Overview

overview

10

Static

static

10

scvhost.exe

windows11-21h2-x64

10

Resubmissions

28/03/2025, 16:33

250328-t2z5kayvbw 10

25/03/2025, 14:33

250325-rwtz9axvhy 10

25/03/2025, 14:30

250325-rt744a1ly8 10

05/02/2025, 10:34

250205-mmassssng1 10

05/02/2025, 10:33

250205-mlx7pssnfz 10

13/01/2022, 17:53

220113-wgrc2abhgp 10

Analysis

  • max time kernel
    259s
  • max time network
    240s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250314-en
  • resource tags

    arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28/03/2025, 16:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    scvhost.exe

  • Size

    500KB

  • MD5

    e04becb4c8ff826e5e5aa305dee074bc

  • SHA1

    07bf49663c9c76e4a468a98f2fe3a55977432a39

  • SHA256

    5fa8c4ab6dc45672099078277903cce8e86ae1e310f24a0dd9862166e3c0e30c

  • SHA512

    cb4c086df9395d1ebc68cc576d241e584c454e45db5365ed2196f0529cb6c2cad70b0f061e7fced4d980f10aabf8829f6e69602be8e086f73d9c1aa7d4d48fa2

  • SSDEEP

    12288:uKWAb1TS+OeO+OeNhBBhhBB8dBwD9EX1hQvuqN/4fsw86:uKWe+dBk9EFO7NQh

Score
10/10
mespinozadiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\90bc16654a7d6c5c99\Readme.README

Ransom Note
Hi Company, Every byte on any types of your devices was encrypted. Don't try to use backups because it were encrypted too. To get all your data back contact us: [email protected] Also, be aware that we downloaded files from your servers and in case of non-payment we will be forced to upload them on our website, and if necessary, we will sell them on the darknet. Check out our website, we just posted there new updates for our partners: http://pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion/ To go to our site you have to use TOR Browser. Download link: https://www.torproject.org/download/ -------------- FAQ: 1. Q: How can I make sure you don't fooling me? A: You can send us 2 files(max 2mb). 2. Q: What to do to get all data back? A: Don't restart the computer, don't move files and write us. 3. Q: What if I have no response? A: Wait and we will answer you in 24 hours. 4. Q: What to tell my boss? A: Protect Your System Amigo.
URLs

http://pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion/

Signatures

  • Mespinoza Ransomware 2 TTPs

    Also known as Pysa. Ransomware-as-a-servoce which first appeared in 2020.

    ransomwaremespinoza
  • Mespinoza family
    mespinoza
  • Renames multiple (3382) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 3 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\scvhost.exe
    "C:\Users\Admin\AppData\Local\Temp\scvhost.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2672
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\update.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:912
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3236
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:3028
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2908
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5852
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Readme.txt
      1⤵
      • Opens file in notepad (likely ransom note)
      PID:4392

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\90bc16654a7d6c5c99\Readme.README
      Filesize

      1019B

      MD5

      2c4008e4abaea0c31c8f340163d05ae7

      SHA1

      8f2b914094ae1fd0cb802085f9f12b00a6fe6a63

      SHA256

      fb6ea25124c44ca61ec2c13eaaf872fc1ccf73f59efb91296dbb36cefd7a02cd

      SHA512

      6b94fd44f9e0eab149aece2263fb32b9cc6cefdb99e1b2d12b51837922933d3e16cb4bc045ab5ae392320aa3e10e7c9aea46ecf5cff18d70820ffa68def39c28

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\update.bat
      Filesize

      225B

      MD5

      8b62af0dab0aede04ce53ce7022fcf1c

      SHA1

      0f5f1d427531c502d8c46348cf5d52fe9d5e6bad

      SHA256

      f1202f4d1dd1b0d974eed9c7ebe97552522208c860dede4251b6b001f66143d8

      SHA512

      1884c41110456211f7cb163483bff6128700d9a8164354cf386abd3eaada7aa45e1112fd87adebb75375793a12e7c7785446f2326bf2c54bb6d81050a8f38451

      Download Submit