939c8987dca4aacad41066c29eb0bee95ed447c5f9597953fd1de0027c660ee4

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

code.vbs
Size

566B
MD5

73d9fdda098386095a38def08f0391cf
SHA1

4cc22841ea50caaeb8de420cb5da4a0af44a817c
SHA256

939c8987dca4aacad41066c29eb0bee95ed447c5f9597953fd1de0027c660ee4
SHA512

f6e1eee98e643f113693a43477ae47357289afa1b3d0ab9312c18e642c2bb5712af741da2bc4ac7d782a1cecb1ed76993713dedf1d204af73ecb91a7e2c66ee0

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 16 IoCs

exploit

pid	Process
2680	icacls.exe
2640	takeown.exe
2288	icacls.exe
632	icacls.exe
2880	takeown.exe
2916	takeown.exe
2808	icacls.exe
2716	icacls.exe
2256	takeown.exe
2172	takeown.exe
2344	icacls.exe
1240	icacls.exe
2300	takeown.exe
2440	icacls.exe
2668	takeown.exe
1836	takeown.exe

Modifies file permissions 1 TTPs 16 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2916	takeown.exe
2680	icacls.exe
2668	takeown.exe
2288	icacls.exe
2880	takeown.exe
2172	takeown.exe
632	icacls.exe
2640	takeown.exe
1836	takeown.exe
2256	takeown.exe
2440	icacls.exe
2344	icacls.exe
2808	icacls.exe
2716	icacls.exe
1240	icacls.exe
2300	takeown.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2300	1140	WScript.exe	30
PID 1140 wrote to memory of 2300	1140	WScript.exe	30
PID 1140 wrote to memory of 2300	1140	WScript.exe	30
PID 1140 wrote to memory of 2440	1140	WScript.exe	32
PID 1140 wrote to memory of 2440	1140	WScript.exe	32
PID 1140 wrote to memory of 2440	1140	WScript.exe	32
PID 1140 wrote to memory of 2880	1140	WScript.exe	34
PID 1140 wrote to memory of 2880	1140	WScript.exe	34
PID 1140 wrote to memory of 2880	1140	WScript.exe	34
PID 1140 wrote to memory of 2344	1140	WScript.exe	36
PID 1140 wrote to memory of 2344	1140	WScript.exe	36
PID 1140 wrote to memory of 2344	1140	WScript.exe	36
PID 1140 wrote to memory of 2916	1140	WScript.exe	38
PID 1140 wrote to memory of 2916	1140	WScript.exe	38
PID 1140 wrote to memory of 2916	1140	WScript.exe	38
PID 1140 wrote to memory of 2680	1140	WScript.exe	40
PID 1140 wrote to memory of 2680	1140	WScript.exe	40
PID 1140 wrote to memory of 2680	1140	WScript.exe	40
PID 1140 wrote to memory of 2668	1140	WScript.exe	42
PID 1140 wrote to memory of 2668	1140	WScript.exe	42
PID 1140 wrote to memory of 2668	1140	WScript.exe	42
PID 1140 wrote to memory of 2808	1140	WScript.exe	44
PID 1140 wrote to memory of 2808	1140	WScript.exe	44
PID 1140 wrote to memory of 2808	1140	WScript.exe	44
PID 1140 wrote to memory of 2640	1140	WScript.exe	46
PID 1140 wrote to memory of 2640	1140	WScript.exe	46
PID 1140 wrote to memory of 2640	1140	WScript.exe	46
PID 1140 wrote to memory of 2716	1140	WScript.exe	48
PID 1140 wrote to memory of 2716	1140	WScript.exe	48
PID 1140 wrote to memory of 2716	1140	WScript.exe	48
PID 1140 wrote to memory of 2256	1140	WScript.exe	50
PID 1140 wrote to memory of 2256	1140	WScript.exe	50
PID 1140 wrote to memory of 2256	1140	WScript.exe	50
PID 1140 wrote to memory of 2288	1140	WScript.exe	52
PID 1140 wrote to memory of 2288	1140	WScript.exe	52
PID 1140 wrote to memory of 2288	1140	WScript.exe	52
PID 1140 wrote to memory of 2172	1140	WScript.exe	54
PID 1140 wrote to memory of 2172	1140	WScript.exe	54
PID 1140 wrote to memory of 2172	1140	WScript.exe	54
PID 1140 wrote to memory of 1240	1140	WScript.exe	56
PID 1140 wrote to memory of 1240	1140	WScript.exe	56
PID 1140 wrote to memory of 1240	1140	WScript.exe	56
PID 1140 wrote to memory of 1836	1140	WScript.exe	58
PID 1140 wrote to memory of 1836	1140	WScript.exe	58
PID 1140 wrote to memory of 1836	1140	WScript.exe	58
PID 1140 wrote to memory of 632	1140	WScript.exe	60
PID 1140 wrote to memory of 632	1140	WScript.exe	60
PID 1140 wrote to memory of 632	1140	WScript.exe	60

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\code.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\deployment.properties
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2300
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" C:\Users\Admin\deployment.properties /grant Everyone:(F)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2440
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\NTUSER.DAT
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2880
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" C:\Users\Admin\NTUSER.DAT /grant Everyone:(F)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2344
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\ntuser.dat.LOG1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2916
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" C:\Users\Admin\ntuser.dat.LOG1 /grant Everyone:(F)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2680
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\ntuser.dat.LOG2
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2668
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" C:\Users\Admin\ntuser.dat.LOG2 /grant Everyone:(F)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2808
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2640
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" C:\Users\Admin\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf /grant Everyone:(F)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2716
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2256
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" C:\Users\Admin\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms /grant Everyone:(F)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2288
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2172
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" C:\Users\Admin\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms /grant Everyone:(F)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1240
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\ntuser.ini
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1836
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" C:\Users\Admin\ntuser.ini /grant Everyone:(F)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...