da372170c6fa0828db5e4fb5cf15749d09391b6f6b998dc6a27ecc68e26ff30a

Analysis

max time kernel
15s
max time network
20s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 17:45

Target

strcomputer.vbs
Size

2KB
MD5

26b6d2fcf318aecf9df98d0f4705a671
SHA1

1751305572fc3e87bdcf8f5a46fd45fee3a3830d
SHA256

da372170c6fa0828db5e4fb5cf15749d09391b6f6b998dc6a27ecc68e26ff30a
SHA512

46622857c48e01b8222eb0613b77d88155d17b8694e13b6edc3c8d88d6278104496680381d595a37ace5a18f71fe85c7405a866b3092d09618da4832da925784

Score

10^/10

evasion trojan

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2212	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
4960	reg.exe

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
3260	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2212	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 4720	3376	WScript.exe	89
PID 3376 wrote to memory of 4720	3376	WScript.exe	89
PID 4720 wrote to memory of 4960	4720	cmd.exe	92
PID 4720 wrote to memory of 4960	4720	cmd.exe	92
PID 3376 wrote to memory of 2212	3376	WScript.exe	93
PID 3376 wrote to memory of 2212	3376	WScript.exe	93

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3260