f0000010000000000000018d40ff37d00000080e7cea19a01000010cb7aa39a010000010000000000000002bcfb43fc7f0000c0c97aa39a010000a0c078a39a010000feffffff040000007df0e752fc7f0000a0e7cea1 (UID: 00000000-00005964) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000f0aacea19a010000000000000000000070c67aa39a0100004c98fe65fc7f0000b0bb7aa39a010000b3cefb43fc7f000090c97aa39a010000384fe852fc7f0000d0b0e852fc7f00000000000000000000000000000000000090c97aa39a010000f0aacea19a01000080e7cea19a01000010d40ff37d0000004c98fe65fc7f0000010000000000000010d40ff37d00000080e7cea19a01000090c97aa39a010000010000000000000002bcfb43fc7f00000000000000000000a0c078a39a010000c0c97aa304000000fefffffffffffffff0aacea19a0100007df0e752fc7f000000000000 (UID: 00000000-00005964)29:T751,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0f70ff37d0000000000000000000000605f94a19a010000d8f1cb65fc7f000090f70ff37d0000000000000000000000011c94a19a0100001f000000000000000000010000000000501595a19a01000000000100 (UID: 00000000-00005964) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000008cf00ff37d000000000000000000000040f40ff37d000000f8d996a19a010000a0ea0ff37d00000000000000000000004ef7d962fc7f00008cf00ff37d0000000000000000000000000000000000000099ddcb65fc7f0000000000000000000030ea0ff37d00000040ea0ff37d000000010000007d00000000000000 (UID: 00000000-00005964) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7bda62fc7f000000002e50fc7f00000000000000000000000000000000000008062f50fc7f00000001000000000000f098fe65fc7f000000010000000000000001000000000000000000000000000000062f50fc7f000001000000000000000f182e50fc7f0000000000000000000000062f50fc7f000000000000 (UID: 00000000-00005964) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c31fb45fc7f0000708bfd45fc7f00000200000000000000708bfd45fc7f000000000000000000000300000000000000b131fb45fc7f0000a815fe45fc7f000020cbcea19a01000030cbcea19a010000888bfd45fc7f00000100000000000000239f0066fc7f00000000000000000000888bfd45fc7f000006000000 (UID: 00000000-00005964) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000005e213044fc7f00007f0200000000000000000000000000000000000000000000801f0000ffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005964)2a:T6d3,"WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "B3DD7606D2B5A8B4A13771DBECC9EE1CECAFA38A") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "B3DD7606D2B5A8B4A13771DBECC9EE1CECAFA38A") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT\CERTIFICATES"; Key: "B3DD7606D2B5A8B4A13771DBECC9EE1CECAFA38A") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "B3DD7606D2B5A8B4A13771DBECC9EE1CECAFA38A") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "D4DE20D05E66FC53FE1A50882C78DB2852CAE474") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "D4DE20D05E66FC53FE1A50882C78DB2852CAE474") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D4DE20D05E66FC53FE1A50882C78DB2852CAE474"; Key: "BLOB") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESLASTSYNCTIME") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESENCODEDCTL")2b:T641,"WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005964) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005964) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005964) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005964) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005964) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005964) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005964) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00005964) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005964) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005964) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00005964) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00005964) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005964) "WScript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005964) "WScript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005964)2c:T242e,"WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00005964) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00005964)2d:Td85,"WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 62d40000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 62d40000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 62d40000 "WScript.exe" loaded module "KERNEL32" at base 65cb0000 "WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 46240000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 60d40000 "WScript.exe" loaded module "RPCRT4.DLL" at base 65d60000 "WScript.exe" loaded module "KERNEL32.DLL" at base 65cb0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 442f0000 "WScript.exe" loaded module "AMSI.DLL" at base 50a00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 5d800000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 52e70000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\7SMDBHGV.DLL" at base 442a0000 "WScript.exe" loaded module "WLDP.DLL" at base 61730000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 65a10000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 63820000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 61b40000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 50610000 "WScript.exe" loaded module "OLE32.DLL" at base 65e80000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 62af0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 502e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 45fb0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base 46fa0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 44060000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINHTTPCOM.DLL" at base 4f510000 "WScript.exe" loaded module "WINHTTP.DLL" at base 5cd30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 46e90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 61f30000 "WScript.exe" loaded module "SSPICLI.DLL" at base 62630000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 5ae20000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 5c910000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 61a80000 "WScript.exe" loaded module "MSKEYPROTECT.DLL" at base 569f0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 563a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 62cc0000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 43f80000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 65cb0000 "WScript.exe" loaded module "USERENV.DLL" at base 62600000 "WScript.exe" loaded module "VERSION.DLL" at base 5d800000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 652e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 65e80000 "WScript.exe" loaded module "OLEAUT32.DLL" at base 662b0000 "WScript.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 65810000 "WScript.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 65810000 "WScript.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 655000002e:T4c0,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEM\DNSCLIENT"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS\MICROSOFT SSL PROTOCOL PROVIDER"; Key: ""; Value: "")2f:Tbbd,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "")30:Tbbd,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"f0e4e2656467459bfde295f51d68f5b1de5c03a504c2c7c8dc4f0d635ed0da26","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":45,"unified_at_epoch_ms":1790361097919,"unified_at":"2026-09-25T18:31:37.919Z","metadata":{"hashes":{"sha256":"f0e4e2656467459bfde295f51d68f5b1de5c03a504c2c7c8dc4f0d635ed0da26","sha1":"1f3c851f34b0d5d852e6aded505636eb3b8114c8","md5":"1d08ea9c2b5742989ddd848f545ddf00","sha512":"664e102e06139662caac5246b0a317291d25e05f188bac3aefcb4db21978f781bad2f05ce4c1d9c4eae0aa7e00405ba855bb74e92975a51ceb3c1c73fcfa475a","ssdeep":"12:Q2k330+FT6UAWQHDRIuIovVlgMhUADHneAU0991pqEtneYzhpqsF4Ff8fB:Q2CEzSOTIeV6MhvHeAU09k6ej04Ff8fB","ssdeep_chunks":["12:Q2k330+","12:2k330+F","12:k330+FT","12:330+FT6","12:30+FT6U","12:0+FT6UA","12:+FT6UAW","12:FT6UAWQ","12:T6UAWQH","12:6UAWQHD","12:UAWQHDR","12:AWQHDRI","12:WQHDRIu","12:QHDRIuI","12:HDRIuIo","12:DRIuIov","12:RIuIovV","12:IuIovVl","12:uIovVlg","12:IovVlgM","12:ovVlgMh","12:vVlgMhU","12:VlgMhUA","12:lgMhUAD","12:gMhUADH","12:MhUADHn","12:hUADHne","12:UADHneA","12:ADHneAU","12:DHneAU0","12:HneAU09","12:neAU099","12:eAU0991","12:AU0991p","12:U0991pq","12:0991pqE","12:991pqEt","12:91pqEtn","12:1pqEtne","12:pqEtneY","12:qEtneYz","12:EtneYzh","12:tneYzhp","12:neYzhpq","12:eYzhpqs","12:YzhpqsF","12:zhpqsF4","12:hpqsF4F","12:pqsF4Ff","12:qsF4Ff8","12:sF4Ff8f","12:F4Ff8fB","24:Q2k330+","24:2k330+F","24:k330+FT","24:330+FT6","24:30+FT6U","24:0+FT6UA","24:+FT6UAW","24:FT6UAWQ","24:T6UAWQH","24:6UAWQHD","24:UAWQHDR","24:AWQHDRI","24:WQHDRIu","24:QHDRIuI","24:HDRIuIo","24:DRIuIov","24:RIuIovV","24:IuIovVl","24:uIovVlg","24:IovVlgM","24:ovVlgMh","24:vVlgMhU","24:VlgMhUA","24:lgMhUAD","24:gMhUADH","24:MhUADHn","24:hUADHne","24:UADHneA","24:ADHneAU","24:DHneAU0","24:HneAU09","24:neAU099","24:eAU0991","24:AU0991p","24:U0991pq","24:0991pqE","24:991pqEt","24:91pqEtn","24:1pqEtne","24:pqEtneY","24:qEtneYz","24:EtneYzh","24:tneYzhp","24:neYzhpq","24:eYzhpqs","24:YzhpqsF","24:zhpqsF4","24:hpqsF4F","24:pqsF4Ff","24:qsF4Ff8","24:sF4Ff8f","24:F4Ff8fB","12:Q2CEzSO","12:2CEzSOT","12:CEzSOTI","12:EzSOTIe","12:zSOTIeV","12:SOTIeV6","12:OTIeV6M","12:TIeV6Mh","12:IeV6Mhv","12:eV6MhvH","12:V6MhvHe","12:6MhvHeA","12:MhvHeAU","12:hvHeAU0","12:vHeAU09","12:HeAU09k","12:eAU09k6","12:AU09k6e","12:U09k6ej","12:09k6ej0","12:9k6ej04","12:k6ej04F","12:6ej04Ff","12:ej04Ff8","12:j04Ff8f","12:04Ff8fB"],"imphash":"Unknown"},"file_info":{"file_name":"damaged_item.vbs","file_type":["script","vbs"],"file_type_id":"vbs","file_size":560,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1708106711000,"last_seen":1708125586000,"last_multi_scan":1708125586000}},"detections":{"summary":{"verdict":"malicious","score":45,"tags":null},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":29},"sandbox_signatures":{"informative_count":56,"suspicious_count":4,"malicious_count":1,"total":61},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"GT:VB.Methuselah.20.873F5B17","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"GT:VB.Methuselah.20.873F5B17 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Downloader.Script.