Overview

overview

10

Static

static

svchOst.exe

windows7_x64

10

svchOst.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    18-06-2022 17:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    svchOst.exe

  • Size

    178KB

  • MD5

    b21a2b18631fc2d5493eb53807075380

  • SHA1

    1c1c7cf048ae795cf6f29351c719772f4c1fb425

  • SHA256

    e49fd2651d5f3d5ffd999104841edd3e6e6dbd342507df6d2201720bdca65a74

  • SHA512

    ca8d5141db157d5691998dd99b7bba882e227c2cf03c99aba71587644ca749a40fcf7f27cfe555253dad61921d7e3a27c3562119b0fc7913c129a04a043ad660

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

C:\!!!WARNING !!!WARNING !!!WARNING HOW TO RECOVER ALL ENCRYPTED FILES.txt

Ransom Note
!!! GREETINGS i-mod.me all other employees !!! What happened ? We are a team of Certified network security experts, after accessing your networks for more than 3 weeks, We hacked almost All your network , All Computers, Servers were hacked due to weak security We Accessed All your Accounts and downloaded all google drive files, gmail contacts , passwords etc Your files, databases, documents .etc , where DOWNLOADED and stored on our private servers We Downloaded 900GB+ of Files, Backups, Databases,IMS, Contract Documents, Property Documents We Locked or Encrypted All files,databases,backups on your computer network What Do You Want ? TO US GETTING MONEY MATTERS && OUR REPUTATION You must pay us to restore your network and all files,databases,documents ... You have Five(5) days to pay or price increases WE DON'T ASK MUCH MONEY How can we contact YOU ? write to this email : filedecryptionsupport@msgsafe.io write on telegram : @decryptionsupport Why did you choose to encrypt our machines instead ? To proof we hacked your networks and we are still in To show the risks && side effects of unsecured network What happens when You pay us ? We Provide you with decryption software to unlock or decrypt all your files on network,servers and computers We remove all malwares virus from your network We Delete All files we downloaded to our servers We provide tips on how to protect your network from another hack What if We Don't Pay You ? We downloaded all your Data, Files, Databases,Credentials,Backups we will publish , leak them on telegram channels ,discord servers, twitter ...etc Everyone on the internet can download for free What if After payment you don't provide help? This is our business. We honour our reputation For Guarantee of successful decryption of all files on computers, servers .. We offer free decryption for not more than 3 encrypted files before we take PAYMENT We will not PAY people like You, We will restore from offline backups ? We will sell all the data we downloaded to get our money We will publish All Files, Documents, database , Credentials for free on the internet ; telegram channels ,discord servers, twitter ...etc Data we downloaded includes IF YOU WANT PROOF OF ALL DOWNLOADED FILES, DATABASES , Documents ... contact us !!! BEWARE !!! DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! - Don't try because you will damage all the files Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.
Emails

filedecryptionsupport@msgsafe.io

Signatures

  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\svchOst.exe
    "C:\Users\Admin\AppData\Local\Temp\svchOst.exe"
    1⤵
    • Modifies extensions of user files
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:788
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7AD057C6-01E7-41BE-8363-DFAD0D4032B1}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1760
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7AD057C6-01E7-41BE-8363-DFAD0D4032B1}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2200
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4292
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\!!!WARNING !!!WARNING !!!WARNING HOW TO RECOVER ALL ENCRYPTED FILES.txt
    1⤵
      PID:736

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Desktop\!!!WARNING !!!WARNING !!!WARNING HOW TO RECOVER ALL ENCRYPTED FILES.txt
      Filesize

      2KB

      MD5

      3949600f0366c164183a14a99429e10d

      SHA1

      2d99d7027b87e990d710b146ed70d8520a78f39c

      SHA256

      e1e9a7ebc9575cf6e0f61dda50e0d2f5b7ba851a8f9c05e491e731b0a53aea46

      SHA512

      dc36c0e386ff0c07a2851efa2677db6b6e6ec231d9b6613495ad423cf18dc0c5c21daa2378eeaf0718755964486e8fc268e8fb721be74a24a1d5eadae72ddde2

      Download Submit
    • memory/1760-130-0x0000000000000000-mapping.dmp
      Download
    • memory/2200-131-0x0000000000000000-mapping.dmp
      Download