Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
9s -
max time network
16s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
24/08/2021, 06:08
Static task
static1
Behavioral task
behavioral1
Sample
scvhost.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
scvhost.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
scvhost.exe
-
Size
398KB
-
MD5
6d48770e0812501ee714453e729d4936
-
SHA1
b5852d71c699358a00ff3d6034fab1bddb396647
-
SHA256
cc9edc887142fc50112db7bad99afc39518c2e132413b1d0a548fc1f267ea628
-
SHA512
65e62eb4a5aff5792fd6cbf44ee1a3bd0fe36cb69ae341fa6c4fc45847c5623b9a7446c98ef775234bd43b39a15e3fe1c6af775158e7e2047261670292e7824f
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1696 scvhost.exe -
resource yara_rule behavioral1/files/0x00040000000130d4-63.dat upx behavioral1/files/0x00040000000130d4-64.dat upx behavioral1/files/0x00040000000130d4-67.dat upx behavioral1/files/0x00040000000130d4-66.dat upx behavioral1/files/0x00040000000130d4-65.dat upx behavioral1/files/0x00040000000130d4-69.dat upx -
Loads dropped DLL 4 IoCs
pid Process 1768 scvhost.exe 1768 scvhost.exe 1768 scvhost.exe 1768 scvhost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\scvhost.exe" scvhost.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\j: scvhost.exe File opened (read-only) \??\o: scvhost.exe File opened (read-only) \??\t: scvhost.exe File opened (read-only) \??\u: scvhost.exe File opened (read-only) \??\t: scvhost.exe File opened (read-only) \??\x: scvhost.exe File opened (read-only) \??\j: scvhost.exe File opened (read-only) \??\f: scvhost.exe File opened (read-only) \??\h: scvhost.exe File opened (read-only) \??\n: scvhost.exe File opened (read-only) \??\p: scvhost.exe File opened (read-only) \??\w: scvhost.exe File opened (read-only) \??\b: scvhost.exe File opened (read-only) \??\g: scvhost.exe File opened (read-only) \??\g: scvhost.exe File opened (read-only) \??\z: scvhost.exe File opened (read-only) \??\h: scvhost.exe File opened (read-only) \??\q: scvhost.exe File opened (read-only) \??\u: scvhost.exe File opened (read-only) \??\y: scvhost.exe File opened (read-only) \??\e: scvhost.exe File opened (read-only) \??\i: scvhost.exe File opened (read-only) \??\a: scvhost.exe File opened (read-only) \??\b: scvhost.exe File opened (read-only) \??\l: scvhost.exe File opened (read-only) \??\r: scvhost.exe File opened (read-only) \??\s: scvhost.exe File opened (read-only) \??\w: scvhost.exe File opened (read-only) \??\y: scvhost.exe File opened (read-only) \??\m: scvhost.exe File opened (read-only) \??\a: scvhost.exe File opened (read-only) \??\p: scvhost.exe File opened (read-only) \??\s: scvhost.exe File opened (read-only) \??\z: scvhost.exe File opened (read-only) \??\v: scvhost.exe File opened (read-only) \??\x: scvhost.exe File opened (read-only) \??\l: scvhost.exe File opened (read-only) \??\m: scvhost.exe File opened (read-only) \??\n: scvhost.exe File opened (read-only) \??\r: scvhost.exe File opened (read-only) \??\v: scvhost.exe File opened (read-only) \??\e: scvhost.exe File opened (read-only) \??\i: scvhost.exe File opened (read-only) \??\k: scvhost.exe File opened (read-only) \??\q: scvhost.exe File opened (read-only) \??\f: scvhost.exe File opened (read-only) \??\k: scvhost.exe File opened (read-only) \??\o: scvhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\scvhost.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1696 scvhost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1768 wrote to memory of 300 1768 scvhost.exe 28 PID 1768 wrote to memory of 300 1768 scvhost.exe 28 PID 1768 wrote to memory of 300 1768 scvhost.exe 28 PID 1768 wrote to memory of 300 1768 scvhost.exe 28 PID 1768 wrote to memory of 1696 1768 scvhost.exe 31 PID 1768 wrote to memory of 1696 1768 scvhost.exe 31 PID 1768 wrote to memory of 1696 1768 scvhost.exe 31 PID 1768 wrote to memory of 1696 1768 scvhost.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\scvhost.exe"C:\Users\Admin\AppData\Local\Temp\scvhost.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C echo. > "C:\Users\Admin\AppData\Roaming\scvhost.exe":Zone.Identifier2⤵
- NTFS ADS
PID:300
-
-
C:\Users\Admin\AppData\Roaming\scvhost.exe"C:\Users\Admin\AppData\Roaming\scvhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:1696
-