Overview

overview

10

Static

static

10

scvhost.exe

windows11-21h2-x64

10

scvhost.exe

windows7-x64

10

scvhost.exe

windows10-2004-x64

10

scvhost.exe

windows10-ltsc_2021-x64

10

scvhost.exe

windows11-21h2-x64

10

Resubmissions

28/03/2025, 16:33

250328-t2z5kayvbw10

25/03/2025, 14:33

250325-rwtz9axvhy10

25/03/2025, 14:30

250325-rt744a1ly810

05/02/2025, 10:34

250205-mmassssng110

05/02/2025, 10:33

250205-mlx7pssnfz10

13/01/2022, 17:53

220113-wgrc2abhgp10

Analysis

  • max time kernel
    19s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    25/03/2025, 14:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    scvhost.exe
  • Size 500KB
  • Sample250325-rt744a1ly8
  • SHA256 5fa8c4ab6dc45672099078277903cce8e86ae1e310f24a0dd9862166e3c0e30c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
mespinozadiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Readme.README

Ransom Note
  • Hi Company, Every byte on any types of your devices was encrypted. Don't try to use backups because it were encrypted too. To get all your data back contact us: [email protected] Also, be aware that we downloaded files from your servers and in case of non-payment we will be forced to upload them on our website, and if necessary, we will sell them on the darknet. Check out our website, we just posted there new updates for our partners: http://pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion/ To go to our site you have to use TOR Browser. Download link: https://www.torproject.org/download/ -------------- FAQ: 1. Q: How can I make sure you don't fooling me? A: You can send us 2 files(max 2mb). 2. Q: What to do to get all data back? A: Don't restart the computer, don't move files and write us. 3. Q: What if I have no response? A: Wait and we will answer you in 24 hours. 4. Q: What to tell my boss? A: Protect Your System Amigo.
URLs

  • http://pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion/

Signatures

  • Mespinoza Ransomware 2 TTPs

    Also known as Pysa. Ransomware-as-a-servoce which first appeared in 2020.

    ransomwaremespinoza
  • Mespinoza family
    mespinoza
  • Renames multiple (2576) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 7 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\scvhost.exe
    C:\Users\Admin\AppData\Local\Temp\scvhost.exe bcdedit /set shutdown /r /f /t 2
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2084
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\update.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2752

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        update.bat
        • Path C:\Users\Admin\AppData\Local\Temp\update.bat
        • Size 225B
        • SHA256 f1202f4d1dd1b0d974eed9c7ebe97552522208c860dede4251b6b001f66143d8
        • MD5 SHA1 SHA512
        Submit Download

        Readme.README
        • Path C:\Users\Readme.README
        • Size 1019B
        • SHA256 fb6ea25124c44ca61ec2c13eaaf872fc1ccf73f59efb91296dbb36cefd7a02cd
        • MD5 SHA1 SHA512
        Submit Download