Analysis
-
max time kernel
155s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
18-04-2023 12:53
Static task
static1
Behavioral task
behavioral1
Sample
svcservice.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral2
Sample
svcservice.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
General
-
Target
svcservice.exe
-
Size
1023.8MB
-
MD5
9112d21551cffc1149f0e11d44afbec0
-
SHA1
cd1751ed7525adafdbcf44e6cc1dd0dad1b760c8
-
SHA256
723710eaf3beac67ea9191491824d50bd3398951341cea790aabef634a412871
-
SHA512
2983e1a653a81b711d2bfe68897934efdd07ca1d02adfe18a903d7cde18af522a03b17f2db273938ef6cc6872bd40950f498d6e60dfef2f522b01d6195d431d6
-
SSDEEP
3145728:m33333333333333333333333333333333333333333333333333333333333333y:P
Malware Config
Extracted
laplas
http://nerf-0150-unknown.guru
-
api_key
afc950a4a18fd71c9d7be4c460e4cb77d0bcf29a49d097e4e739c17c332c3a34
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1020 svcservice.exe -
Loads dropped DLL 1 IoCs
pid Process 668 svcservice.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe" svcservice.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 684 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 684 taskmgr.exe Token: SeSecurityPrivilege 684 taskmgr.exe Token: SeTakeOwnershipPrivilege 684 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe 684 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 668 wrote to memory of 1020 668 svcservice.exe 30 PID 668 wrote to memory of 1020 668 svcservice.exe 30 PID 668 wrote to memory of 1020 668 svcservice.exe 30 PID 668 wrote to memory of 1020 668 svcservice.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\svcservice.exe"C:\Users\Admin\AppData\Local\Temp\svcservice.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"2⤵
- Executes dropped EXE
PID:1020
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:684
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
506.9MB
MD5cdd42a5f92d7026cb1aeb36dbfe84c11
SHA1e55c588d721ce594a332aceb59f9f0dd01328b67
SHA256e538e65524ea4dbbbb1023d9badfaaf09c3439afd63d733dfad9694965e34b62
SHA512b8f774ea59c4bc96085c35c9562d0b8032d4d0e8836bbe4a8dd56e856ff5758588d1b20f570289eec2a094fba81628aea60855c03736adfe65aaa8309cb8020d
-
Filesize
478.7MB
MD528f785e55e10a1c3f5906876a16ea59b
SHA17cb1299bbb00652b30cca07a10987b553fa5d669
SHA25690e1c89e2a8f181a4df6a349c50387eb1b4eb0b097761a5e34b351a4554f109d
SHA5129da839564580dea4c34c422914c5eed090a21366eb1f7c93971dafac1a801756f039dee03ea1b1fa63374e0869a6b4b355be7b6bf8395d5164f50aa8e845ed3f
-
Filesize
498.2MB
MD55753973b050d7dd3424c868309d69516
SHA1237f0324a5a043d9ce41f11ef53c7b00a02e16c2
SHA2564dc92e51157bbc5633f4698f607c369056b6f5165eeca6f404082f8447d9b919
SHA5126f011b703dad9351eb2a90dcc77e4b6758dd1d03f160ffb596670b9594400a34e224a246d737220ecc1de4a1991eaedc752b954356347200ec8cce1285cb795f