Overview

overview

8

Static

static

3

svchost_du...py.exe

windows7-x64

8

svchost_du...py.exe

windows10-1703-x64

8

svchost_du...py.exe

windows10-2004-x64

8

svchost_du...py.exe

windows11-21h2-x64

8

Resubmissions

12-04-2024 13:32

240412-qtgfpsag84 8

12-04-2024 13:32

240412-qtc4aaag83 8

12-04-2024 13:32

240412-qtcshsag82 8

12-04-2024 13:32

240412-qtb6zsag79 8

12-04-2024 13:32

240412-qtbkfsdh4s 8

09-04-2024 05:34

240409-f9mmjsbc9t 8

09-04-2024 05:33

240409-f9bkaabc8w 8

09-04-2024 05:33

240409-f86n2abc71 8

09-04-2024 05:33

240409-f8wh3afh27 8

01-02-2024 11:29

240201-nlq9tsebck 10

Analysis

  • max time kernel
    287s
  • max time network
    301s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09-04-2024 05:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    svchost_dump_SCY - Copy.exe

  • Size

    5.2MB

  • MD5

    5fd3d21a968f4b8a1577b5405ab1c36a

  • SHA1

    710e5ab0fceb71b982b966c3a7406ebdf1d2aa82

  • SHA256

    7ac7b42889e14cbd8c7cebe692566ca045d0034f9ff103fc3ef9c5e035dc594f

  • SHA512

    085a31c0412ba0a3d612a66ec8d95ce900e148240f92f9ec8c4d07b6c8e32cf233e92aefc7b4b53a91f5eacacd1cf3a8fcdf8cd7c206afa46014a9e4a9ddf53f

  • SSDEEP

    98304:jgoX+R+gW1CkQFBAFGspWvuL136BRiGQiiyBrDbnh57cpbJLyns:coXxFGWL56BVrDbn77cjIs

Score
8/10
evasion

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\svchost_dump_SCY - Copy.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost_dump_SCY - Copy.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4208
    • C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3640
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      2⤵
      • Modifies Windows Firewall
      PID:872
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      2⤵
      • Modifies Windows Firewall
      PID:4848
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:424
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2360
    • C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /TN "Timer"
      2⤵
        PID:4652
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
        2⤵
        • Creates scheduled task(s)
        PID:3228
      • C:\Windows\System\svchost.exe
        "C:\Windows\System\svchost.exe" formal
        2⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4344
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
          3⤵
            PID:1696
          • C:\Windows\System32\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
            3⤵
            • Modifies Windows Firewall
            PID:4192
          • C:\Windows\System32\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
            3⤵
            • Modifies Windows Firewall
            PID:4872
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4212
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1284

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        Filesize

        3KB

        MD5

        ad5cd538ca58cb28ede39c108acb5785

        SHA1

        1ae910026f3dbe90ed025e9e96ead2b5399be877

        SHA256

        c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

        SHA512

        c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        1KB

        MD5

        943aa240feab973a4e14aa0c4796b77b

        SHA1

        e922f007cdf5180c0e2123f6b084bf9ada6eb5ed

        SHA256

        459772e033d452aa5eea9049295f216fb961d006f5dd49389727c2041bf57007

        SHA512

        4f4db91cfee934c7c1c64282501e40bf6cd5b55647c1f9e5a1f79464f7234734d73a4117abb6285c5f71166c84c1e62dad34435bc8b6396bbf7549515649fa9c

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        1KB

        MD5

        a9db40bdcf669482a2da15d84a0cf326

        SHA1

        3f8dbbaebffa2fd4951299421284b5bcb7044101

        SHA256

        f9e59dfc9335eaca14a60ca69c9b41e1cae7642342ebcbf77421beca8e207959

        SHA512

        7bbaae82b861c13229da7cdcb24bee9d0c179b0654a6010ff0c1dca0085241f57ee6f5407bd52358e895490196234ec66aadb099316cf4984570d6f535aea1f8

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ibkev0yf.h4x.ps1
        Filesize

