aab77d3b1891b93b6fd235cb023127c2b34365026057bb0200b714f9483cab80

General

Target

svchost.bin.exe
Size

312KB
MD5

fbd82a5f5bfe23872fad17cf62c41a6e
SHA1

03dff661da8207517fc4cb3c0809e8c0fe7f76fa
SHA256

a1b6faa0465ec8bf30e3450f9679f121ff9e724257577c38c813b77e82e1f42f
SHA512

ac653d1f6b2222c56c3b73715219028a70ca078c87585a11ee2260d68d336e76a794d5d4c111c7c423aa916ed375d18a0cc3a6eb4789e40414243467e11da9bc

Score

10^/10

evasion trojan ransomware persistence

Malware Config

Signatures

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

svchost.bin.execmd.execmd.exe

description	pid	process	target process
PID 2112 wrote to memory of 2672	2112	svchost.bin.exe	cmd.exe
PID 2112 wrote to memory of 2672	2112	svchost.bin.exe	cmd.exe
PID 2112 wrote to memory of 2672	2112	svchost.bin.exe	cmd.exe
PID 2112 wrote to memory of 2856	2112	svchost.bin.exe	cmd.exe
PID 2112 wrote to memory of 2856	2112	svchost.bin.exe	cmd.exe
PID 2112 wrote to memory of 2856	2112	svchost.bin.exe	cmd.exe
PID 2112 wrote to memory of 3532	2112	svchost.bin.exe	powershell.exe
PID 2112 wrote to memory of 3532	2112	svchost.bin.exe	powershell.exe
PID 2112 wrote to memory of 3532	2112	svchost.bin.exe	powershell.exe
PID 2672 wrote to memory of 3004	2672	cmd.exe	sc.exe
PID 2672 wrote to memory of 3004	2672	cmd.exe	sc.exe
PID 2672 wrote to memory of 3004	2672	cmd.exe	sc.exe
PID 2856 wrote to memory of 2920	2856	cmd.exe	vssadmin.exe
PID 2856 wrote to memory of 2920	2856	cmd.exe	vssadmin.exe
PID 2856 wrote to memory of 2920	2856	cmd.exe	vssadmin.exe
PID 2856 wrote to memory of 3152	2856	cmd.exe	WMIC.exe
PID 2856 wrote to memory of 3152	2856	cmd.exe	WMIC.exe
PID 2856 wrote to memory of 3152	2856	cmd.exe	WMIC.exe

Drops file in Drivers directory 1 IoCs

Processes:

svchost.bin.exe

description ioc process

File created C:\Windows\System32\drivers\etc\host svchost.bin.exe

description	ioc	process
File created	C:\Windows\System32\drivers\etc\host	svchost.bin.exe

System policy modification 1 TTPs 17 IoCs

evasion

Modify Registry

T1112

Processes:

svchost.bin.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\scforceoption = "0"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "1"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\dontdisplaylastusername = "0"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "1"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "1"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "5"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "1"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\undockwithoutlogon = "1"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "5"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "3"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.bin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	svchost.bin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption	svchost.bin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext	svchost.bin.exe

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

svchost.bin.exeWerFault.exe

pid	process
2112	svchost.bin.exe
2112	svchost.bin.exe
2112	svchost.bin.exe
2112	svchost.bin.exe
2112	svchost.bin.exe
2112	svchost.bin.exe
2112	svchost.bin.exe
2112	svchost.bin.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1840 3532 WerFault.exe powershell.exe
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

svchost.bin.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.bin.exe
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2920 vssadmin.exe

pid	pid_target	process	target process
1840	3532	WerFault.exe	powershell.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.bin.exe

