Overview

overview

10

Static

static

1

Svhost.exe

windows7-x64

10

Svhost.exe

windows10-1703-x64

10

Svhost.exe

windows10-2004-x64

10

Svhost.exe

windows11-21h2-x64

10

Svhost.exe

macos-10.15-amd64

4

Svhost.exe

macos-10.15-amd64

1

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21-08-2024 13:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Svhost.exe

  • Size

    399KB

  • MD5

    7d4970831fafb993a4b0de345cb6832b

  • SHA1

    ff95a1c11fe502a396f65cb817abf6796dfb791a

  • SHA256

    fa47d6d85592087d1cba503253670920ac9545deb3176006fc79606b21ae966c

  • SHA512

    9b27ecaca0dc6b7b68acdcfc4308f213b94ddfea3cbc357ee96e1cc82bd2e3cfb06c4c8a9ce5647fbde18931f5e2b34e5a119295c4548d719b7a85d425657b84

  • SSDEEP

    6144:PaSpJQYtBJ5666+e6VlWT8b9L+s82y00ZFlTzubWKrhtwwD:PPph95o+PVle8Is8LZFFCrhtw4

Score
10/10
persistenceprivilege_escalation

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 43 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Svhost.exe
    "C:\Users\Admin\AppData\Local\Temp\Svhost.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3620
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Roaming\xdwdAvast Antivirus Upgrade.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1700
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Roaming\xdwdAvast Antivirus Upgrade.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2988
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "svchost.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:452
      • C:\Windows\system32\schtasks.exe
        schtASks /deLeTe /F /Tn "svchost.exe"
        3⤵
          PID:4176
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" /C taskkill /im explorer.exe /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4180
        • C:\Windows\system32\taskkill.exe
          taskkill /im explorer.exe /f
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1968
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7A85.tmp.bat""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4660
        • C:\Windows\system32\timeout.exe
          timeout 5
          3⤵
          • Delays execution with timeout.exe
          PID:4696
        • C:\Windows\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:1780
        • C:\Windows\system32\taskkill.exe
          taskkill /im xdwdAvast Antivirus Upgrade.exe /f
          3⤵
          • Kills process with taskkill
          PID:3020
        • C:\Windows\system32\timeout.exe
          timeout 3
          3⤵
          • Delays execution with timeout.exe
          PID:4936
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2292
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3364
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4104

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Persistence

    Boot or Logon Autostart Execution

    3
    T1547

    Active Setup

    1
    T1547.014

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Event Triggered Execution

    1
    T1546

    AppInit DLLs

    1
    T1546.010

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Privilege Escalation

    Boot or Logon Autostart Execution

    3
    T1547

    Active Setup

    1
    T1547.014

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Event Triggered Execution

    1
    T1546

    AppInit DLLs

    1
    T1546.010

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Defense Evasion

    Modify Registry

    4
    T1112

    Credential Access

    Discovery

    Peripheral Device Discovery

    2
    T1120

    Query Registry

    4
    T1012

    System Information Discovery

    4
    T1082

    Lateral Movement

    Collection

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZTZW67SQ\www.bing[1].xml
      Filesize

      540B

      MD5

      d84bd7386a3688ed77e19c37c7321917

      SHA1

      59ac51436f8d347dfaccbf02f01298ac821b6bd3

      SHA256

      5fe17504668a7157eb1195572ad60d015ebbe7796fd18683a4a0d4891cc1bba1

      SHA512

      b96b5640a80e0c2e1a141271713fdf7d7d7e50993a99b14c7c52f880e576c1b519204f49f016a9fb67290d87fac85941d5e67ed35d4aee645fa618a5d17aad66

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tmp7A85.tmp.bat
      Filesize

      262B

      MD5

      05b2bcc0c3ce564df8f87b6e51ca2299

      SHA1

      967f72cfd9715a5419658f888e85bf5ac4830d77

      SHA256

      0fbca0fd1ee56998431e766b8eb0fb9307fae33fe45e305ad8fc8dec664b8241

      SHA512

      a6faf97f1e0e975acaf56649acd1cf089387020ba04823f8a384e490dbc120c2ffdf8d4c1cfe08e6fa577551231738ec43f452742aea41276b34206a2ed2637e

      Download Submit

    • C:\Windows\xdwd.dll
      Filesize

      136KB

      MD5

      16e5a492c9c6ae34c59683be9c51fa31

      SHA1

      97031b41f5c56f371c28ae0d62a2df7d585adaba

      SHA256

      35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

      SHA512

      20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

      Download Submit

    • memory/2292-90-0x00007FFA13730000-0x00007FFA13731000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3364-1007-0x000001F2F9D90000-0x000001F2F9E90000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/3364-1050-0x000001F2FA030000-0x000001F2FA050000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3364-1135-0x000001F2FDDF0000-0x000001F2FDEF0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/3364-1051-0x000001F2F9ED0000-0x000001F2F9EF0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3364-1052-0x000001F2F7F70000-0x000001F2F7F90000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3364-961-0x000001F2E65E0000-0x000001F2E66E0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/3364-962-0x000001F2E65E0000-0x000001F2E66E0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/3364-979-0x000001F2F7DB0000-0x000001F2F7EB0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/3364-1014-0x000001F2FA0B0000-0x000001F2FA1B0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/3620-0-0x00007FF9F2853000-0x00007FF9F2855000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3620-44-0x00007FF9F2850000-0x00007FF9F3312000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3620-947-0x00007FF9F2850000-0x00007FF9F3312000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3620-2-0x00007FF9F2853000-0x00007FF9F2855000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3620-1-0x0000000000C60000-0x0000000000CC8000-memory.dmp

      Filesize

      416KB

      Download

    • memory/3620-144-0x00007FF9F2850000-0x00007FF9F3312000-memory.dmp

      Filesize

      10.8MB

      Download