Overview

overview

10

Static

static

10

svchost.exe

windows7-x64

10

svchost.exe

windows10-2004-x64

10

Resubmissions

25/03/2025, 15:14

250325-smq3ns1qx2 10

05/02/2025, 10:17

250205-mbfjxatlhr 10

05/02/2025, 10:16

250205-ma5gmstlgq 10

21/12/2022, 10:49

221221-mwyafsfc8z 10

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    21/12/2022, 10:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    svchost.exe

  • Size

    500KB

  • MD5

    4dc8cae2cfff6ac862aea48b014937bb

  • SHA1

    80486ca4caa5cb4ce42885dcd66d7a1b4a27d5ce

  • SHA256

    ab0774b4ac9eb7e50c82abad03293ae39b668e81712b6ceb0d35ffe7e330881b

  • SHA512

    79eb56d858b21743ca565d22bb56cd3d8e4ecfdf462f03124672dca090c95ca51f8908f8dea22c3631dddba0a1a2bf443f41fdf8bf70e826335bcc56d0def47d

  • SSDEEP

    12288:YLrjOlAQS+OeO+OeNhBBhhBBYIeVZkD097u8HvaEs1Mm7Q:YLrjSGtVGD05u4yVMm

Score
10/10
mespinozaransomwarespywarestealer

Malware Config

Signatures

  • Mespinoza Ransomware 2 TTPs

    Also known as Pysa. Ransomware-as-a-servoce which first appeared in 2020.

    ransomwaremespinoza
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 27 IoCs
    adwarespyware
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    1⤵
    • Modifies extensions of user files
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1984
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\update.bat" "
      2⤵
      • Deletes itself
      PID:1104
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1380
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.bing.com/search?q=ProgramData&src=IE-SearchBox&FORM=IE11SR
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1612
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:480
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x548
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1808

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\update.bat
      Filesize

      225B

      MD5

      28818933fcf3ede3b45e0f5f36cf9629

      SHA1

      c522061c91847b9c32ef744f04ee9526bfbb694f

      SHA256

      7c3550b6fbf86eb37a37a5c79e66b9984a7ee1f74f6b16dddf8b53163f17e008

      SHA512

      3cbbc70359bf5d94524ae12db7213cac96f9bb745cc7dfec35b5d3b1d99365867862d9da7a4118d46fad2a920e5d956f76a767b06f10c92bd8a1a43cfa57ea04

      Download Submit

    • memory/1380-57-0x000007FEFB561000-0x000007FEFB563000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1984-54-0x0000000075441000-0x0000000075443000-memory.dmp

      Filesize

      8KB

      Download