Analysis
-
max time kernel
82s -
max time network
100s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:33
Static task
static1
Behavioral task
behavioral1
Sample
4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe
Resource
win10v2004-20221111-en
General
-
Target
4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe
-
Size
208KB
-
MD5
a24f2fe2cacb342a641056898e5966d0
-
SHA1
764d4b31a2c0f7ea7075534356a3ee0163e1871b
-
SHA256
4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce
-
SHA512
b9de43a39cee3c83090f4c821b7fcfee22a8f5cdefb43e072d679cfdadb8bc1f6315e3cc2a3a712dd223c4a86f50b28127e728c654c040da959e66bb0ff6dab4
-
SSDEEP
1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yh:f0OtF2Qo7VsJgisxlYegEX0ZZbW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svhust.exesvhust.exesvhust.exepid process 1156 svhust.exe 1800 svhust.exe 1992 svhust.exe -
Processes:
resource yara_rule behavioral1/memory/1068-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1068-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1068-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1068-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1068-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1068-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1992-94-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1992-98-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1992-99-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1068-105-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1992-107-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1992-108-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1992-110-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/1800-111-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exepid process 1068 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe 1068 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe 1068 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe 1068 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.exesvhust.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhust = "C:\\Users\\Admin\\AppData\\Roaming\\svhust\\svhust.exe" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svhust.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver = "C:\\Windows\\system32\\winldr.exe" svhust.exe -
Drops file in System32 directory 2 IoCs
Processes:
svhust.exedescription ioc process File created C:\Windows\System32\winldr.exe svhust.exe File opened for modification C:\Windows\SysWOW64\winldr.exe svhust.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exesvhust.exedescription pid process target process PID 976 set thread context of 1068 976 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe PID 1156 set thread context of 1800 1156 svhust.exe svhust.exe PID 1156 set thread context of 1992 1156 svhust.exe svhust.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svhust.exepid process 1992 svhust.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exesvhust.exesvhust.exepid process 976 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe 1068 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe 1156 svhust.exe 1800 svhust.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.execmd.exesvhust.exedescription pid process target process PID 976 wrote to memory of 1068 976 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe PID 976 wrote to memory of 1068 976 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe PID 976 wrote to memory of 1068 976 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe PID 976 wrote to memory of 1068 976 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe PID 976 wrote to memory of 1068 976 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe PID 976 wrote to memory of 1068 976 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe PID 976 wrote to memory of 1068 976 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe PID 976 wrote to memory of 1068 976 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe PID 1068 wrote to memory of 1876 1068 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe cmd.exe PID 1068 wrote to memory of 1876 1068 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe cmd.exe PID 1068 wrote to memory of 1876 1068 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe cmd.exe PID 1068 wrote to memory of 1876 1068 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe cmd.exe PID 1876 wrote to memory of 512 1876 cmd.exe reg.exe PID 1876 wrote to memory of 512 1876 cmd.exe reg.exe PID 1876 wrote to memory of 512 1876 cmd.exe reg.exe PID 1876 wrote to memory of 512 1876 cmd.exe reg.exe PID 1068 wrote to memory of 1156 1068 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe svhust.exe PID 1068 wrote to memory of 1156 1068 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe svhust.exe PID 1068 wrote to memory of 1156 1068 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe svhust.exe PID 1068 wrote to memory of 1156 1068 4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe svhust.exe PID 1156 wrote to memory of 1800 1156 svhust.exe svhust.exe PID 1156 wrote to memory of 1800 1156 svhust.exe svhust.exe PID 1156 wrote to memory of 1800 1156 svhust.exe svhust.exe PID 1156 wrote to memory of 1800 1156 svhust.exe svhust.exe PID 1156 wrote to memory of 1800 1156 svhust.exe svhust.exe PID 1156 wrote to memory of 1800 1156 svhust.exe svhust.exe PID 1156 wrote to memory of 1800 1156 svhust.exe svhust.exe PID 1156 wrote to memory of 1800 1156 svhust.exe svhust.exe PID 1156 wrote to memory of 1992 1156 svhust.exe svhust.exe PID 1156 wrote to memory of 1992 1156 svhust.exe svhust.exe PID 1156 wrote to memory of 1992 1156 svhust.exe svhust.exe PID 1156 wrote to memory of 1992 1156 svhust.exe svhust.exe PID 1156 wrote to memory of 1992 1156 svhust.exe svhust.exe PID 1156 wrote to memory of 1992 1156 svhust.exe svhust.exe PID 1156 wrote to memory of 1992 1156 svhust.exe svhust.exe PID 1156 wrote to memory of 1992 1156 svhust.exe svhust.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe"C:\Users\Admin\AppData\Local\Temp\4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe"C:\Users\Admin\AppData\Local\Temp\4a64e5213a53734c0eac02e4335729c473c77a983d1ff5cc718dedb380c6e6ce.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\GYXTV.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f4⤵
