8b0f9d248e67199bb7f1a778a03e4caee7d267e61d8a7d70fa1c1f6d7944e96a

Resubmissions

28/03/2025, 16:52

250328-vdc6kazry9 9

24/03/2025, 22:22

250324-2aphra1jx7 10

Analysis

max time kernel
900s
max time network
432s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2025, 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
Size

1.2MB
MD5

a393b9536a1caa34914636d3da7378b5
SHA1

5aced706d9f6a0bb6a95c8bdf1e123485219a123
SHA256

342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20
SHA512

4ac4b2c2f87d305f3073f79136cec44cacca296f75451c6d67653b9de4a2b871409a11631e5ff5d76478c3043e5f47040e72e2f86db1536079f586c12ebd42de
SSDEEP

12288:2CdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBgac9Q9bNHTQx:2Cdxte/80jYLT3U1jfsWakQpNHTQx

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (342) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe

Executes dropped EXE 1 IoCs

pid	Process
5004	scvhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\scvhost.exe"	scvhost.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\i:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\s:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\e:	scvhost.exe
File opened (read-only)	\??\t:	scvhost.exe
File opened (read-only)	\??\x:	scvhost.exe
File opened (read-only)	\??\e:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\o:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\k:	scvhost.exe
File opened (read-only)	\??\u:	scvhost.exe
File opened (read-only)	\??\z:	scvhost.exe
File opened (read-only)	\??\b:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\m:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\u:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\a:	scvhost.exe
File opened (read-only)	\??\j:	scvhost.exe
File opened (read-only)	\??\o:	scvhost.exe
File opened (read-only)	\??\q:	scvhost.exe
File opened (read-only)	\??\y:	scvhost.exe
File opened (read-only)	\??\q:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\g:	scvhost.exe
File opened (read-only)	\??\h:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\j:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\l:	scvhost.exe
File opened (read-only)	\??\m:	scvhost.exe
File opened (read-only)	\??\r:	scvhost.exe
File opened (read-only)	\??\s:	scvhost.exe
File opened (read-only)	\??\l:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\n:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\v:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\h:	scvhost.exe
File opened (read-only)	\??\v:	scvhost.exe
File opened (read-only)	\??\p:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\k:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\i:	scvhost.exe
File opened (read-only)	\??\p:	scvhost.exe
File opened (read-only)	\??\w:	scvhost.exe
File opened (read-only)	\??\r:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\t:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\w:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\x:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\y:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\z:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
File opened (read-only)	\??\b:	scvhost.exe
File opened (read-only)	\??\n:	scvhost.exe
File opened (read-only)	\??\a:	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral3/files/0x0009000000024082-11.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scvhost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5004	scvhost.exe
5004	scvhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5004	scvhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 5004	1888	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe	89
PID 1888 wrote to memory of 5004	1888	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe	89
PID 1888 wrote to memory of 5004	1888	342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe	89

C:\Users\Admin\AppData\Local\Temp\342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
"C:\Users\Admin\AppData\Local\Temp\342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Roaming\scvhost.exe
  "C:\Users\Admin\AppData\Roaming\scvhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\S2HFQ4RA\3\5qSqWyip_grL-s7BafaqI3Mrk9M.br[1].js.locked

Filesize
16B

MD5
9a777788abd1fe3d26b014b95f1e3c61

SHA1
3ebcc2d10adfc0648d9ceecbeeea3a19a442c2ee

SHA256
526a5b3939b8afd4b79eb98d16b6ff5e7dc9d442b5b1f624250a338f27bafd2f

SHA512
e9075f27a63889a58e699989cff524a17c51ed6458679fa3885dc01d31de802dae5eb5f243dfc0510df6b1dd6f0f4cc308b8d38fa754007817b312566c268023

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133864073512451704.txt.locked

