dd37c75a0da7c3be6f4dc3594cf7bd3460200593664a5344eb0c9120ef61d86f

General

Target

vbs.vbs
Size

1KB
MD5

239bbcf5668cd4778530d27aa4a50d3a
SHA1

694809c0a1c739bc85d9790460153caff768b71f
SHA256

dd37c75a0da7c3be6f4dc3594cf7bd3460200593664a5344eb0c9120ef61d86f
SHA512

08f1f2437286743964142fafe6db8c62e02e2cfbdeb5b9842a1f555bc00cb615b8fc98dc355067045a20afbbc3d60b09c61018ead2407105cce2e9c877440057

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2880	taskkill.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
3028	reg.exe
2644	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2880	taskkill.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 2036	1392	WScript.exe	28
PID 1392 wrote to memory of 2036	1392	WScript.exe	28
PID 1392 wrote to memory of 2036	1392	WScript.exe	28
PID 1392 wrote to memory of 2156	1392	WScript.exe	30
PID 1392 wrote to memory of 2156	1392	WScript.exe	30
PID 1392 wrote to memory of 2156	1392	WScript.exe	30
PID 1392 wrote to memory of 1228	1392	WScript.exe	32
PID 1392 wrote to memory of 1228	1392	WScript.exe	32
PID 1392 wrote to memory of 1228	1392	WScript.exe	32
PID 2036 wrote to memory of 3028	2036	cmd.exe	33
PID 2036 wrote to memory of 3028	2036	cmd.exe	33
PID 2036 wrote to memory of 3028	2036	cmd.exe	33
PID 1228 wrote to memory of 2512	1228	wscript.exe	34
PID 1228 wrote to memory of 2512	1228	wscript.exe	34
PID 1228 wrote to memory of 2512	1228	wscript.exe	34
PID 1228 wrote to memory of 2616	1228	wscript.exe	36
PID 1228 wrote to memory of 2616	1228	wscript.exe	36
PID 1228 wrote to memory of 2616	1228	wscript.exe	36
PID 2512 wrote to memory of 2644	2512	cmd.exe	38
PID 2512 wrote to memory of 2644	2512	cmd.exe	38
PID 2512 wrote to memory of 2644	2512	cmd.exe	38
PID 1228 wrote to memory of 2880	1228	wscript.exe	39
PID 1228 wrote to memory of 2880	1228	wscript.exe	39
PID 1228 wrote to memory of 2880	1228	wscript.exe	39

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vbs.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:3028
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v ABC_DEF /f
  2⤵
  PID:2156
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\vbs.vbs" uac
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /k C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:2644
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v ABC_DEF /f
    3⤵
    PID:2616
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im svchost.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2880