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.Vbs-heuristic.druvzi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"GT:VB.Methuselah.20","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","identifiers":[{"type":"suspicious","value":"Executes a VBS file"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Windows system process connects to a network"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Calls an API typically used to decrypt a block of data"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Calls an API typically to import asymmetric cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"suspicious","value":"Contact Pastebin domains (possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"WScript.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00005964)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00005964)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00005964)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00005964)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"WScript.exe\" called \"LoadResource with parameter {'hModule': '1763680387073', 'hResInfo': '1763680388320'}\" (UID: 00000000-00005964)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '1763680387073', 'hResInfo': '1763680388352'}\" (UID: 00000000-00005964)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '1763680387073', 'hResInfo': '1763680388368'}\" (UID: 00000000-00005964)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '1763680387073', 'hResInfo': '1763680388336'}\" (UID: 00000000-00005964)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"WScript.exe\" queried SystemProcessInformation at 00000000-00005964-00000C13-56081295 [PID: 5964]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00005964-00000C13-56082992 [PID: 5964]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00005964-00000C13-57052264 [PID: 5964]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00005964-00000C13-57053975 [PID: 5964]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00005964-00000C13-57522337 [PID: 5964]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00005964-00000C13-57523986 [PID: 5964]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00005964-00000C13-59265099 [PID: 5964]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00005964-00000C13-59266714 [PID: 5964]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically to import asymmetric cryptographic keys into a CSP","description":"$27","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to decrypt a block of data","description":"\"WScript.exe\" called \"BCryptDecrypt\" with parameters {\"$dataout\": \"HTTP/1.1 404 Not FoundDate: Fri, 16 Feb 2024 23:22:41 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-alivex-frame-options: DENYx-frame-options: DENYx-content-type-options: nosniffx-content-type-options: nosn\"}\n \"WScript.exe\" called \"BCryptDecrypt\" with parameters {\"$dataout\": \"0\"}","origin":"API Call","mitre_attack_id":"T1140","relevance":3,"id":"api-207","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"WScript.exe\" called \"IsWow64Process\" with parameter \"5964\" - (UID: 00000000-00005964)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"WScript.exe\" called \"GetActiveWindow\" (UID: 00000000-00005964)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005964)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WScript.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00005964)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005964)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00005964)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"set \"; File: \"f0e4e2656467459bfde295f51d68f5b1de5c03a504c2c7c8dc4f0d635ed0da26.vbs\")\n Found string \"Set calosomo = CreateObject(\"MSXML2.ServerXMLHTTP\")\" (Indicator: \"set \"; File: \"f0e4e2656467459bfde295f51d68f5b1de5c03a504c2c7c8dc4f0d635ed0da26.vbs\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"B3DD7606D2B5A8B4A13771DBECC9EE1CECAFA38A\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"B3DD7606D2B5A8B4A13771DBECC9EE1CECAFA38A\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.20.68.143:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\SM0:5964:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5964:304:WilStaging_02\"\n \"Local\\SM0:5964:304:WilStaging_02\"\n \"SM0:5964:304:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 50A00000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 62CC0000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 62200000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 65D60000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"WScript.exe\" called \"Msxml2.ServerXMLHTTP.CreateObject\" ... \n \"WScript.exe\" called \"Msxml2.ServerXMLHTTP.open\" ... \n \"WScript.exe\" called \"Msxml2.ServerXMLHTTP.responseText\" with result: \" Pastebin.com - Not Found (#404)

Not Found (#404)

This page is no longer available. It has either expired, been removed by its creator, or removed by one of the Pastebin staff.