Filesize
77KB

MD5
de3adbb21638c3287a9b8e13a80e794d

SHA1
a965bfd3d8942cb292db18612fe71a8c8806c400

SHA256
0d7754ff3cbcafce856588028aec5bb01cfc6bf4d2ec51a47d53a37e7b39c09c

SHA512
cae262d409a9f7eb2f88e5f331e9569c67d38fc391bc918121629d04cc37a2431054aa1bf1112cff21dacecfcbd4115ac92318862a88ec9b529417a0d494ef0b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133864079499266533.txt.locked

Filesize
48KB

MD5
f4236230c351d67151bf754a5aca5ee8

SHA1
31825bdb80245879d8a2ba1d37984a575ae8880c

SHA256
1c0d76611ddf51a9c5c7deafcc9939c37cd1432fd83e420fb30b3e95b6c654e7

SHA512
a74ab2e0d75797da9c364f34dd8c87841107b39aaa7017d2b9974dcd00ea13428e14298cc19eac37d73c2c71b2e62b79ca7f726ef2103132eacaf6542ca32cd8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133864082182982119.txt.locked

Filesize
65KB

MD5
751633ba5e514094cb1fc26bc4e45eea

SHA1
f3822e7ba665166a1abe3ebc8b15f894c7121b87

SHA256
5f0bd208cfe00486453a0a0b69ad333e367e98bd7451d5a110d7218ad63877e3

SHA512
a42fbf2c92c4e47325c71853cd00c2566f98f9e55842181beaeede0146287c3a21fc6d6220096009fa0da85526b20fb7d4727b338eb89ad9111a0438ce5ea79b

Download Submit
C:\Users\Admin\AppData\Local\Temp\scqpxln

Filesize
26KB

MD5
daa74c9be0ea2bcbf174c3398e98dbfb

SHA1
e5a23e3853fdcf2fab54d6a708091086a0370282

SHA256
4c37593255835b87267a97e401eb97a177f9ee96fd8edb83b7df4e539d2f26ac

SHA512
6b3ccf7a0ce3a68bf0f7e8823e9129baa10c26b56d698a079564bc2c8a1ca60ecae7ae9b24f3b592f53a07f2b3128f0520e3a02c408e8d927c24ff720ac28d9c

Download Submit
C:\Users\Admin\AppData\Roaming\4912CBA6006A6AC9A8BE87DB96020FFB

Filesize
55B

MD5
e544836b56b6e8ab73f673f8a879eef9

SHA1
95977beefd328f107a8c9a7c15a9280de197255b

SHA256
78ff908e9aff30d234b444c230911c76d6d212501d3b11fb4c99659fa48f34ac

SHA512
e3aeef38063179fe05112d68be0ce2e1492c94b3ddc28f75c2a9f03dfe8a8a3391d061182cb7f02170671cd6521ee257a70caeb4bf38e2812d9f1d0d9db21b28

Download Submit
C:\Users\Admin\AppData\Roaming\DBD10426370F575175479FB9D16707A7

Filesize
4KB

MD5
385295420e43ecbe038dcefb4a920877

SHA1
e54640c04691d12e847a41f17f4c0fff8ff0f40d

SHA256
8357f4f6bad647f0a3a60f094c73ceb4c2cbfc64697604c4465722b6e942a75c

SHA512
186b89ca464fe589b92eee5d5622b0a95272d7bda95cdf6ba27c9c456ede191fb0787fbdd47eb50f313e3cadbcb5f5c256a489cc73641eb4e434d9c2e46c8d47

Download Submit
C:\Users\Admin\AppData\Roaming\scvhost.exe

Filesize
1.2MB

MD5
a393b9536a1caa34914636d3da7378b5

SHA1
5aced706d9f6a0bb6a95c8bdf1e123485219a123

SHA256
342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20

SHA512
4ac4b2c2f87d305f3073f79136cec44cacca296f75451c6d67653b9de4a2b871409a11631e5ff5d76478c3043e5f47040e72e2f86db1536079f586c12ebd42de

Download Submit