Overview

overview

10

Static

static

1

Svhost.exe

windows7-x64

10

Svhost.exe

windows10-1703-x64

10

Svhost.exe

windows10-2004-x64

10

Svhost.exe

windows11-21h2-x64

10

Svhost.exe

macos-10.15-amd64

1

Svhost.exe

macos-10.15-amd64

1

Analysis

  • max time kernel
    1784s
  • max time network
    1608s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    21/08/2024, 13:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Svhost.exe

  • Size

    399KB

  • MD5

    7d4970831fafb993a4b0de345cb6832b

  • SHA1

    ff95a1c11fe502a396f65cb817abf6796dfb791a

  • SHA256

    fa47d6d85592087d1cba503253670920ac9545deb3176006fc79606b21ae966c

  • SHA512

    9b27ecaca0dc6b7b68acdcfc4308f213b94ddfea3cbc357ee96e1cc82bd2e3cfb06c4c8a9ce5647fbde18931f5e2b34e5a119295c4548d719b7a85d425657b84

  • SSDEEP

    6144:PaSpJQYtBJ5666+e6VlWT8b9L+s82y00ZFlTzubWKrhtwwD:PPph95o+PVle8Is8LZFFCrhtw4

Score
10/10
persistenceprivilege_escalation

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 29 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 45 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Svhost.exe
    "C:\Users\Admin\AppData\Local\Temp\Svhost.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4812
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Roaming\xdwdAvast Antivirus Upgrade.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:696
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost.exe" /tr "C:\Users\Admin\AppData\Roaming\xdwdAvast Antivirus Upgrade.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5112
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "svchost.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1528
      • C:\Windows\system32\schtasks.exe
        schtASks /deLeTe /F /Tn "svchost.exe"
        3⤵
          PID:4068
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" /C taskkill /im explorer.exe /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:308
        • C:\Windows\system32\taskkill.exe
          taskkill /im explorer.exe /f
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2380
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE40A.tmp.bat""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2192
        • C:\Windows\system32\timeout.exe
          timeout 5
          3⤵
          • Delays execution with timeout.exe
          PID:4620
        • C:\Windows\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1916
        • C:\Windows\system32\taskkill.exe
          taskkill /im xdwdAvast Antivirus Upgrade.exe /f
          3⤵
          • Kills process with taskkill
          PID:4168
        • C:\Windows\system32\timeout.exe
          timeout 3
          3⤵
          • Delays execution with timeout.exe
          PID:4972
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:944
    • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
      1⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4580

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Persistence

    Boot or Logon Autostart Execution

    3
    T1547

    Active Setup

    1
    T1547.014

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Event Triggered Execution

    1
    T1546

    AppInit DLLs

    1
    T1546.010

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Privilege Escalation

    Boot or Logon Autostart Execution

    3
    T1547

    Active Setup

    1
    T1547.014

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Event Triggered Execution

    1
    T1546

    AppInit DLLs

    1
    T1546.010

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Defense Evasion

    Modify Registry

    4
    T1112

    Credential Access

    Discovery

    Peripheral Device Discovery

    2
    T1120

    Query Registry

    4
    T1012

    System Information Discovery

    4
    T1082

    Lateral Movement

    Collection

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpE40A.tmp.bat
      Filesize

      262B

      MD5

      623272a113dee69cd42e5ac174809ac4

      SHA1

      0b92277fe813ad9e6831e583a55364cde4ecfe99

      SHA256

      f933929a4634e0602bed629fee0a21722bdf125d0537becaa86ec32c0da32620

      SHA512

      b12cc941c602539f90c8fc23f79df429cd87a8a1735bae73816ca52e17eb4f306feffb959fcb9eb8278f5276b36b357c42f72bf0c1cdb4b6890c7b3d86ce8d83

      Download Submit

    • C:\Windows\xdwd.dll
      Filesize

      136KB

      MD5

      16e5a492c9c6ae34c59683be9c51fa31

      SHA1

      97031b41f5c56f371c28ae0d62a2df7d585adaba

      SHA256

      35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

      SHA512

      20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

      Download Submit

    • memory/944-66-0x00007FFFF9BC0000-0x00007FFFF9D9B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/944-65-0x00007FFFEA2C0000-0x00007FFFEA2E2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/944-64-0x00007FFFF9BC0000-0x00007FFFF9D9B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/944-63-0x00007FFFF9BC0000-0x00007FFFF9D9B000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/944-62-0x00007FFFF9C65000-0x00007FFFF9C66000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1916-3500-0x0000000002D60000-0x0000000002D61000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4580-3501-0x0000015D10D00000-0x0000015D10E00000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/4580-3502-0x0000015D10D00000-0x0000015D10E00000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/4580-3509-0x0000015D114C0000-0x0000015D114E0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4580-3530-0x0000015D11640000-0x0000015D11660000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4812-2-0x00007FFFED043000-0x00007FFFED044000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4812-0-0x00007FFFED043000-0x00007FFFED044000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4812-44-0x00007FFFED040000-0x00007FFFEDA2C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/4812-119-0x00007FFFED040000-0x00007FFFEDA2C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/4812-1-0x0000000000A90000-0x0000000000AF8000-memory.dmp

      Filesize

      416KB

      Download

    • memory/4812-3497-0x00007FFFED040000-0x00007FFFEDA2C000-memory.dmp

      Filesize

      9.9MB

      Download