Overview

overview

10

Static

static

10

svchost.exe

windows7-x64

10

svchost.exe

windows10-2004-x64

10

svchost.exe

android-11-x64

svchost.exe

android-13-x64

svchost.exe

macos-10.15-amd64

svchost.exe

ubuntu-18.04-amd64

svchost.exe

debian-9-armhf

svchost.exe

debian-9-mips

svchost.exe

debian-9-mipsel

Resubmissions

05-02-2025 10:17

250205-mbfjxatlhr 10

05-02-2025 10:16

250205-ma5gmstlgq 10

21-12-2022 10:49

221221-mwyafsfc8z 10

Analysis

  • max time kernel
    149s
  • max time network
    275s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-02-2025 10:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    svchost.exe

  • Size

    500KB

  • MD5

    4dc8cae2cfff6ac862aea48b014937bb

  • SHA1

    80486ca4caa5cb4ce42885dcd66d7a1b4a27d5ce

  • SHA256

    ab0774b4ac9eb7e50c82abad03293ae39b668e81712b6ceb0d35ffe7e330881b

  • SHA512

    79eb56d858b21743ca565d22bb56cd3d8e4ecfdf462f03124672dca090c95ca51f8908f8dea22c3631dddba0a1a2bf443f41fdf8bf70e826335bcc56d0def47d

  • SSDEEP

    12288:YLrjOlAQS+OeO+OeNhBBhhBBYIeVZkD097u8HvaEs1Mm7Q:YLrjSGtVGD05u4yVMm

Score
10/10
mespinozadiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Readme.README

Ransom Note
Hi Company, Every byte on any types of your devices was encrypted. Don't try to use backups because it were encrypted too. To get all your data back contact us: [email protected] [email protected] [email protected] Also, be aware that we downloaded files from your servers and in case of non-payment we will be forced to upload them on our website, and if necessary, we will sell them on the darknet. Check out our website, we just posted there new updates for our partners: http://pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion/ -------------- FAQ: 1. Q: How can I make sure you don't fooling me? A: You can send us 2 files(max 2mb). 2. Q: What to do to get all data back? A: Don't restart the computer, don't move files and write us. 3. Q: What to tell my boss? A: Protect Your System Amigo.
URLs

http://pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion/

Signatures

  • Mespinoza Ransomware 2 TTPs

    Also known as Pysa. Ransomware-as-a-servoce which first appeared in 2020.

    ransomwaremespinoza
  • Mespinoza family
    mespinoza
  • Renames multiple (3391) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\svchost.exe dsrm -subtree -noprompt -c user"http://+:443"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3868
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\update.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\update.bat
    Filesize

    225B

    MD5

    28818933fcf3ede3b45e0f5f36cf9629

    SHA1

    c522061c91847b9c32ef744f04ee9526bfbb694f

    SHA256

    7c3550b6fbf86eb37a37a5c79e66b9984a7ee1f74f6b16dddf8b53163f17e008

    SHA512

    3cbbc70359bf5d94524ae12db7213cac96f9bb745cc7dfec35b5d3b1d99365867862d9da7a4118d46fad2a920e5d956f76a767b06f10c92bd8a1a43cfa57ea04

    Download Submit

  • C:\Users\Readme.README
    Filesize

    895B

    MD5

    2b6d1c5b5de83cc5932ae40b86d60875

    SHA1

    c5d85f44181eebb98e6fa398a7239d8c2aef716a

    SHA256

    7c754b4dad557bbd282e3d956a24cf477e7c3782a9ef792b833be919d6a89445

    SHA512

    71e0dbb9342586560fcf63b3bdc5813d1c48cf59ddc4e4e21745c057e2ddb77460cf8407a717884b84aafca91fa5ce88fc696ea02ae343a4e21b28e8a1740c4e

    Download Submit