b7da3b3684234f6959fc1b0bd217f111faa5b4048c62b6339320144d790ac178

Analysis

max time kernel
140s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2024 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cina/Desktop (2)/KeyFreeze/Lock2/extra security.vbs
Size

703B
MD5

7a8dd45a3d1cf2299ef1b56812c0a128
SHA1

0558385de7d0bc3adc8cb13692e0513a625ee8c0
SHA256

f3085abe9314b33e7aa8b65a25aaa57d6f82f867bc96d5dca92ee1d0e5e4cf49
SHA512

54677e79af244d0c8847cbc400ada13f766bbbfa75e6fe7e9a10a6a9559910be3b25615df85ff6be1f398d77597c19f9762e09c2e1a9fce509e251624a8ca1c2

Score

8^/10

evasion

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

WScript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	WScript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Cina\Desktop (2)\KeyFreeze\Lock2\extra security.vbs"
1⤵
- System policy modification
PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads