abf42d3bfbc4d6e51d74bd07b039bd4c92d9bf16967b488c78fef65bb983529d | Triage™

Login
Reports

Overview

overview

9

Static

static

1

fbo.vbs

windows10-ltsc_2021-x64

9

Sharing

Copy URL Twitter E-mail

General

Target
fbo.vbs
Size 2KB
Sample261002-2fn46sxtbv
SHA256 abf42d3bfbc4d6e51d74bd07b039bd4c92d9bf16967b488c78fef65bb983529d
MD5 82b6b9fd988a11e3fa823dad31c7dbe8
SHA1 3e62f7446a547c2d846ef70dc964944889e8a088
SHA512 9faa056586e917721f9c09864b7e0b27c7757f4ca3bfb56cf347b2a2d51726a772c503be2e4452e4b8b26e81c978d1c09b481cb307e7145cba9e8bbe4e47d70f
TLSH
T11D51740EE018C0B189317016CC1AFDAFCE74E14B892AE97478887545761B5F99ED345F
MD5 SHA1 SHA512 TLSH

Score

9^/10

defense_evasion evasion execution impact persistence privilege_escalation ransomware trojan

Static task

static1

Behavioral task

behavioral1

Sample

fbo.vbs

Resource

win10ltsc2021-20260911-en

windows10-ltsc_2021-x64

19 signatures

150 seconds

defense_evasion evasion execution impact persistence privilege_escalation ransomware trojan

Malware Config

Targets

- Target
  fbo.vbs
- Size 2KB
- SHA256 abf42d3bfbc4d6e51d74bd07b039bd4c92d9bf16967b488c78fef65bb983529d
- MD5 82b6b9fd988a11e3fa823dad31c7dbe8
- SHA1 3e62f7446a547c2d846ef70dc964944889e8a088
- SHA512 9faa056586e917721f9c09864b7e0b27c7757f4ca3bfb56cf347b2a2d51726a772c503be2e4452e4b8b26e81c978d1c09b481cb307e7145cba9e8bbe4e47d70f
- TLSH
  T11D51740EE018C0B189317016CC1AFDAFCE74E14B892AE97478887545761B5F99ED345F
- MD5 SHA1 SHA512 TLSH
Score

9^/10

defense_evasion evasion execution impact persistence privilege_escalation ransomware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Disables service(s)
  defense_evasion execution
- Checks whether UAC is enabled
  defense_evasion trojan
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Visual Basic

Windows Command Shell

System Services

Service Execution

Windows Management Instrumentation

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Service Stop

Tasks

static1

behavioral1

defense_evasionevasionexecutionimpactpersistenceprivilege_escalationransomwaretrojan

© 2018-2026

Terms | Privacy