Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 08:07
Behavioral task
behavioral1
Sample
svchost.exe
Resource
win7-20240708-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
svchost.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
svchost.exe
-
Size
145KB
-
MD5
5d0e0d8c39cd3e9cd530a226eb859020
-
SHA1
8eb4534f812e5ef719eccd5b5bbc3cea0c86d01a
-
SHA256
a71031f0dab50af58606e40c45a469d98a226ab53ede2d950da6445874b4bd12
-
SHA512
c50bcc77befb2abd9190fd25a7e12370a88b461cf8ec3208d65f37a74f6d4a09293086eaf361e4a55dc58ba47155306fb851af1bb8f3ca21aa5187d30529d29b
-
SSDEEP
1536:izICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xD5bwnHm/1BviIdU/IqbNLu75RjJ:hqJogYkcSNm9V7D50nH2viI2xadRj1T
Score
9/10
Malware Config
Signatures
-
Renames multiple (8281) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
D633.tmppid Process 2032 D633.tmp -
Executes dropped EXE 1 IoCs
Processes:
D633.tmppid Process 2032 D633.tmp -
Loads dropped DLL 5 IoCs
Processes:
svchost.exepid Process 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
svchost.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
D633.tmppid Process 2032 D633.tmp -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exedescription ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN075.XML.GO4nojG0Y svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\management-agent.jar svchost.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui.GO4nojG0Y svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar.GO4nojG0Y svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099176.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01954_.WMF.GO4nojG0Y svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\33.png svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\slideShow.html svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00703L.GIF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02431_.WMF svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\ICE.ELM svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.GO4nojG0Y svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\background.png svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Pangnirtung.GO4nojG0Y svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_LightSpirit.gif svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099181.WMF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00118_.WMF.GO4nojG0Y svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01368_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome.GO4nojG0Y svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR13F.GIF svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH02313_.WMF.GO4nojG0Y svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\flyout.css svchost.exe File created C:\Program Files\VideoLAN\VLC\GO4nojG0Y.README.txt svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Right.accdt.GO4nojG0Y svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0299587.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar.GO4nojG0Y svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT.GO4nojG0Y svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\icon.png svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21527_.GIF.GO4nojG0Y svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21365_.GIF svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca.GO4nojG0Y svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-snaptracer.xml svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar.GO4nojG0Y svchost.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\GO4nojG0Y.README.txt svchost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\info.png svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Premium.css svchost.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar.GO4nojG0Y svchost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_floating.png svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo svchost.exe File opened for modification C:\Program Files\Common Files\System\ado\msado28.tlb svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt.GO4nojG0Y svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Installed_schemas14.xss svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png.GO4nojG0Y svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00177_.WMF svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Aspect.xml svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200467.WMF.GO4nojG0Y svchost.exe File created C:\Program Files\Java\jre7\lib\amd64\GO4nojG0Y.README.txt svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL_F_COL.HXK svchost.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\GO4nojG0Y.README.txt svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Angles.xml.GO4nojG0Y svchost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Civic.xml.GO4nojG0Y svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif.GO4nojG0Y svchost.exe File opened for modification C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vienna.GO4nojG0Y svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe svchost.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\de-DE\wordpad.exe.mui svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid Process 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe 2316 svchost.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
D633.tmppid Process 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp 2032 D633.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svchost.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeDebugPrivilege 2316 svchost.exe Token: 36 2316 svchost.exe Token: SeImpersonatePrivilege 2316 svchost.exe Token: SeIncBasePriorityPrivilege 2316 svchost.exe Token: SeIncreaseQuotaPrivilege 2316 svchost.exe Token: 33 2316 svchost.exe Token: SeManageVolumePrivilege 2316 svchost.exe Token: SeProfSingleProcessPrivilege 2316 svchost.exe Token: SeRestorePrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeSystemProfilePrivilege 2316 svchost.exe Token: SeTakeOwnershipPrivilege 2316 svchost.exe Token: SeShutdownPrivilege 2316 svchost.exe Token: SeDebugPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeBackupPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe Token: SeSecurityPrivilege 2316 svchost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
svchost.exeD633.tmpdescription pid Process procid_target PID 2316 wrote to memory of 2032 2316 svchost.exe 33 PID 2316 wrote to memory of 2032 2316 svchost.exe 33 PID 2316 wrote to memory of 2032 2316 svchost.exe 33 PID 2316 wrote to memory of 2032 2316 svchost.exe 33 PID 2316 wrote to memory of 2032 2316 svchost.exe 33 PID 2032 wrote to memory of 1704 2032 D633.tmp 34 PID 2032 wrote to memory of 1704 2032 D633.tmp 34 PID 2032 wrote to memory of 1704 2032 D633.tmp 34 PID 2032 wrote to memory of 1704 2032 D633.tmp 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\ProgramData\D633.tmp"C:\ProgramData\D633.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D633.tmp >> NUL3⤵PID:1704
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:1596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5b5a33661ec796aba12185d31c90eda72
SHA1b94643789b220d93abe3603c3a3b4af5857647b9
SHA256d9430c37674e249190e76ba3c418c6ba9e50396b9e069ea7b2df1de64423523f
SHA5126909af56e2a802e972689cb50913846eaea12d21f4dfa463adc45c395d22f7cef7cff252973ce58b21bd9df74a50ac086d4be4d3b6b274da88e3842d204f212f
-
Filesize
469B
MD51452389485b72f5b3b6fe32ef0048884
SHA132bdd628c5f5883ed8b1a725221a45630f09cf09
SHA256ccb5dfd78313bf6a409d8d49c4470f5fc947a2967911af5b8e68d0eb0b6a7731
SHA512b4a1a03de139d2a21966b1a7be952121a44382f7f24596a1018cb09b20ff4dca16901cad1a1a8a3d6c1587638950e66a3d97dbcf16597ec8090aa8557a0d360a
-
Filesize
145KB
MD50081e212200a838c1e84661efeedcca3
SHA1f6361534cd8768eac51361d4ddf6fa5bb63fb635
SHA256f56143a231ab3eab879e4cf9f776feeee3f858946a561babed9bf51683ee4374
SHA5124e1b9e0055bbfd4aebf540682088ea8827280bece5a9b41a1e76e9f056586ddf4bd57b61d2371c3375f48145e4c91415f5146895f4873b1ed1ab944c66d41db1
-
Filesize
129B
MD55400d9127a5decc3e4bb1db5dd352365
SHA177f5d817ca68267cfc876ed0d58e62d474776419
SHA25676b11fc90ccbf0b173f65344f9d481ec64536da49c1db51b0b0ad0edb66a338b
SHA5125e6383e0b0a34e4922ceaec491afbeac2e2bdf1043fb26bfc8019961aa7faa20bf6f2264e8e9726fb1f24cbdce726b25f3f009e337e298d062f6d65f101a966c
-
Filesize
4.7MB
MD561bffb5f57ad12f83ab64b7181829b34
SHA1945d94fef51e0db76c2fd95ee22ed2767be0fe0b
SHA2561dd0dd35e4158f95765ee6639f217df03a0a19e624e020dba609268c08a13846
SHA512e569639d3bb81a7b3bd46484ff4b8065d7fd15df416602d825443b2b17d8c0c59500fb6516118e7a65ea9fdd9e4be238f0319577fa44c114eaca18b0334ba521
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf