Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-07-2022 06:59
Static task
static1
Behavioral task
behavioral1
Sample
svchost.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
svchost.exe
-
Size
421KB
-
MD5
cd53aaba4ef4f8f8b8334e376755e75b
-
SHA1
9bb985ee239f963cdcdf3910680a1564d0db6524
-
SHA256
b0480be94b4504dcbd0463cb69acc97609cdd49b1cead7a6c8b6843180815aff
-
SHA512
1ca4dd845e582f7e8af517ad094262a55fadbed2cc2c136050f04cb4220223c9b970cb6da6702362b24e5d2acfc262272486692cf29b2d90044f9c6564f32ff3
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 304 svchost.exe 304 svchost.exe 304 svchost.exe 304 svchost.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 304 svchost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 304 svchost.exe Token: 33 304 svchost.exe Token: SeIncBasePriorityPrivilege 304 svchost.exe Token: SeDebugPrivilege 1648 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe 1648 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 304 svchost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 304 wrote to memory of 1648 304 svchost.exe 27 PID 304 wrote to memory of 1648 304 svchost.exe 27 PID 304 wrote to memory of 1648 304 svchost.exe 27 PID 304 wrote to memory of 1648 304 svchost.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:304 -
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1648
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1976