Analysis
-
max time kernel
50s -
platform
windows11-21h2_x64 -
resource
win11-20250314-en -
resource tags
arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system -
submitted
24/03/2025, 18:17
Behavioral task
behavioral1
Sample
Serverice.Host.local.exe
Resource
win11-20250314-en
General
-
Target
Serverice.Host.local.exe
-
Size
182KB
-
MD5
d206dd07a32132a06af8fe1d0f3eec55
-
SHA1
ac3c7dc216a9351905379f612bbe132906020384
-
SHA256
1e10c6e0e448b51d612f5363b5b4edd2d52d3862287388e5172fdf0d3736dc0e
-
SHA512
dbbfb14cdf7bc9fc02f210112be10bc9c410d2c8b9e48545313e39004fcab09c273cbe0d0e94a947483f760ca3e8c3824272973e14cec63a43a60f6336bf36ee
-
SSDEEP
3072:2oLIVr9G3hCJxtY4sdP6VZn6ZCHGIQZT7TMPD6HCq4X:or9khCJLYiZnCCUZXTMbBq4
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 2 IoCs
resource yara_rule behavioral1/memory/5808-1-0x0000000000D90000-0x0000000000DC4000-memory.dmp family_chaos behavioral1/files/0x001a00000002b3c5-6.dat family_chaos -
Chaos family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2780 bcdedit.exe 4744 bcdedit.exe -
pid Process 1732 wbadmin.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OPTIMUS_readme.txt svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 5996 svchost.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
description ioc Process File opened for modification C:\Users\Admin\OneDrive\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3920535620-1286624088-2946613906-1000\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini svchost.exe File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qqawreypo.jpg" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2988 vssadmin.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000_Classes\Local Settings svchost.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1924 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5996 svchost.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 5808 Serverice.Host.local.exe 5808 Serverice.Host.local.exe 5808 Serverice.Host.local.exe 5808 Serverice.Host.local.exe 5808 Serverice.Host.local.exe 5808 Serverice.Host.local.exe 5808 Serverice.Host.local.exe 5808 Serverice.Host.local.exe 5808 Serverice.Host.local.exe 5808 Serverice.Host.local.exe 5808 Serverice.Host.local.exe 5808 Serverice.Host.local.exe 5808 Serverice.Host.local.exe 5808 Serverice.Host.local.exe 5808 Serverice.Host.local.exe 5808 Serverice.Host.local.exe 5808 Serverice.Host.local.exe 5996 svchost.exe 5996 svchost.exe 5996 svchost.exe 5996 svchost.exe 5996 svchost.exe 5996 svchost.exe 5996 svchost.exe 5996 svchost.exe 5996 svchost.exe 5996 svchost.exe 5996 svchost.exe 5996 svchost.exe 5996 svchost.exe 5996 svchost.exe 5996 svchost.exe 5996 svchost.exe 5996 svchost.exe 5996 svchost.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeDebugPrivilege 5808 Serverice.Host.local.exe Token: SeDebugPrivilege 5996 svchost.exe Token: SeBackupPrivilege 3112 vssvc.exe Token: SeRestorePrivilege 3112 vssvc.exe Token: SeAuditPrivilege 3112 vssvc.exe Token: SeIncreaseQuotaPrivilege 1820 WMIC.exe Token: SeSecurityPrivilege 1820 WMIC.exe Token: SeTakeOwnershipPrivilege 1820 WMIC.exe Token: SeLoadDriverPrivilege 1820 WMIC.exe Token: SeSystemProfilePrivilege 1820 WMIC.exe Token: SeSystemtimePrivilege 1820 WMIC.exe Token: SeProfSingleProcessPrivilege 1820 WMIC.exe Token: SeIncBasePriorityPrivilege 1820 WMIC.exe Token: SeCreatePagefilePrivilege 1820 WMIC.exe Token: SeBackupPrivilege 1820 WMIC.exe Token: SeRestorePrivilege 1820 WMIC.exe Token: SeShutdownPrivilege 1820 WMIC.exe Token: SeDebugPrivilege 1820 WMIC.exe Token: SeSystemEnvironmentPrivilege 1820 WMIC.exe Token: SeRemoteShutdownPrivilege 1820 WMIC.exe Token: SeUndockPrivilege 1820 WMIC.exe Token: SeManageVolumePrivilege 1820 WMIC.exe Token: 33 1820 WMIC.exe Token: 34 1820 WMIC.exe Token: 35 1820 WMIC.exe Token: 36 1820 WMIC.exe Token: SeIncreaseQuotaPrivilege 1820 WMIC.exe Token: SeSecurityPrivilege 1820 WMIC.exe Token: SeTakeOwnershipPrivilege 1820 WMIC.exe Token: SeLoadDriverPrivilege 1820 WMIC.exe Token: SeSystemProfilePrivilege 1820 WMIC.exe Token: SeSystemtimePrivilege 1820 WMIC.exe Token: SeProfSingleProcessPrivilege 1820 WMIC.exe Token: SeIncBasePriorityPrivilege 1820 WMIC.exe Token: SeCreatePagefilePrivilege 1820 WMIC.exe Token: SeBackupPrivilege 1820 WMIC.exe Token: SeRestorePrivilege 1820 WMIC.exe Token: SeShutdownPrivilege 1820 WMIC.exe Token: SeDebugPrivilege 1820 WMIC.exe Token: SeSystemEnvironmentPrivilege 1820 WMIC.exe Token: SeRemoteShutdownPrivilege 1820 WMIC.exe Token: SeUndockPrivilege 1820 WMIC.exe Token: SeManageVolumePrivilege 1820 WMIC.exe Token: 33 1820 WMIC.exe Token: 34 1820 WMIC.exe Token: 35 1820 WMIC.exe Token: 36 1820 WMIC.exe Token: SeBackupPrivilege 2832 wbengine.exe Token: SeRestorePrivilege 2832 wbengine.exe Token: SeSecurityPrivilege 2832 wbengine.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 5808 wrote to memory of 5996 5808 Serverice.Host.local.exe 78 PID 5808 wrote to memory of 5996 5808 Serverice.Host.local.exe 78 PID 5996 wrote to memory of 348 5996 svchost.exe 80 PID 5996 wrote to memory of 348 5996 svchost.exe 80 PID 348 wrote to memory of 2988 348 cmd.exe 82 PID 348 wrote to memory of 2988 348 cmd.exe 82 PID 348 wrote to memory of 1820 348 cmd.exe 85 PID 348 wrote to memory of 1820 348 cmd.exe 85 PID 5996 wrote to memory of 1412 5996 svchost.exe 87 PID 5996 wrote to memory of 1412 5996 svchost.exe 87 PID 1412 wrote to memory of 2780 1412 cmd.exe 89 PID 1412 wrote to memory of 2780 1412 cmd.exe 89 PID 1412 wrote to memory of 4744 1412 cmd.exe 90 PID 1412 wrote to memory of 4744 1412 cmd.exe 90 PID 5996 wrote to memory of 1508 5996 svchost.exe 91 PID 5996 wrote to memory of 1508 5996 svchost.exe 91 PID 1508 wrote to memory of 1732 1508 cmd.exe 93 PID 1508 wrote to memory of 1732 1508 cmd.exe 93 PID 5996 wrote to memory of 1924 5996 svchost.exe 97 PID 5996 wrote to memory of 1924 5996 svchost.exe 97 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Serverice.Host.local.exe"C:\Users\Admin\AppData\Local\Temp\Serverice.Host.local.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:2988
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1820
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:2780
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:4744
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:1732
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\OPTIMUS_readme.txt3⤵
- Opens file in notepad (likely ransom note)
PID:1924
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3112
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1040
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:5500
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
182KB
MD5d206dd07a32132a06af8fe1d0f3eec55
SHA1ac3c7dc216a9351905379f612bbe132906020384
SHA2561e10c6e0e448b51d612f5363b5b4edd2d52d3862287388e5172fdf0d3736dc0e
SHA512dbbfb14cdf7bc9fc02f210112be10bc9c410d2c8b9e48545313e39004fcab09c273cbe0d0e94a947483f760ca3e8c3824272973e14cec63a43a60f6336bf36ee
-
Filesize
1KB
MD57741528464e9dabb2bf527618bb17b30
SHA1d9cd59d1aeff9e5e94729a40ca12c01d635c5b8f
SHA256adf04def25d25f7f21a87b76f55d27c3d28089c38290e3fabd153eebe26f92eb
SHA51202ce6c4a0370511f893a02e7e37c7aeb0afaadb9d707e9be46bc28abdb4e1ed5eb8af8e2db1b55094b72bb8e906cd93960b35c0d0fe6c583157bd24080d18ee7