Overview

overview

10

Static

static

10

scvhost.exe

windows7-x64

10

scvhost.exe

windows10-2004-x64

10

scvhost.exe

android-9-x86

scvhost.exe

android-13-x64

scvhost.exe

macos-10.15-amd64

scvhost.exe

ubuntu-18.04-amd64

scvhost.exe

debian-9-armhf

scvhost.exe

debian-9-mips

scvhost.exe

debian-9-mipsel

Resubmissions

05-02-2025 10:34

250205-mmassssng1 10

05-02-2025 10:33

250205-mlx7pssnfz 10

13-01-2022 17:53

220113-wgrc2abhgp 10

Analysis

  • max time kernel
    91s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05-02-2025 10:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    scvhost.exe

  • Size

    500KB

  • MD5

    e04becb4c8ff826e5e5aa305dee074bc

  • SHA1

    07bf49663c9c76e4a468a98f2fe3a55977432a39

  • SHA256

    5fa8c4ab6dc45672099078277903cce8e86ae1e310f24a0dd9862166e3c0e30c

  • SHA512

    cb4c086df9395d1ebc68cc576d241e584c454e45db5365ed2196f0529cb6c2cad70b0f061e7fced4d980f10aabf8829f6e69602be8e086f73d9c1aa7d4d48fa2

  • SSDEEP

    12288:uKWAb1TS+OeO+OeNhBBhhBB8dBwD9EX1hQvuqN/4fsw86:uKWe+dBk9EFO7NQh

Score
10/10
mespinozadiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Readme.README

Ransom Note
Hi Company, Every byte on any types of your devices was encrypted. Don't try to use backups because it were encrypted too. To get all your data back contact us: [email protected] Also, be aware that we downloaded files from your servers and in case of non-payment we will be forced to upload them on our website, and if necessary, we will sell them on the darknet. Check out our website, we just posted there new updates for our partners: http://pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion/ To go to our site you have to use TOR Browser. Download link: https://www.torproject.org/download/ -------------- FAQ: 1. Q: How can I make sure you don't fooling me? A: You can send us 2 files(max 2mb). 2. Q: What to do to get all data back? A: Don't restart the computer, don't move files and write us. 3. Q: What if I have no response? A: Wait and we will answer you in 24 hours. 4. Q: What to tell my boss? A: Protect Your System Amigo.
URLs

http://pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion/

Signatures

  • Mespinoza Ransomware 2 TTPs

    Also known as Pysa. Ransomware-as-a-servoce which first appeared in 2020.

    ransomwaremespinoza
  • Mespinoza family
    mespinoza
  • Renames multiple (2571) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 7 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\scvhost.exe
    C:\Users\Admin\AppData\Local\Temp\scvhost.exe dsrm -subtree -noprompt -c user"http://+:443"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2464
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\update.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\update.bat
    Filesize

    225B

    MD5

    8b62af0dab0aede04ce53ce7022fcf1c

    SHA1

    0f5f1d427531c502d8c46348cf5d52fe9d5e6bad

    SHA256

    f1202f4d1dd1b0d974eed9c7ebe97552522208c860dede4251b6b001f66143d8

    SHA512

    1884c41110456211f7cb163483bff6128700d9a8164354cf386abd3eaada7aa45e1112fd87adebb75375793a12e7c7785446f2326bf2c54bb6d81050a8f38451

    Download Submit

  • C:\Users\Readme.README
    Filesize

    1019B

    MD5

    2c4008e4abaea0c31c8f340163d05ae7

    SHA1

    8f2b914094ae1fd0cb802085f9f12b00a6fe6a63

    SHA256

    fb6ea25124c44ca61ec2c13eaaf872fc1ccf73f59efb91296dbb36cefd7a02cd

    SHA512

    6b94fd44f9e0eab149aece2263fb32b9cc6cefdb99e1b2d12b51837922933d3e16cb4bc045ab5ae392320aa3e10e7c9aea46ecf5cff18d70820ffa68def39c28

    Download Submit