Overview

overview

8

Static

static

3

svchost_du...py.exe

windows7-x64

8

svchost_du...py.exe

windows10-1703-x64

8

svchost_du...py.exe

windows10-2004-x64

8

svchost_du...py.exe

windows11-21h2-x64

8

Resubmissions

12-04-2024 13:32

240412-qtgfpsag84 8

12-04-2024 13:32

240412-qtc4aaag83 8

12-04-2024 13:32

240412-qtcshsag82 8

12-04-2024 13:32

240412-qtb6zsag79 8

12-04-2024 13:32

240412-qtbkfsdh4s 8

09-04-2024 05:34

240409-f9mmjsbc9t 8

09-04-2024 05:33

240409-f9bkaabc8w 8

09-04-2024 05:33

240409-f86n2abc71 8

09-04-2024 05:33

240409-f8wh3afh27 8

01-02-2024 11:29

240201-nlq9tsebck 10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12-04-2024 13:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    svchost_dump_SCY - Copy.exe

  • Size

    5.2MB

  • MD5

    5fd3d21a968f4b8a1577b5405ab1c36a

  • SHA1

    710e5ab0fceb71b982b966c3a7406ebdf1d2aa82

  • SHA256

    7ac7b42889e14cbd8c7cebe692566ca045d0034f9ff103fc3ef9c5e035dc594f

  • SHA512

    085a31c0412ba0a3d612a66ec8d95ce900e148240f92f9ec8c4d07b6c8e32cf233e92aefc7b4b53a91f5eacacd1cf3a8fcdf8cd7c206afa46014a9e4a9ddf53f

  • SSDEEP

    98304:jgoX+R+gW1CkQFBAFGspWvuL136BRiGQiiyBrDbnh57cpbJLyns:coXxFGWL56BVrDbn77cjIs

Score
8/10
evasion

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\svchost_dump_SCY - Copy.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost_dump_SCY - Copy.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:420
    • C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:216
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      2⤵
      • Modifies Windows Firewall
      PID:3012
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      2⤵
      • Modifies Windows Firewall
      PID:2268
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:392
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2648
    • C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /TN "Timer"
      2⤵
        PID:1280
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
        2⤵
        • Creates scheduled task(s)
        PID:860
      • C:\Windows\System\svchost.exe
        "C:\Windows\System\svchost.exe" formal
        2⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:596
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
          3⤵
            PID:1916
          • C:\Windows\System32\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
            3⤵
            • Modifies Windows Firewall
            PID:2828
          • C:\Windows\System32\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
            3⤵
            • Modifies Windows Firewall
            PID:620
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2568
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3000

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        Filesize

        2KB

        MD5

        268b890dae39e430e8b127909067ed96

        SHA1

        35939515965c0693ef46e021254c3e73ea8c4a2b

        SHA256

        7643d492a6f1e035b63b2e16c9c21d974a77dfd2d8e90b9c15ee412625e88c4c

        SHA512

        abc4b2ce10a6566f38c00ad55e433791dd45fca47deec70178daf0763578ff019fb0ec70792d5e9ecde4eb6778a35ba8a8c7ecd07550597d9bbb13521c9b98fb

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        1KB

        MD5

        0f5a7d69d8c9ff958c9c3edfe5139699

        SHA1

        58796d0ee6b6d420cc84001119d2b7c0e84136be

        SHA256

        c568af5284711bb40fa7c6eb654e27dd44dd6ebfb41ffd0ccd96f29c77537d52

        SHA512

        8dbd320ab256ad6344e48a7ed0ebe1fe512aae88406d1ed5806a27ed6b8a5a3a7c8c5ccc0c60135853e26481ea9ca89dda3e9eb4d52e7855258b1a0ffa32624e

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        1KB

        MD5

        c94859de3a213084dc9af4463a09d6e7

        SHA1

        74806f832d3580c018a11461fcbd16948203d8d5

        SHA256

        2f8278372a32011b80d12b997be4cdb91181f344b1746be14b496daf9be16a9f

        SHA512

        2800b4eca191bee9d740e588ba7acf6f7c931a475196c2865a9487eb6fecf3ba78688fd91cb8bb1ca9d5a04f86a3295ab847112dc1b693d304120c5c79638dd0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j0nlqhpt.lrw.ps1
        Filesize

        1B

        MD5

        c4ca4238a0b923820dcc509a6f75849b

        SHA1

        356a192b7913b04c54574d18c28d46e6395428ab

        SHA256

        6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

        SHA512

        4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

        Download Submit

      • C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
        Filesize

        2.7MB

        MD5

        27acfbf94480631e547b5cb508d9d4fb

        SHA1

        f6477330ca9aeb4a8cd19cc44e1a30fa9695b36c

        SHA256

        0fd156526952ba5edb62133774a19bf72f71d3c968d01fcdb517521d45a67c5e

        SHA512

        902ccecfa284881c1f241802b9ccd51a85da0cc48632fbd944b686d37a4fa57bc7cd01c44ef79bfe475494be780164b82ff8fa9a3e77984f6e29467843138929

        Download Submit

      • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
        Filesize

        6.1MB

        MD5

        7ec7216523f775201b2a0c7df04b0356

        SHA1

        e8a8a824632534990a49a006b06c416e0685ead3

        SHA256

        ab72039998ea21b0b26142f80397fb12093b820416f01e0e2aefd1089cdb6486

        SHA512

        cb1982aab2a83f329d0cf7ef034e7dda0515106237f8d62d89d22946a6d76da8032be0f94365f666f153003b1a058343904c6ee9686ba99e83ec6c05afb9272a

        Download Submit

      • C:\Windows\System\svchost.exe
        Filesize

        5.2MB

        MD5

        5fd3d21a968f4b8a1577b5405ab1c36a

        SHA1

        710e5ab0fceb71b982b966c3a7406ebdf1d2aa82

        SHA256

        7ac7b42889e14cbd8c7cebe692566ca045d0034f9ff103fc3ef9c5e035dc594f

        SHA512

        085a31c0412ba0a3d612a66ec8d95ce900e148240f92f9ec8c4d07b6c8e32cf233e92aefc7b4b53a91f5eacacd1cf3a8fcdf8cd7c206afa46014a9e4a9ddf53f

        Download Submit

      • memory/392-106-0x00007FFACD660000-0x00007FFACE04C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/392-19-0x00000244446D0000-0x0000024444746000-memory.dmp

        Filesize

        472KB

        Download

      • memory/392-14-0x00000244444F0000-0x0000024444512000-memory.dmp

        Filesize

        136KB

        Download

      • memory/392-42-0x0000024444540000-0x0000024444550000-memory.dmp

        Filesize

        64KB

        Download

      • memory/392-5-0x00007FFACD660000-0x00007FFACE04C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/392-6-0x0000024444540000-0x0000024444550000-memory.dmp

        Filesize

        64KB

        Download

      • memory/392-101-0x0000024444540000-0x0000024444550000-memory.dmp

        Filesize

        64KB

        Download

      • memory/392-9-0x0000024444540000-0x0000024444550000-memory.dmp

        Filesize

        64KB

        Download

      • memory/420-0-0x0000000140000000-0x0000000140636000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/420-113-0x0000000140000000-0x0000000140636000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/420-8-0x0000000140000000-0x0000000140636000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/596-217-0x0000000036A60000-0x0000000036F42000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/596-126-0x0000000140000000-0x0000000140636000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/596-112-0x0000000140000000-0x0000000140636000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/2568-117-0x00007FFACD660000-0x00007FFACE04C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/2568-155-0x00000215E2E80000-0x00000215E2E90000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2568-119-0x00000215E2E80000-0x00000215E2E90000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2568-120-0x00000215E2E80000-0x00000215E2E90000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2568-215-0x00007FFACD660000-0x00007FFACE04C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/2568-204-0x00000215E2E80000-0x00000215E2E90000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2648-15-0x00000279CDE90000-0x00000279CDEA0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2648-12-0x00007FFACD660000-0x00007FFACE04C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/2648-16-0x00000279CDE90000-0x00000279CDEA0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2648-100-0x00007FFACD660000-0x00007FFACE04C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/2648-94-0x00000279CDE90000-0x00000279CDEA0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2648-60-0x00000279CDE90000-0x00000279CDEA0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3000-129-0x0000013106CC0000-0x0000013106CD0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3000-128-0x0000013106CC0000-0x0000013106CD0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3000-166-0x0000013106CC0000-0x0000013106CD0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3000-209-0x0000013106CC0000-0x0000013106CD0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3000-124-0x00007FFACD660000-0x00007FFACE04C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/3000-216-0x00007FFACD660000-0x00007FFACE04C000-memory.dmp

        Filesize

        9.9MB

        Download