Analysis
-
max time kernel
132s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 13:46
Static task
static1
Behavioral task
behavioral1
Sample
Svhost.exe
Resource
win7-20240704-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
Svhost.exe
Resource
win10-20240404-en
windows10-1703-x64
21 signatures
150 seconds
Behavioral task
behavioral3
Sample
Svhost.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral4
Sample
Svhost.exe
Resource
win11-20240802-en
windows11-21h2-x64
22 signatures
150 seconds
Behavioral task
behavioral5
Sample
Svhost.exe
Resource
macos-20240711.1-en
macos-10.15-amd64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Svhost.exe
Resource
macos-20240711.1-en
macos-10.15-amd64
0 signatures
150 seconds
General
-
Target
Svhost.exe
-
Size
399KB
-
MD5
7d4970831fafb993a4b0de345cb6832b
-
SHA1
ff95a1c11fe502a396f65cb817abf6796dfb791a
-
SHA256
fa47d6d85592087d1cba503253670920ac9545deb3176006fc79606b21ae966c
-
SHA512
9b27ecaca0dc6b7b68acdcfc4308f213b94ddfea3cbc357ee96e1cc82bd2e3cfb06c4c8a9ce5647fbde18931f5e2b34e5a119295c4548d719b7a85d425657b84
-
SSDEEP
6144:PaSpJQYtBJ5666+e6VlWT8b9L+s82y00ZFlTzubWKrhtwwD:PPph95o+PVle8Is8LZFFCrhtw4
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\xdwdAvast Antivirus Upgrade.exe" Svhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe" Svhost.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\xdwdfghfghfg = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\xdwdMicrosoft Dynamics Upgrade.exe" Svhost.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\xdwd.dll Svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 2 IoCs
pid Process 2740 timeout.exe 1492 timeout.exe -
Kills process with taskkill 2 IoCs
pid Process 2340 taskkill.exe 2688 taskkill.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings explorer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3020 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2336 WmiApSrv.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe 2164 Svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2796 explorer.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 2164 Svhost.exe Token: SeDebugPrivilege 2340 taskkill.exe Token: SeShutdownPrivilege 2796 explorer.exe Token: SeShutdownPrivilege 2796 explorer.exe Token: SeShutdownPrivilege 2796 explorer.exe Token: SeShutdownPrivilege 2796 explorer.exe Token: SeShutdownPrivilege 2796 explorer.exe Token: SeShutdownPrivilege 2796 explorer.exe Token: SeShutdownPrivilege 2796 explorer.exe Token: SeShutdownPrivilege 2796 explorer.exe Token: SeShutdownPrivilege 2796 explorer.exe Token: SeShutdownPrivilege 2796 explorer.exe Token: 33 1364 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1364 AUDIODG.EXE Token: 33 1364 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1364 AUDIODG.EXE Token: SeShutdownPrivilege 2796 explorer.exe Token: SeShutdownPrivilege 2796 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe -
Suspicious use of SendNotifyMessage 23 IoCs
pid Process 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe 2796 explorer.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2832 2164 Svhost.exe 30 PID 2164 wrote to memory of 2832 2164 Svhost.exe 30 PID 2164 wrote to memory of 2832 2164 Svhost.exe 30 PID 2832 wrote to memory of 3020 2832 CMD.exe 32 PID 2832 wrote to memory of 3020 2832 CMD.exe 32 PID 2832 wrote to memory of 3020 2832 CMD.exe 32 PID 2164 wrote to memory of 988 2164 Svhost.exe 34 PID 2164 wrote to memory of 988 2164 Svhost.exe 34 PID 2164 wrote to memory of 988 2164 Svhost.exe 34 PID 2164 wrote to memory of 2308 2164 Svhost.exe 36 PID 2164 wrote to memory of 2308 2164 Svhost.exe 36 PID 2164 wrote to memory of 2308 2164 Svhost.exe 36 PID 988 wrote to memory of 2492 988 cmd.exe 38 PID 988 wrote to memory of 2492 988 cmd.exe 38 PID 988 wrote to memory of 2492 988 cmd.exe 38 PID 2308 wrote to memory of 2340 2308 CMD.exe 39 PID 2308 wrote to memory of 2340 2308 CMD.exe 39 PID 2308 wrote to memory of 2340 2308 CMD.exe 39 PID 2164 wrote to memory of 2792 2164 Svhost.exe 40 PID 2164 wrote to memory of 2792 2164 Svhost.exe 40 PID 2164 wrote to memory of 2792 2164 Svhost.exe 40 PID 2792 wrote to memory of 1492 2792 cmd.exe 42 PID 2792 wrote to memory of 1492 2792 cmd.exe 42 PID 2792 wrote to memory of 1492 2792 cmd.exe 42 PID 2792 wrote to memory of 2796 2792 cmd.exe 43 PID 2792 wrote to memory of 2796 2792 cmd.exe 43 PID 2792 wrote to memory of 2796 2792 cmd.exe 43 PID 2792 wrote to memory of 2688 2792 cmd.exe 44 PID 2792 wrote to memory of 2688 2792 cmd.exe 44 PID 2792 wrote to memory of 2688 2792 cmd.exe 44 PID 2792 wrote to memory of 2740 2792 cmd.exe 45 PID 2792 wrote to memory of 2740 2792 cmd.exe 45 PID 2792 wrote to memory of 2740 2792 cmd.exe 45 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Svhost.exe"C:\Users\Admin\AppData\Local\Temp\Svhost.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\system32\CMD.exe"CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Roaming\xdwdAvast Antivirus Upgrade.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\system32\schtasks.exeSchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Roaming\xdwdAvast Antivirus Upgrade.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3020
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "svchost.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\system32\schtasks.exeschtASks /deLeTe /F /Tn "svchost.exe"3⤵PID:2492
-
-
-
C:\Windows\system32\CMD.exe"CMD" /C taskkill /im explorer.exe /f2⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\system32\taskkill.exetaskkill /im explorer.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp18DE.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\system32\timeout.exetimeout 53⤵
- Delays execution with timeout.exe
PID:1492
-
-
C:\Windows\explorer.exeexplorer.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2796
-
-
C:\Windows\system32\taskkill.exetaskkill /im xdwdAvast Antivirus Upgrade.exe /f3⤵
- Kills process with taskkill
PID:2688
-
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2740
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2336
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5a81⤵
- Suspicious use of AdjustPrivilegeToken
PID:1364
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1AppInit DLLs
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262B
MD580675dea5e5a7fb13ae7d2e87891c332
SHA1146876855669045ff28b79dd618bc5e1d08eefaf
SHA2568df26ae53cf15698f403bfd9d3f241605360b0e36cd25e7b2e28ffc677ab3164
SHA512ed5414d9af33cca49fe91bee6bd676e7660143a14119ee3d3cfdc57a0a1875280687bb107b2b6ac15a28a31b088d570141b90e6405e39af7112071bec845fff0
-
Filesize
136KB
MD516e5a492c9c6ae34c59683be9c51fa31
SHA197031b41f5c56f371c28ae0d62a2df7d585adaba
SHA25635c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
SHA51220fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6