939c8987dca4aacad41066c29eb0bee95ed447c5f9597953fd1de0027c660ee4

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-09-2024 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

code.vbs
Size

566B
MD5

73d9fdda098386095a38def08f0391cf
SHA1

4cc22841ea50caaeb8de420cb5da4a0af44a817c
SHA256

939c8987dca4aacad41066c29eb0bee95ed447c5f9597953fd1de0027c660ee4
SHA512

f6e1eee98e643f113693a43477ae47357289afa1b3d0ab9312c18e642c2bb5712af741da2bc4ac7d782a1cecb1ed76993713dedf1d204af73ecb91a7e2c66ee0

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 14 IoCs

exploit

pid	Process
2468	takeown.exe
4700	takeown.exe
1824	icacls.exe
4372	icacls.exe
3012	takeown.exe
3228	takeown.exe
2076	takeown.exe
1936	icacls.exe
1916	takeown.exe
1896	icacls.exe
1444	icacls.exe
4900	takeown.exe
4288	icacls.exe
1872	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	WScript.exe

Modifies file permissions 1 TTPs 14 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1872	icacls.exe
4372	icacls.exe
1824	icacls.exe
2076	takeown.exe
4700	takeown.exe
1444	icacls.exe
1916	takeown.exe
1896	icacls.exe
3228	takeown.exe
4900	takeown.exe
4288	icacls.exe
2468	takeown.exe
3012	takeown.exe
1936	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1468	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 3012	700	WScript.exe	84
PID 700 wrote to memory of 3012	700	WScript.exe	84
PID 700 wrote to memory of 4288	700	WScript.exe	86
PID 700 wrote to memory of 4288	700	WScript.exe	86
PID 700 wrote to memory of 2468	700	WScript.exe	88
PID 700 wrote to memory of 2468	700	WScript.exe	88
PID 700 wrote to memory of 1936	700	WScript.exe	90
PID 700 wrote to memory of 1936	700	WScript.exe	90
PID 700 wrote to memory of 1916	700	WScript.exe	92
PID 700 wrote to memory of 1916	700	WScript.exe	92
PID 700 wrote to memory of 1896	700	WScript.exe	95
PID 700 wrote to memory of 1896	700	WScript.exe	95
PID 700 wrote to memory of 4700	700	WScript.exe	97
PID 700 wrote to memory of 4700	700	WScript.exe	97
PID 700 wrote to memory of 1444	700	WScript.exe	99
PID 700 wrote to memory of 1444	700	WScript.exe	99
PID 700 wrote to memory of 3228	700	WScript.exe	101
PID 700 wrote to memory of 3228	700	WScript.exe	101
PID 700 wrote to memory of 1824	700	WScript.exe	103
PID 700 wrote to memory of 1824	700	WScript.exe	103
PID 700 wrote to memory of 2076	700	WScript.exe	105
PID 700 wrote to memory of 2076	700	WScript.exe	105
PID 700 wrote to memory of 1872	700	WScript.exe	107
PID 700 wrote to memory of 1872	700	WScript.exe	107
PID 700 wrote to memory of 4900	700	WScript.exe	109
PID 700 wrote to memory of 4900	700	WScript.exe	109
PID 700 wrote to memory of 4372	700	WScript.exe	111
PID 700 wrote to memory of 4372	700	WScript.exe	111

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\code.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:700
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\NTUSER.DAT
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3012
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" C:\Users\Admin\NTUSER.DAT /grant Everyone:(F)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4288
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\ntuser.dat.LOG1
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2468
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" C:\Users\Admin\ntuser.dat.LOG1 /grant Everyone:(F)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1936
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\ntuser.dat.LOG2
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1916
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" C:\Users\Admin\ntuser.dat.LOG2 /grant Everyone:(F)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1896
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TM.blf
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4700
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TM.blf /grant Everyone:(F)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1444
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3228
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms /grant Everyone:(F)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1824
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2076
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms /grant Everyone:(F)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1872
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\ntuser.ini
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4900
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" C:\Users\Admin\ntuser.ini /grant Everyone:(F)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4372

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\CompareHide.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads