Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:33
Static task
static1
Behavioral task
behavioral1
Sample
1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe
Resource
win10v2004-20220812-en
General
-
Target
1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe
-
Size
208KB
-
MD5
08b5f110dfe78ab368079f5410af0cb0
-
SHA1
a4a2295a484b7ea90100f596336df39c79f08c4f
-
SHA256
1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708
-
SHA512
fd56a4eedb32168112228eecef1f9cad3e65c7db5d9df4381cf6d2ae7dde18558a92c9b570ae0852182b687e1b739090048c9593f94a26e3c846a7c95be0241a
-
SSDEEP
1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yh:f0OtF2Qo7VsJgisxlYegEX0ZZbW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svhust.exesvhust.exesvhust.exepid process 1548 svhust.exe 1380 svhust.exe 824 svhust.exe -
Processes:
resource yara_rule behavioral1/memory/1272-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1272-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1272-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1272-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1272-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1272-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/824-94-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/824-98-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/824-100-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1272-106-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/824-107-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/824-108-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/824-110-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1380-111-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1380-113-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exepid process 1272 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe 1272 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe 1272 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe 1272 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.exesvhust.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svhust.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver = "C:\\Windows\\system32\\winldr.exe" svhust.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Drops file in System32 directory 2 IoCs
Processes:
svhust.exedescription ioc process File created C:\Windows\System32\winldr.exe svhust.exe File opened for modification C:\Windows\SysWOW64\winldr.exe svhust.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exesvhust.exedescription pid process target process PID 832 set thread context of 1272 832 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe PID 1548 set thread context of 1380 1548 svhust.exe svhust.exe PID 1548 set thread context of 824 1548 svhust.exe svhust.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svhust.exedescription pid process Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe Token: SeDebugPrivilege 1380 svhust.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svhust.exepid process 824 svhust.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exesvhust.exesvhust.exepid process 832 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe 1272 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe 1548 svhust.exe 1380 svhust.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.execmd.exesvhust.exedescription pid process target process PID 832 wrote to memory of 1272 832 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe PID 832 wrote to memory of 1272 832 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe PID 832 wrote to memory of 1272 832 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe PID 832 wrote to memory of 1272 832 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe PID 832 wrote to memory of 1272 832 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe PID 832 wrote to memory of 1272 832 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe PID 832 wrote to memory of 1272 832 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe PID 832 wrote to memory of 1272 832 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe PID 1272 wrote to memory of 452 1272 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe cmd.exe PID 1272 wrote to memory of 452 1272 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe cmd.exe PID 1272 wrote to memory of 452 1272 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe cmd.exe PID 1272 wrote to memory of 452 1272 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe cmd.exe PID 452 wrote to memory of 520 452 cmd.exe reg.exe PID 452 wrote to memory of 520 452 cmd.exe reg.exe PID 452 wrote to memory of 520 452 cmd.exe reg.exe PID 452 wrote to memory of 520 452 cmd.exe reg.exe PID 1272 wrote to memory of 1548 1272 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe svhust.exe PID 1272 wrote to memory of 1548 1272 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe svhust.exe PID 1272 wrote to memory of 1548 1272 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe svhust.exe PID 1272 wrote to memory of 1548 1272 1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe svhust.exe PID 1548 wrote to memory of 1380 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 1380 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 1380 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 1380 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 1380 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 1380 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 1380 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 1380 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 824 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 824 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 824 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 824 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 824 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 824 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 824 1548 svhust.exe svhust.exe PID 1548 wrote to memory of 824 1548 svhust.exe svhust.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe"C:\Users\Admin\AppData\Local\Temp\1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe"C:\Users\Admin\AppData\Local\Temp\1605f51117212803254cb241a68f37c2daf864950044db6bfdc12163c9013708.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RVHIF.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f4⤵
- Adds Run key to start application
PID:520 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1380 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:824
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RVHIF.batFilesize
141B
MD5e83a2e0b3c1e03dfb96ffd9924117a45
SHA127a3e4ba115ba1bad0bf094f5b97e768d1ece33e
SHA256655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13
SHA5125f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD508c55056edcae86552facdc1daa5d5fe
SHA1fca2cb53b9e232b9f133b37767d13ee5a34bc83c
SHA256d8132ba294cc866e5f36ea3a1f5bf1aff306d0edf238b8b33d64cea434b71b11
SHA512a0ac10c410206e74eb624a6fba9fc83cf279a1847f3303150c4d2e3713f5558a859acf98abd45a11fdc782824feda6985133b008b1550f313a10bbb006208bf0
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD508c55056edcae86552facdc1daa5d5fe
SHA1fca2cb53b9e232b9f133b37767d13ee5a34bc83c
SHA256d8132ba294cc866e5f36ea3a1f5bf1aff306d0edf238b8b33d64cea434b71b11
SHA512a0ac10c410206e74eb624a6fba9fc83cf279a1847f3303150c4d2e3713f5558a859acf98abd45a11fdc782824feda6985133b008b1550f313a10bbb006208bf0
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD508c55056edcae86552facdc1daa5d5fe
SHA1fca2cb53b9e232b9f133b37767d13ee5a34bc83c
SHA256d8132ba294cc866e5f36ea3a1f5bf1aff306d0edf238b8b33d64cea434b71b11
SHA512a0ac10c410206e74eb624a6fba9fc83cf279a1847f3303150c4d2e3713f5558a859acf98abd45a11fdc782824feda6985133b008b1550f313a10bbb006208bf0
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD508c55056edcae86552facdc1daa5d5fe
SHA1fca2cb53b9e232b9f133b37767d13ee5a34bc83c
SHA256d8132ba294cc866e5f36ea3a1f5bf1aff306d0edf238b8b33d64cea434b71b11
SHA512a0ac10c410206e74eb624a6fba9fc83cf279a1847f3303150c4d2e3713f5558a859acf98abd45a11fdc782824feda6985133b008b1550f313a10bbb006208bf0
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD508c55056edcae86552facdc1daa5d5fe
SHA1fca2cb53b9e232b9f133b37767d13ee5a34bc83c
SHA256d8132ba294cc866e5f36ea3a1f5bf1aff306d0edf238b8b33d64cea434b71b11
SHA512a0ac10c410206e74eb624a6fba9fc83cf279a1847f3303150c4d2e3713f5558a859acf98abd45a11fdc782824feda6985133b008b1550f313a10bbb006208bf0
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD508c55056edcae86552facdc1daa5d5fe
SHA1fca2cb53b9e232b9f133b37767d13ee5a34bc83c
SHA256d8132ba294cc866e5f36ea3a1f5bf1aff306d0edf238b8b33d64cea434b71b11
SHA512a0ac10c410206e74eb624a6fba9fc83cf279a1847f3303150c4d2e3713f5558a859acf98abd45a11fdc782824feda6985133b008b1550f313a10bbb006208bf0
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD508c55056edcae86552facdc1daa5d5fe
SHA1fca2cb53b9e232b9f133b37767d13ee5a34bc83c
SHA256d8132ba294cc866e5f36ea3a1f5bf1aff306d0edf238b8b33d64cea434b71b11
SHA512a0ac10c410206e74eb624a6fba9fc83cf279a1847f3303150c4d2e3713f5558a859acf98abd45a11fdc782824feda6985133b008b1550f313a10bbb006208bf0
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD508c55056edcae86552facdc1daa5d5fe
SHA1fca2cb53b9e232b9f133b37767d13ee5a34bc83c
SHA256d8132ba294cc866e5f36ea3a1f5bf1aff306d0edf238b8b33d64cea434b71b11
SHA512a0ac10c410206e74eb624a6fba9fc83cf279a1847f3303150c4d2e3713f5558a859acf98abd45a11fdc782824feda6985133b008b1550f313a10bbb006208bf0
-
memory/452-71-0x0000000000000000-mapping.dmp
-
memory/520-73-0x0000000000000000-mapping.dmp
-
memory/824-101-0x0000000000476940-mapping.dmp
-
memory/824-107-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/824-110-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/824-109-0x0000000074FB1000-0x0000000074FB3000-memory.dmpFilesize
8KB
-
memory/824-108-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/824-100-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/824-98-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/824-94-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/824-92-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/832-56-0x00000000004ED000-0x0000000000503000-memory.dmpFilesize
88KB
-
memory/1272-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1272-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1272-69-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1272-62-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1272-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1272-63-0x00000000004085D0-mapping.dmp
-
memory/1272-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1272-106-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1272-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1272-70-0x0000000076BA1000-0x0000000076BA3000-memory.dmpFilesize
8KB
-
memory/1380-90-0x00000000004085D0-mapping.dmp
-
memory/1380-111-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1380-113-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1548-78-0x0000000000000000-mapping.dmp
-
memory/1548-82-0x00000000004ED000-0x0000000000502000-memory.dmpFilesize
84KB