\" ...","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a007d00000040c7eb62fc7f0000@ntdll.dll\"\n \"\"#}@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"WScript.exe\" touched \"VB Script Language\" (Path: \"HKCU\\CLSID\\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\")\n \"WScript.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")\n \"WScript.exe\" touched \"Constructor that allows hosts better control creating scriptlets\" (Path: \"HKCU\\CLSID\\{06290BD1-48AA-11D2-8432-006008C3FBFC}\\TREATAS\")\n \"WScript.exe\" touched \"Multi Language Support\" (Path: \"HKCU\\CLSID\\{275C23E2-3747-11D0-9FEA-00AA003F8646}\\TREATAS\")\n \"WScript.exe\" touched \"Server XML HTTP\" (Path: \"HKCU\\CLSID\\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\\TREATAS\")\n \"WScript.exe\" touched \"WinHttpRequest Component version 5.1\" (Path: \"HKCU\\CLSID\\{2087C2F4-2CEF-4953-A8AB-66779B670495}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"pastebin.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00005964-00000C25-56646411]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00005964-00000C25-57362804]\n Observed system executable string:\"%WINDIR%\\system32\\kernel32.dll\" [Source: 00000000-00005964-00000C25-59802168]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"WScript.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\" (Filter: 268435461; Subtree: 1)\n \"WScript.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Services\\crypt32\" (Filter: 268435460; Subtree: 0)\n \"WScript.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \"WScript.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)\n \"WScript.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CertDllCreateCertificateChainEngine\\Config\" (Filter: 268435460; Subtree: 0)\n \"WScript.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\AutoUpdate\" (Filter: 268435460; Subtree: 0)\n \"WScript.exe\" monitors \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Policy Manager\" (Filter: 5; Subtree: 1)\n \"WScript.exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\Windows Defender\" (Filter: 5; Subtree: 1)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\wscript.exe\" (UID: 5964)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"WScript.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005964)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\f0e4e2656467459bfde295f51d68f5b1de5c03a504c2c7c8dc4f0d635ed0da26.vbs\"\n \"WScript.exe\" reads file \"c:\\windows\\system32\\msxml3.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\version.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\ole32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\wscript.exe.mui\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"WScript.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"WScript.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\winhttpcom.dll\"\n \"WScript.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.12.17007.18022-0\\SLC.DLL\"\n \"WScript.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\SLC.dll\"\n \"WScript.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.12.17007.18022-0\\SPPC.DLL\"\n \"WScript.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\sppc.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\AppLocker\\MDM\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://pastebin.com/raw/NMt95iKw\"\n Pattern match: \"https://pastebin.com/raw/NMt95iKwcalosomo.Open\"\n Heuristic match: \"pastebin.com\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: ce5f3254611a8c095a3d821d44539877\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://pastebin.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.20.68.143\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"WScript.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"16844639\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"WScript.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"\"WScript.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\")\n \"WScript.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$30","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F0\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Executes a VBS file","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\f0e4e2656467459bfde295f51d68f5b1de5c03a504c2c7c8dc4f0d635ed0da26.vbs\"\" (UID: 00000000-00005964)","origin":"Monitored Target","mitre_attack_id":"T1059.005","relevance":10,"id":"target-17","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"suspicious","category":"Network Related","name":"Contact Pastebin domains (possible C&C communication)","description":"\"pastebin.com\"","origin":"Network Traffic","mitre_attack_id":"T1102","relevance":5,"id":"network-44","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.20.68.143 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\System32\\WScript.exe\" connects to 104.20.68.143 on port 443 (TCP); Domain: \"pastebin.com\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Windows system process connects to a network","description":"Process \"WScript.exe\" connects to 104.20.68.143:443","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":81,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":12,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":12,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"65cfed91b0f34ec6c40cd89e","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":45,"contacted_countries":["USA"],"submit_name":"f0e4e2656467459bfde295f51d68f5b1de5c03a504c2c7c8dc4f0d635ed0da26.vbs","analysis_start_time":"2024-02-16T23:19:46+00:00","indicators_count":{"informative":56,"suspicious":4,"malicious":1},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.20.68.143","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]}],"dns_resolutions":[{"domain":"pastebin.com","address":"104.20.68.143","ttl":300,"country":"United States","registrar_name":"ENOM, INC.","registrar_organization":"WHOISGUARD, INC.","registrar_name_servers":"SUE.NS.CLOUDFLARE.COM","registrar_creation_date":"2002-09-03T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}],"processes":[{"pid":5964,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\f0e4e2656467459bfde295f51d68f5b1de5c03a504c2c7c8dc4f0d635ed0da26.vbs\"","sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00005964","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="}],"all_imported_dlls":["winnsi.dll","gpapi.dll","user32.dll","ole32.dll","shell32.dll","sppc.dll","msvcrt.dll","msctf.dll","MpOAV.dll","ntdll.dll","msvcp_win.dll","win32u.dll","advapi32.dll","wldp.dll","ntasn1.dll","WinTypes.dll","KernelBase.dll","version.dll","coml2.dll","FWPUCLNT.DLL","ncrypt.dll","MpClient.dll","CoreMessaging.dll","gdi32full.dll","dnsapi.dll","gdi32.dll","kernel32.dll","kernel.appcore.dll","wintrust.dll","TextInputFramework.dll","sechost.dll","bcrypt.dll","msisip.dll","shlwapi.dll","scrobj.dll","dwmapi.dll","ucrtbase.dll","rpcrt4.dll","imm32.dll","7smDBhgv.dll","webio.dll","slc.dll","fltLib.dll","crypt32.dll","winhttpcom.dll","CoreUIComponents.dll","ntmarta.dll","bcryptprimitives.dll","uxtheme.dll","profapi.dll","msasn1.dll","OnDemandConnRouteHelper.dll","schannel.dll","ncryptsslp.dll","ws2_32.dll","amsi.dll","powrprof.dll","mskeyprotect.dll","sxs.dll","clbcatq.dll","oleaut32.dll","cryptbase.dll","wshext.dll","SHCore.dll","mswsock.dll","cryptsp.dll","cfgmgr32.dll","IPHLPAPI.DLL","nsi.dll","vbscript.dll","windows.storage.dll","mlang.dll","msxml3.dll","sspicli.dll","rasadhlp.dll","dpapi.dll","rsaenh.dll","winhttp.dll","combase.dll","VxSSL64.dll","userenv.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\\","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5964:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5964:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"name":"Local\\SM0:5964:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]},{"name":"SM0:5964:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65cfed91b0f34ec6c40cd89e"}]}]}},"report_ids":{"sandbox_job_ids":["65cfed91b0f34ec6c40cd89e"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious GT:VB.Methuselah.20 Sample f0e4e2656467… — Score 45/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f0e4e2656467…. Malware family: GT:VB.Methuselah.20. Threat score 45/100. 4/24 AV engines flagged this file. 1 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f0e4e2656467459bfde295f51d68f5b1de5c03a504c2c7c8dc4f0d635ed0da26"}],["$","meta","4",{"property":"og:title","content":"Malicious GT:VB.Methuselah.20 Sample f0e4e2656467… — Score 45/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f0e4e2656467…. Malware family: GT:VB.Methuselah.20. Threat score 45/100. 4/24 AV engines flagged this file. 1 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f0e4e2656467459bfde295f51d68f5b1de5c03a504c2c7c8dc4f0d635ed0da26"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious GT:VB.Methuselah.20 Sample f0e4e2656467… — Score 45/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f0e4e2656467…. Malware family: GT:VB.Methuselah.20. Threat score 45/100. 4/24 AV engines flagged this file. 1 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]