ae5b66322e5a7c26ad21ccc556bdc1618796166565d2939142c5aa3d76c38ace

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 04:39

Target

wscripts/service-remove.vbs
Size

150B
MD5

b90e75dd7903cb2d6328bb3714865c7a
SHA1

2d32868deb198726ed5feb80b66542bad7fbacee
SHA256

970b3c2a9ea1906a177810990478932e3517f47aba267cf2ab9e4ba65e7b475f
SHA512

3d4bfb86ec98fd85843ae5b63dcf5f475c6500380f02bb4d0dee15a5f7e2334abdbbcd9420b8ac05b5beb8a63b9ea16abcd70ae01c04b87a423fc288ff4dca0a

Score

8^/10

evasion execution

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	WScript.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3672	sc.exe
884	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 3672	3200	WScript.exe	82
PID 3200 wrote to memory of 3672	3200	WScript.exe	82
PID 3200 wrote to memory of 884	3200	WScript.exe	84
PID 3200 wrote to memory of 884	3200	WScript.exe	84

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\wscripts\service-remove.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop Parsec
  2⤵
  - Launches sc.exe
  PID:3672
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete Parsec
  2⤵
  - Launches sc.exe
  PID:884