- Adds Run key to start application
PID:512 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1800 -
C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:1992
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GYXTV.batFilesize
141B
MD5e83a2e0b3c1e03dfb96ffd9924117a45
SHA127a3e4ba115ba1bad0bf094f5b97e768d1ece33e
SHA256655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13
SHA5125f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5e8a6f42cee37f9407d32830f29f8172b
SHA1b95b5a06d49224900c304e588ab374c65e822adb
SHA2567e378f5c31e7ef3a7c75b15a24b0e8ed28255e9f4dff61db585bf1151f0d87aa
SHA512b25f7ceb1213c2046b97a50bb8328a6abfe8c9c30aa79cd395d93a6c8a011a0711796ba208b304cab3af420a196cff9693a1ebbb6f4dae2e6bc0677fa07b79d9
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5e8a6f42cee37f9407d32830f29f8172b
SHA1b95b5a06d49224900c304e588ab374c65e822adb
SHA2567e378f5c31e7ef3a7c75b15a24b0e8ed28255e9f4dff61db585bf1151f0d87aa
SHA512b25f7ceb1213c2046b97a50bb8328a6abfe8c9c30aa79cd395d93a6c8a011a0711796ba208b304cab3af420a196cff9693a1ebbb6f4dae2e6bc0677fa07b79d9
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5e8a6f42cee37f9407d32830f29f8172b
SHA1b95b5a06d49224900c304e588ab374c65e822adb
SHA2567e378f5c31e7ef3a7c75b15a24b0e8ed28255e9f4dff61db585bf1151f0d87aa
SHA512b25f7ceb1213c2046b97a50bb8328a6abfe8c9c30aa79cd395d93a6c8a011a0711796ba208b304cab3af420a196cff9693a1ebbb6f4dae2e6bc0677fa07b79d9
-
C:\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5e8a6f42cee37f9407d32830f29f8172b
SHA1b95b5a06d49224900c304e588ab374c65e822adb
SHA2567e378f5c31e7ef3a7c75b15a24b0e8ed28255e9f4dff61db585bf1151f0d87aa
SHA512b25f7ceb1213c2046b97a50bb8328a6abfe8c9c30aa79cd395d93a6c8a011a0711796ba208b304cab3af420a196cff9693a1ebbb6f4dae2e6bc0677fa07b79d9
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5e8a6f42cee37f9407d32830f29f8172b
SHA1b95b5a06d49224900c304e588ab374c65e822adb
SHA2567e378f5c31e7ef3a7c75b15a24b0e8ed28255e9f4dff61db585bf1151f0d87aa
SHA512b25f7ceb1213c2046b97a50bb8328a6abfe8c9c30aa79cd395d93a6c8a011a0711796ba208b304cab3af420a196cff9693a1ebbb6f4dae2e6bc0677fa07b79d9
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5e8a6f42cee37f9407d32830f29f8172b
SHA1b95b5a06d49224900c304e588ab374c65e822adb
SHA2567e378f5c31e7ef3a7c75b15a24b0e8ed28255e9f4dff61db585bf1151f0d87aa
SHA512b25f7ceb1213c2046b97a50bb8328a6abfe8c9c30aa79cd395d93a6c8a011a0711796ba208b304cab3af420a196cff9693a1ebbb6f4dae2e6bc0677fa07b79d9
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5e8a6f42cee37f9407d32830f29f8172b
SHA1b95b5a06d49224900c304e588ab374c65e822adb
SHA2567e378f5c31e7ef3a7c75b15a24b0e8ed28255e9f4dff61db585bf1151f0d87aa
SHA512b25f7ceb1213c2046b97a50bb8328a6abfe8c9c30aa79cd395d93a6c8a011a0711796ba208b304cab3af420a196cff9693a1ebbb6f4dae2e6bc0677fa07b79d9
-
\Users\Admin\AppData\Roaming\svhust\svhust.exeFilesize
208KB
MD5e8a6f42cee37f9407d32830f29f8172b
SHA1b95b5a06d49224900c304e588ab374c65e822adb
SHA2567e378f5c31e7ef3a7c75b15a24b0e8ed28255e9f4dff61db585bf1151f0d87aa
SHA512b25f7ceb1213c2046b97a50bb8328a6abfe8c9c30aa79cd395d93a6c8a011a0711796ba208b304cab3af420a196cff9693a1ebbb6f4dae2e6bc0677fa07b79d9
-
memory/512-73-0x0000000000000000-mapping.dmp
-
memory/976-56-0x000000000051D000-0x0000000000533000-memory.dmpFilesize
88KB
-
memory/1068-69-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1068-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1068-70-0x0000000075761000-0x0000000075763000-memory.dmpFilesize
8KB
-
memory/1068-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1068-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1068-63-0x00000000004085D0-mapping.dmp
-
memory/1068-105-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1068-62-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1068-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1068-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1156-78-0x0000000000000000-mapping.dmp
-
memory/1156-82-0x00000000005DD000-0x00000000005F2000-memory.dmpFilesize
84KB
-
memory/1800-111-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1800-90-0x00000000004085D0-mapping.dmp
-
memory/1876-71-0x0000000000000000-mapping.dmp
-
memory/1992-98-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1992-100-0x0000000000476940-mapping.dmp
-
memory/1992-99-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1992-92-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1992-107-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1992-108-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1992-109-0x0000000074AD1000-0x0000000074AD3000-memory.dmpFilesize
8KB
-
memory/1992-110-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1992-94-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB