Overview

overview

9

Static

static

1

code.vbs

windows7-x64

9

code.vbs

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target
    code.vbs
  • Size 1KB
  • Sample241011-s9dqvsvfpp
  • SHA256 a7e0361d293c68159a7d48b5cfeef5804ba938df7e6e0dfbb1e6ca200bcfd037
  • MD5 SHA1 SHA512
Score
9/10
defense_evasiondiscoveryexploitpersistenceransomware

Malware Config

Targets

    • Target
      code.vbs
    • Size 1KB
    • SHA256 a7e0361d293c68159a7d48b5cfeef5804ba938df7e6e0dfbb1e6ca200bcfd037
    • MD5 SHA1 SHA512
    Score
    9/10
    discoveryexploitransomwaredefense_evasionpersistence

    • Renames multiple (13075) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Possible privilege escalation attempt

      exploit

    • Boot or Logon Autostart Execution: Print Processors

      Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Indicator Removal: Clear Windows Event Logs

      Clear Windows Event Logs to hide the activity of an intrusion.

      defense_evasion

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks