Analysis
-
max time kernel
150s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 07:20
Static task
static1
Behavioral task
behavioral1
Sample
a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe
Resource
win10v2004-20221111-en
General
-
Target
a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe
-
Size
1.1MB
-
MD5
df3eb70752175bd0f8391f9524874fa4
-
SHA1
0006c5e7d2681a7d8fd5e3bafc7be27bd6a9b5f9
-
SHA256
a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e
-
SHA512
2feac4e3451c5bf6661d4d9a47827e66ef4de9781649667af2895059f29076304f684b6624ac73190ff90bf959d033cd57e3d45749ee8e3486f1391c04bbcebc
-
SSDEEP
24576:xf9I2Wjiv0j/yaMctr1SdWHJXLr1TO+qoDJd46:xFNWjiceCrkkpXP1fqWZ
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
mvchost.exemvchost.exepid process 1724 mvchost.exe 988 mvchost.exe -
Loads dropped DLL 2 IoCs
Processes:
a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exepid process 1640 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe 1640 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
mvchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\CNS = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\mvchost.exe" mvchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs
Processes:
a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exemvchost.exepid process 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe 1724 mvchost.exe 1724 mvchost.exe 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe 1724 mvchost.exe 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe 1724 mvchost.exe 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe 1724 mvchost.exe 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe 1724 mvchost.exe 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe 1724 mvchost.exe 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe 1724 mvchost.exe 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe 1724 mvchost.exe 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exemvchost.exedescription pid process target process PID 1808 set thread context of 1640 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe PID 1724 set thread context of 988 1724 mvchost.exe mvchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
mvchost.exedescription pid process Token: SeDebugPrivilege 988 mvchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exemvchost.exepid process 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe 1724 mvchost.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exea378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exemvchost.exedescription pid process target process PID 1808 wrote to memory of 760 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe splwow64.exe PID 1808 wrote to memory of 760 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe splwow64.exe PID 1808 wrote to memory of 760 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe splwow64.exe PID 1808 wrote to memory of 760 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe splwow64.exe PID 1808 wrote to memory of 1640 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe PID 1808 wrote to memory of 1640 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe PID 1808 wrote to memory of 1640 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe PID 1808 wrote to memory of 1640 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe PID 1808 wrote to memory of 1640 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe PID 1808 wrote to memory of 1640 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe PID 1808 wrote to memory of 1640 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe PID 1808 wrote to memory of 1640 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe PID 1808 wrote to memory of 1640 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe PID 1808 wrote to memory of 1640 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe PID 1808 wrote to memory of 1640 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe PID 1808 wrote to memory of 1640 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe PID 1808 wrote to memory of 1640 1808 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe PID 1640 wrote to memory of 1724 1640 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe mvchost.exe PID 1640 wrote to memory of 1724 1640 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe mvchost.exe PID 1640 wrote to memory of 1724 1640 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe mvchost.exe PID 1640 wrote to memory of 1724 1640 a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe mvchost.exe PID 1724 wrote to memory of 988 1724 mvchost.exe mvchost.exe PID 1724 wrote to memory of 988 1724 mvchost.exe mvchost.exe PID 1724 wrote to memory of 988 1724 mvchost.exe mvchost.exe PID 1724 wrote to memory of 988 1724 mvchost.exe mvchost.exe PID 1724 wrote to memory of 988 1724 mvchost.exe mvchost.exe PID 1724 wrote to memory of 988 1724 mvchost.exe mvchost.exe PID 1724 wrote to memory of 988 1724 mvchost.exe mvchost.exe PID 1724 wrote to memory of 988 1724 mvchost.exe mvchost.exe PID 1724 wrote to memory of 988 1724 mvchost.exe mvchost.exe PID 1724 wrote to memory of 988 1724 mvchost.exe mvchost.exe PID 1724 wrote to memory of 988 1724 mvchost.exe mvchost.exe PID 1724 wrote to memory of 988 1724 mvchost.exe mvchost.exe PID 1724 wrote to memory of 988 1724 mvchost.exe mvchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe"C:\Users\Admin\AppData\Local\Temp\a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exeC:\Users\Admin\AppData\Local\Temp\a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\mvchost.exe"C:\Users\Admin\AppData\Local\Microsoft\mvchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\mvchost.exeC:\Users\Admin\AppData\Local\Microsoft\mvchost.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\mvchost.exeFilesize
1.1MB
MD5df3eb70752175bd0f8391f9524874fa4
SHA10006c5e7d2681a7d8fd5e3bafc7be27bd6a9b5f9
SHA256a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e
SHA5122feac4e3451c5bf6661d4d9a47827e66ef4de9781649667af2895059f29076304f684b6624ac73190ff90bf959d033cd57e3d45749ee8e3486f1391c04bbcebc
-
C:\Users\Admin\AppData\Local\Microsoft\mvchost.exeFilesize
1.1MB
MD5df3eb70752175bd0f8391f9524874fa4
SHA10006c5e7d2681a7d8fd5e3bafc7be27bd6a9b5f9
SHA256a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e
SHA5122feac4e3451c5bf6661d4d9a47827e66ef4de9781649667af2895059f29076304f684b6624ac73190ff90bf959d033cd57e3d45749ee8e3486f1391c04bbcebc
-
C:\Users\Admin\AppData\Local\Microsoft\mvchost.exeFilesize
1.1MB
MD5df3eb70752175bd0f8391f9524874fa4
SHA10006c5e7d2681a7d8fd5e3bafc7be27bd6a9b5f9
SHA256a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e
SHA5122feac4e3451c5bf6661d4d9a47827e66ef4de9781649667af2895059f29076304f684b6624ac73190ff90bf959d033cd57e3d45749ee8e3486f1391c04bbcebc
-
\Users\Admin\AppData\Local\Microsoft\mvchost.exeFilesize
1.1MB
MD5df3eb70752175bd0f8391f9524874fa4
SHA10006c5e7d2681a7d8fd5e3bafc7be27bd6a9b5f9
SHA256a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e
SHA5122feac4e3451c5bf6661d4d9a47827e66ef4de9781649667af2895059f29076304f684b6624ac73190ff90bf959d033cd57e3d45749ee8e3486f1391c04bbcebc
-
\Users\Admin\AppData\Local\Microsoft\mvchost.exeFilesize
1.1MB
MD5df3eb70752175bd0f8391f9524874fa4
SHA10006c5e7d2681a7d8fd5e3bafc7be27bd6a9b5f9
SHA256a378103c8f8f3766e1976a46e70d4c7f5c514fa08e04ae003b670c6bc1e59a0e
SHA5122feac4e3451c5bf6661d4d9a47827e66ef4de9781649667af2895059f29076304f684b6624ac73190ff90bf959d033cd57e3d45749ee8e3486f1391c04bbcebc
-
memory/760-58-0x0000000000000000-mapping.dmp
-
memory/760-59-0x000007FEFC001000-0x000007FEFC003000-memory.dmpFilesize
8KB
-
memory/988-119-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/988-115-0x000000000041C288-mapping.dmp
-
memory/1640-63-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1640-60-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1640-71-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1640-74-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1640-77-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1640-80-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1640-82-0x000000000041C288-mapping.dmp
-
memory/1640-83-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1640-85-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1640-61-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1640-67-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1640-65-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1724-88-0x0000000000000000-mapping.dmp
-
memory/1724-120-0x0000000000400000-0x00000000008B7000-memory.dmpFilesize
4.7MB
-
memory/1724-123-0x0000000000400000-0x00000000008B7000-memory.dmpFilesize
4.7MB
-
memory/1808-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmpFilesize
8KB
-
memory/1808-57-0x0000000000400000-0x00000000008B7000-memory.dmpFilesize
4.7MB
-
memory/1808-56-0x0000000000400000-0x00000000008B7000-memory.dmpFilesize
4.7MB
-
memory/1808-55-0x0000000000400000-0x00000000008B7000-memory.dmpFilesize
4.7MB
-
memory/1808-121-0x0000000000400000-0x00000000008B7000-memory.dmpFilesize
4.7MB
-
memory/1808-122-0x0000000003F00000-0x00000000043B7000-memory.dmpFilesize
4.7MB