eb3f85c3d94230f89807de4642d7a54b603cb7b35d0009057ec3c4d78dddf272

Analysis

max time kernel
61s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

target.vbs
Size

854B
MD5

eae951cb85656cc231f19829f9550ec4
SHA1

412416ea84052b16ba7204e8260577c99498cfba
SHA256

eb3f85c3d94230f89807de4642d7a54b603cb7b35d0009057ec3c4d78dddf272
SHA512

888ce426a1eff7e6c5e17b254df246e41f58ab3e7bda2429def5f69e0b6070fdb6d395441917f8c4eaa8426b4767772cb725218599383743cfe7c7ed743802cd

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2616	taskkill.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3040	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2704	chrome.exe
2704	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	taskkill.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 3040	2956	WScript.exe	28
PID 2956 wrote to memory of 3040	2956	WScript.exe	28
PID 2956 wrote to memory of 3040	2956	WScript.exe	28
PID 2956 wrote to memory of 2616	2956	WScript.exe	29
PID 2956 wrote to memory of 2616	2956	WScript.exe	29
PID 2956 wrote to memory of 2616	2956	WScript.exe	29
PID 2956 wrote to memory of 2704	2956	WScript.exe	32
PID 2956 wrote to memory of 2704	2956	WScript.exe	32
PID 2956 wrote to memory of 2704	2956	WScript.exe	32
PID 2704 wrote to memory of 2628	2704	chrome.exe	33
PID 2704 wrote to memory of 2628	2704	chrome.exe	33
PID 2704 wrote to memory of 2628	2704	chrome.exe	33
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2420	2704	chrome.exe	34
PID 2704 wrote to memory of 2432	2704	chrome.exe	35
PID 2704 wrote to memory of 2432	2704	chrome.exe	35
PID 2704 wrote to memory of 2432	2704	chrome.exe	35
PID 2704 wrote to memory of 2464	2704	chrome.exe	36
PID 2704 wrote to memory of 2464	2704	chrome.exe	36
PID 2704 wrote to memory of 2464	2704	chrome.exe	36
PID 2704 wrote to memory of 2464	2704	chrome.exe	36
PID 2704 wrote to memory of 2464	2704	chrome.exe	36
PID 2704 wrote to memory of 2464	2704	chrome.exe	36
PID 2704 wrote to memory of 2464	2704	chrome.exe	36
PID 2704 wrote to memory of 2464	2704	chrome.exe	36
PID 2704 wrote to memory of 2464	2704	chrome.exe	36
PID 2704 wrote to memory of 2464	2704	chrome.exe	36

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\target.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Roaming\note.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3040
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im notepad.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" www.google.com/search?q=what+is+the+problem+for+Admin%3F
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6309758,0x7fef6309768,0x7fef6309778
    3⤵
    PID:2628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1192 --field-trial-handle=1392,i,1741218928121335075,3313853711958804752,131072 /prefetch:2
    3⤵
    PID:2420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1392,i,1741218928121335075,3313853711958804752,131072 /prefetch:8
    3⤵
    PID:2432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1392,i,1741218928121335075,3313853711958804752,131072 /prefetch:8
    3⤵
    PID:2464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2332 --field-trial-handle=1392,i,1741218928121335075,3313853711958804752,131072 /prefetch:1
    3⤵
    PID:2604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2344 --field-trial-handle=1392,i,1741218928121335075,3313853711958804752,131072 /prefetch:1
    3⤵
    PID:2716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1608 --field-trial-handle=1392,i,1741218928121335075,3313853711958804752,131072 /prefetch:2
    3⤵
    PID:2828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3232 --field-trial-handle=1392,i,1741218928121335075,3313853711958804752,131072 /prefetch:1
    3⤵
    PID:536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3560 --field-trial-handle=1392,i,1741218928121335075,3313853711958804752,131072 /prefetch:8
    3⤵
    PID:1656

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
5b441b6541586b3b132b67f57d482126

SHA1
4b9dba4ed8366914d6f07c38cb40a2f9ec8c1b64

SHA256
f020ddada9c70bcef0cf4f684ad1de53455020b5e56bb2932da5563977cf70b7

SHA512
ef092a9c57b2af8d46535937d3cb6b0d1a402a3a92ceb6f88af3cfe6e6a155121adfa3ce178f46a890dff9d85cd336ea4d5121d9079f472e0a37e413ce945c1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
296b0d77d92a4ed4ac2bb62ed3b27d71

SHA1
0af4c40c62d2e0d062d185b7f39af062bff7cf7d

SHA256
dbbabe23091a7630ba7aaf5f2f23262b0720729ac174cecbf6c8ecbcd1bfad51

SHA512
b4fd0a16a3b81c7a426edd19c43a02682228f837847d8cb456bb978cc42491fcd09235ef1257b7beb202437dd587836f29f10196ab4b415d56d85ded267fbc21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1da0e0710ae2906a88bc6ef2e63168de

SHA1
750b7b8cea28166953041a1247041f919fc5bc09

SHA256
8987277559b6dbdcc84b5600ee9d69ce3e9e94d8c93cf4bcfb8dac5f7d6112f5

SHA512
e0a73db9f0a9f17cf9aa921c9ffc24d7941eeb5ef304ec9ad8207aa8d9e6957905456c4d8aac4ad99f199856d5e5123a23bb5b5a0b38d6c93ac2c887b5e6ec86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Roaming\note.txt

Filesize
105B

MD5
7974a453105fb964df9cbdf56bd8f998

SHA1
f99e67104498c6a19323cdb636f3edfee2f89119

SHA256
03eae3a1fc877ce36665bcf5c4f6b2614059447b454132083e3ed1eb439e00f0

SHA512
243e57c7f65de4f0ad505062bb80f06b2342d515b0f55bed8978f51367e517c42d60df5d85d83fa5f9ec17f076d2ea40fe4eefed7fadc2e72f88fad57c63d107

Download Submit