        1B

        MD5

        c4ca4238a0b923820dcc509a6f75849b

        SHA1

        356a192b7913b04c54574d18c28d46e6395428ab

        SHA256

        6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

        SHA512

        4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

        Download Submit

      • C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
        Filesize

        2.7MB

        MD5

        277abb67ec3376d7c576732a62c39916

        SHA1

        70faa899ea7c8618289668813f04c69613fd6995

        SHA256

        62ce6ee974509a141b66d66c4dfe41565f9ba90f3d62cd286d7a08834f2b10d4

        SHA512

        f385313c49f7b153488f12be7ea04ed5c1220a85b7dc1382dcb862b8d5b155c5999971d3e8c7b37abdfcf8c2ff23f971a0a477a24f23ff8d08e2bcbe90f5021b

        Download Submit

      • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
        Filesize

        6.1MB

        MD5

        095a2744fc8d92e12fb475c0b74f1cb4

        SHA1

        13b20653d81b0d756a9ac6fdec198071e1ef4136

        SHA256

        3f0c3c248088159653ef1fd87b4a7ec5fef08a598af8102082a3238f6be20778

        SHA512

        a18e857bf38159e3dc4a0bc2e906bc17fbd223902de8241c3a170ecd0786a04011f6ef77213f0d1e22620187e602e34a343429ee32a28a4577b263b48ddf1fea

        Download Submit

      • C:\Windows\System\svchost.exe
        Filesize

        5.2MB

        MD5

        5fd3d21a968f4b8a1577b5405ab1c36a

        SHA1

        710e5ab0fceb71b982b966c3a7406ebdf1d2aa82

        SHA256

        7ac7b42889e14cbd8c7cebe692566ca045d0034f9ff103fc3ef9c5e035dc594f

        SHA512

        085a31c0412ba0a3d612a66ec8d95ce900e148240f92f9ec8c4d07b6c8e32cf233e92aefc7b4b53a91f5eacacd1cf3a8fcdf8cd7c206afa46014a9e4a9ddf53f

        Download Submit

      • memory/424-9-0x00000219D0440000-0x00000219D0462000-memory.dmp

        Filesize

        136KB

        Download

      • memory/424-101-0x00007FF833F80000-0x00007FF83496C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/424-5-0x00007FF833F80000-0x00007FF83496C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/424-6-0x00000219E8AC0000-0x00000219E8AD0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/424-33-0x00000219E8AC0000-0x00000219E8AD0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/424-8-0x00000219E8AC0000-0x00000219E8AD0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/424-90-0x00000219E8AC0000-0x00000219E8AD0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/424-15-0x00000219E8C50000-0x00000219E8CC6000-memory.dmp

        Filesize

        472KB

        Download

      • memory/1284-175-0x000002DAFCAF0000-0x000002DAFCB00000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1284-212-0x000002DAFCAF0000-0x000002DAFCB00000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1284-125-0x00007FF833CC0000-0x00007FF8346AC000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/1284-131-0x000002DAFCAF0000-0x000002DAFCB00000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1284-216-0x00007FF833CC0000-0x00007FF8346AC000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/1284-130-0x000002DAFCAF0000-0x000002DAFCB00000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2360-106-0x00007FF833F80000-0x00007FF83496C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/2360-28-0x0000019CF3B30000-0x0000019CF3B40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2360-14-0x00007FF833F80000-0x00007FF83496C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/2360-26-0x0000019CF3B30000-0x0000019CF3B40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2360-63-0x0000019CF3B30000-0x0000019CF3B40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2360-100-0x0000019CF3B30000-0x0000019CF3B40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4208-0-0x0000000140000000-0x0000000140636000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/4208-113-0x0000000140000000-0x0000000140636000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/4208-7-0x0000000140000000-0x0000000140636000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/4212-145-0x00000286A4E80000-0x00000286A4E90000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4212-197-0x00000286A4E80000-0x00000286A4E90000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4212-208-0x00007FF833CC0000-0x00007FF8346AC000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/4212-116-0x00007FF833CC0000-0x00007FF8346AC000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/4212-120-0x00000286A4E80000-0x00000286A4E90000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4212-119-0x00000286A4E80000-0x00000286A4E90000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4344-129-0x0000000140000000-0x0000000140636000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/4344-112-0x0000000140000000-0x0000000140636000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/4344-217-0x0000000036A60000-0x0000000036F42000-memory.dmp

        Filesize

        4.9MB

        Download