Analysis date (UTC): 30 January 2026, 14:37Analysis environment: Windows 10 Pro, build 19044, x64

RECHNUNG_18208_177710896.js

MD5:3508904CE78AC94DF266715B98602A34

SHA1:EE9AF56398BFEC7E79824A8C179D2DC6702BD731

SHA256:A4F74E43E4F14CAC480C64F5A75147742F8AAB699AA84915C6E30B1EB041032E

Analysis result

Threat level:Malicious activity

Full analysis:Analysis RECHNUNG_18208_177710896.js (MD5: 3508904CE78AC94DF266715B98602A34) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Creates internet connection object (SCRIPT)

wscript.exe (PID: 6928)
cscript.exe (PID: 8144)

Gets path to any of the special folders (SCRIPT)

wscript.exe (PID: 6928)
cscript.exe (PID: 8144)

Copies file to a new location (SCRIPT)

wscript.exe (PID: 6928)

Reads the value of a key from the registry (SCRIPT)

wscript.exe (PID: 6928)
cscript.exe (PID: 8144)

Uses sleep, probably for evasion detection (SCRIPT)

cscript.exe (PID: 8144)

Sends HTTP request (SCRIPT)

cscript.exe (PID: 8144)

Opens an HTTP connection (SCRIPT)

cscript.exe (PID: 8144)

Opens a text file (SCRIPT)

cscript.exe (PID: 8144)

SUSPICIOUS

Creates FileSystem object to access computer's file system (SCRIPT)

wscript.exe (PID: 6928)
cscript.exe (PID: 8144)

Accesses computer name via WMI (SCRIPT)

wscript.exe (PID: 6928)
cscript.exe (PID: 8144)

Gets full path of the running script (SCRIPT)

wscript.exe (PID: 6928)
cscript.exe (PID: 8144)

Accesses system license id via WMI (SCRIPT)

wscript.exe (PID: 6928)
cscript.exe (PID: 8144)

The process executes JS scripts

wscript.exe (PID: 6928)

Runs shell command (SCRIPT)

wscript.exe (PID: 6928)

INFO

Drops script file

wscript.exe (PID: 6928)
cscript.exe (PID: 8144)

Reads Windows Product ID

wscript.exe (PID: 6928)
cscript.exe (PID: 8144)

Reads security settings of Internet Explorer

cscript.exe (PID: 8144)

Create files in a temporary directory

cscript.exe (PID: 8144)

Checks proxy server information

cscript.exe (PID: 8144)
slui.exe (PID: 6272)

Self-termination (SCRIPT)

wscript.exe (PID: 6928)

Threats

PID	Process	Class	Message
8144	cscript.exe	Misc activity	ET INFO Observed UA-CPU Header
7004	svchost.exe	Unknown Traffic	ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)