pid	process
2920	vssadmin.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

vssvc.exeWMIC.exeWerFault.exe

description	pid	process
Token: SeBackupPrivilege	1492	vssvc.exe
Token: SeRestorePrivilege	1492	vssvc.exe
Token: SeAuditPrivilege	1492	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3152	WMIC.exe
Token: SeSecurityPrivilege	3152	WMIC.exe
Token: SeTakeOwnershipPrivilege	3152	WMIC.exe
Token: SeLoadDriverPrivilege	3152	WMIC.exe
Token: SeSystemProfilePrivilege	3152	WMIC.exe
Token: SeSystemtimePrivilege	3152	WMIC.exe
Token: SeProfSingleProcessPrivilege	3152	WMIC.exe
Token: SeIncBasePriorityPrivilege	3152	WMIC.exe
Token: SeCreatePagefilePrivilege	3152	WMIC.exe
Token: SeBackupPrivilege	3152	WMIC.exe
Token: SeRestorePrivilege	3152	WMIC.exe
Token: SeShutdownPrivilege	3152	WMIC.exe
Token: SeDebugPrivilege	3152	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3152	WMIC.exe
Token: SeRemoteShutdownPrivilege	3152	WMIC.exe
Token: SeUndockPrivilege	3152	WMIC.exe
Token: SeManageVolumePrivilege	3152	WMIC.exe
Token: 33	3152	WMIC.exe
Token: 34	3152	WMIC.exe
Token: 35	3152	WMIC.exe
Token: 36	3152	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3152	WMIC.exe
Token: SeSecurityPrivilege	3152	WMIC.exe
Token: SeTakeOwnershipPrivilege	3152	WMIC.exe
Token: SeLoadDriverPrivilege	3152	WMIC.exe
Token: SeSystemProfilePrivilege	3152	WMIC.exe
Token: SeSystemtimePrivilege	3152	WMIC.exe
Token: SeProfSingleProcessPrivilege	3152	WMIC.exe
Token: SeIncBasePriorityPrivilege	3152	WMIC.exe
Token: SeCreatePagefilePrivilege	3152	WMIC.exe
Token: SeBackupPrivilege	3152	WMIC.exe
Token: SeRestorePrivilege	3152	WMIC.exe
Token: SeShutdownPrivilege	3152	WMIC.exe
Token: SeDebugPrivilege	3152	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3152	WMIC.exe
Token: SeRemoteShutdownPrivilege	3152	WMIC.exe
Token: SeUndockPrivilege	3152	WMIC.exe
Token: SeManageVolumePrivilege	3152	WMIC.exe
Token: 33	3152	WMIC.exe
Token: 34	3152	WMIC.exe
Token: 35	3152	WMIC.exe
Token: 36	3152	WMIC.exe
Token: SeRestorePrivilege	1840	WerFault.exe
Token: SeBackupPrivilege	1840	WerFault.exe
Token: SeDebugPrivilege	1840	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\svchost.bin.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Drops file in Drivers directory
- System policy modification
- Suspicious behavior: EnumeratesProcesses
- Checks whether UAC is enabled
PID:2112

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc config "AppCheck" start=disabled
2⤵
- Suspicious use of WriteProcessMemory
PID:2672

C:\Windows\SysWOW64\sc.exe
sc config "AppCheck" start=disabled
3⤵
PID:3004

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
2⤵
- Suspicious use of WriteProcessMemory
PID:2856

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:2920

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3152

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 704
3⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Modify Registry

3

T1112

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

File Deletion

2

T1107

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-7-0x0000000004680000-0x0000000004681000-memory.dmp

Filesize
4KB

Download
memory/1840-15-0x0000000004870000-0x0000000004871000-memory.dmp

Filesize
4KB

Download
memory/1840-6-0x0000000004680000-0x0000000004681000-memory.dmp

Filesize
4KB

Download
memory/2672-0-0x0000000000000000-mapping.dmp

Download
memory/2856-1-0x0000000000000000-mapping.dmp

Download
memory/2920-4-0x0000000000000000-mapping.dmp

Download
memory/3004-3-0x0000000000000000-mapping.dmp

Download
memory/3152-5-0x0000000000000000-mapping.dmp

Download
memory/3532-9-0x0000000000000000-mapping.dmp

Download
memory/3532-11-0x0000000000000000-mapping.dmp

Download
memory/3532-10-0x0000000000000000-mapping.dmp

Download
memory/3532-12-0x0000000000000000-mapping.dmp

Download
memory/3532-13-0x0000000000000000-mapping.dmp

Download
memory/3532-14-0x0000000000000000-mapping.dmp

Download
memory/3532-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads