Analysis
-
max time kernel
205s -
max time network
91s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:33
Static task
static1
Behavioral task
behavioral1
Sample
530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe
Resource
win10v2004-20220812-en
General
-
Target
530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe
-
Size
208KB
-
MD5
10081c32379bf2ecf19bcdadced9a4c0
-
SHA1
e98f00551b19ec2b9224bee5b979092892eaf012
-
SHA256
530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef
-
SHA512
893db1e260aa66bb002301a5464de9a818cd88358860e308d5257b435121e591edc4262ee2f62a1cf45f608435db000a4cf3b734eca87a45fe2a6dbdf19f1d50
-
SSDEEP
1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yh:f0OtF2Qo7VsJgisxlYegEX0ZZbW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svhust.exesvhust.exesvhust.exepid process 1812 svhust.exe 816 svhust.exe 1640 svhust.exe -
Processes:
resource yara_rule behavioral1/memory/276-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/276-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/276-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/276-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/276-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/276-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1640-98-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1640-95-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1640-99-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/276-102-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1640-107-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1640-108-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1640-110-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/816-112-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exepid process 276 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe 276 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe 276 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe 276 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.exesvhust.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svhust.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver = "C:\\Windows\\system32\\winldr.exe" svhust.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Drops file in System32 directory 2 IoCs
Processes:
svhust.exedescription ioc process File created C:\Windows\System32\winldr.exe svhust.exe File opened for modification C:\Windows\SysWOW64\winldr.exe svhust.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exesvhust.exedescription pid process target process PID 1452 set thread context of 276 1452 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe PID 1812 set thread context of 816 1812 svhust.exe svhust.exe PID 1812 set thread context of 1640 1812 svhust.exe svhust.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svhust.exedescription pid process Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe Token: SeDebugPrivilege 816 svhust.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svhust.exepid process 1640 svhust.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exesvhust.exesvhust.exepid process 1452 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe 276 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe 1812 svhust.exe 816 svhust.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.execmd.exesvhust.exedescription pid process target process PID 1452 wrote to memory of 276 1452 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe PID 1452 wrote to memory of 276 1452 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe PID 1452 wrote to memory of 276 1452 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe PID 1452 wrote to memory of 276 1452 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe PID 1452 wrote to memory of 276 1452 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe PID 1452 wrote to memory of 276 1452 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe PID 1452 wrote to memory of 276 1452 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe PID 1452 wrote to memory of 276 1452 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe PID 276 wrote to memory of 1772 276 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe cmd.exe PID 276 wrote to memory of 1772 276 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe cmd.exe PID 276 wrote to memory of 1772 276 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe cmd.exe PID 276 wrote to memory of 1772 276 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe cmd.exe PID 1772 wrote to memory of 1684 1772 cmd.exe reg.exe PID 1772 wrote to memory of 1684 1772 cmd.exe reg.exe PID 1772 wrote to memory of 1684 1772 cmd.exe reg.exe PID 1772 wrote to memory of 1684 1772 cmd.exe reg.exe PID 276 wrote to memory of 1812 276 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe svhust.exe PID 276 wrote to memory of 1812 276 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe svhust.exe PID 276 wrote to memory of 1812 276 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe svhust.exe PID 276 wrote to memory of 1812 276 530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe svhust.exe PID 1812 wrote to memory of 816 1812 svhust.exe svhust.exe PID 1812 wrote to memory of 816 1812 svhust.exe svhust.exe PID 1812 wrote to memory of 816 1812 svhust.exe svhust.exe PID 1812 wrote to memory of 816 1812 svhust.exe svhust.exe PID 1812 wrote to memory of 816 1812 svhust.exe svhust.exe PID 1812 wrote to memory of 816 1812 svhust.exe svhust.exe PID 1812 wrote to memory of 816 1812 svhust.exe svhust.exe PID 1812 wrote to memory of 816 1812 svhust.exe svhust.exe PID 1812 wrote to memory of 1640 1812 svhust.exe svhust.exe PID 1812 wrote to memory of 1640 1812 svhust.exe svhust.exe PID 1812 wrote to memory of 1640 1812 svhust.exe svhust.exe PID 1812 wrote to memory of 1640 1812 svhust.exe svhust.exe PID 1812 wrote to memory of 1640 1812 svhust.exe svhust.exe PID 1812 wrote to memory of 1640 1812 svhust.exe svhust.exe PID 1812 wrote to memory of 1640 1812 svhust.exe svhust.exe PID 1812 wrote to memory of 1640 1812 svhust.exe svhust.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe"C:\Users\Admin\AppData\Local\Temp\530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe"C:\Users\Admin\AppData\Local\Temp\530b9dcf381d80eadf10753518aea6b74d6731643267807cf43850a47fadd4ef.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\VUYLB.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f4⤵
- Adds Run key to start application
PID:1684 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:816 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:1640
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\VUYLB.batFilesize
141B
MD5e83a2e0b3c1e03dfb96ffd9924117a45
SHA127a3e4ba115ba1bad0bf094f5b97e768d1ece33e
SHA256655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13
SHA5125f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51f98782cabc5527620493743aad149df
SHA131beb852fc6d9a3f8cb373c76a672f5a1e28ab8a
SHA256f06bb378072161091b1b64c909244038abfce7deede82db2615deab17ee6e26c
SHA5125bec413901c037c9f91a8b43bd0ee49fab6561323a543fb619694ba50f401fbf0eaf589fa3abe431225ca1854941cdaa239ba22482859ef0e0051828ea5cb4bc
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51f98782cabc5527620493743aad149df
SHA131beb852fc6d9a3f8cb373c76a672f5a1e28ab8a
SHA256f06bb378072161091b1b64c909244038abfce7deede82db2615deab17ee6e26c
SHA5125bec413901c037c9f91a8b43bd0ee49fab6561323a543fb619694ba50f401fbf0eaf589fa3abe431225ca1854941cdaa239ba22482859ef0e0051828ea5cb4bc
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51f98782cabc5527620493743aad149df
SHA131beb852fc6d9a3f8cb373c76a672f5a1e28ab8a
SHA256f06bb378072161091b1b64c909244038abfce7deede82db2615deab17ee6e26c
SHA5125bec413901c037c9f91a8b43bd0ee49fab6561323a543fb619694ba50f401fbf0eaf589fa3abe431225ca1854941cdaa239ba22482859ef0e0051828ea5cb4bc
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51f98782cabc5527620493743aad149df
SHA131beb852fc6d9a3f8cb373c76a672f5a1e28ab8a
SHA256f06bb378072161091b1b64c909244038abfce7deede82db2615deab17ee6e26c
SHA5125bec413901c037c9f91a8b43bd0ee49fab6561323a543fb619694ba50f401fbf0eaf589fa3abe431225ca1854941cdaa239ba22482859ef0e0051828ea5cb4bc
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51f98782cabc5527620493743aad149df
SHA131beb852fc6d9a3f8cb373c76a672f5a1e28ab8a
SHA256f06bb378072161091b1b64c909244038abfce7deede82db2615deab17ee6e26c
SHA5125bec413901c037c9f91a8b43bd0ee49fab6561323a543fb619694ba50f401fbf0eaf589fa3abe431225ca1854941cdaa239ba22482859ef0e0051828ea5cb4bc
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51f98782cabc5527620493743aad149df
SHA131beb852fc6d9a3f8cb373c76a672f5a1e28ab8a
SHA256f06bb378072161091b1b64c909244038abfce7deede82db2615deab17ee6e26c
SHA5125bec413901c037c9f91a8b43bd0ee49fab6561323a543fb619694ba50f401fbf0eaf589fa3abe431225ca1854941cdaa239ba22482859ef0e0051828ea5cb4bc
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51f98782cabc5527620493743aad149df
SHA131beb852fc6d9a3f8cb373c76a672f5a1e28ab8a
SHA256f06bb378072161091b1b64c909244038abfce7deede82db2615deab17ee6e26c
SHA5125bec413901c037c9f91a8b43bd0ee49fab6561323a543fb619694ba50f401fbf0eaf589fa3abe431225ca1854941cdaa239ba22482859ef0e0051828ea5cb4bc
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD51f98782cabc5527620493743aad149df
SHA131beb852fc6d9a3f8cb373c76a672f5a1e28ab8a
SHA256f06bb378072161091b1b64c909244038abfce7deede82db2615deab17ee6e26c
SHA5125bec413901c037c9f91a8b43bd0ee49fab6561323a543fb619694ba50f401fbf0eaf589fa3abe431225ca1854941cdaa239ba22482859ef0e0051828ea5cb4bc
-
memory/276-69-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/276-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/276-70-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/276-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/276-102-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/276-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/276-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/276-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/276-63-0x00000000004085D0-mapping.dmp
-
memory/276-62-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/816-112-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/816-90-0x00000000004085D0-mapping.dmp
-
memory/1452-56-0x00000000008DD000-0x00000000008F3000-memory.dmpFilesize
88KB
-
memory/1640-98-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1640-95-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1640-93-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1640-99-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1640-100-0x0000000000476940-mapping.dmp
-
memory/1640-107-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1640-108-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1640-109-0x0000000074DB1000-0x0000000074DB3000-memory.dmpFilesize
8KB
-
memory/1640-110-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1684-73-0x0000000000000000-mapping.dmp
-
memory/1772-71-0x0000000000000000-mapping.dmp
-
memory/1812-82-0x00000000005BD000-0x00000000005D2000-memory.dmpFilesize
84KB
-
memory/1812-78-0x0000000000000000-mapping.dmp