Overview
overview
9Static
static
830bc4934d7...f0.exe
windows7-x64
630bc4934d7...f0.exe
windows10-2004-x64
6338fdf3626...13.exe
windows7-x64
1338fdf3626...13.exe
windows10-2004-x64
1342933cb4c...20.exe
windows7-x64
7342933cb4c...20.exe
windows10-2004-x64
9343ace5874...03.exe
windows7-x64
3343ace5874...03.exe
windows10-2004-x64
834818CE171...49.dll
windows7-x64
834818CE171...49.dll
windows10-2004-x64
8360390_crypt.exe
windows7-x64
1360390_crypt.exe
windows10-2004-x64
3360390_tree.cmd
windows7-x64
7360390_tree.cmd
windows10-2004-x64
73896f8a370...e_.exe
windows7-x64
83896f8a370...e_.exe
windows10-2004-x64
73a061ee07d...8c.dll
windows7-x64
33a061ee07d...8c.dll
windows10-2004-x64
33af4fa2bff...d1.dll
windows7-x64
33af4fa2bff...d1.dll
windows10-2004-x64
33bb691982d...21.exe
windows7-x64
13bb691982d...21.exe
windows10-2004-x64
93e3f980ab6...95.exe
windows7-x64
73e3f980ab6...95.exe
windows10-2004-x64
73e3f980ab6...26.exe
windows7-x64
73e3f980ab6...26.exe
windows10-2004-x64
33e75e8238a..._2.exe
windows7-x64
63e75e8238a..._2.exe
windows10-2004-x64
6400cad56ff...9a.exe
windows7-x64
9400cad56ff...9a.exe
windows10-2004-x64
940b3cb2a21...0c.exe
windows7-x64
740b3cb2a21...0c.exe
windows10-2004-x64
9Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2025, 16:52
Behavioral task
behavioral1
Sample
30bc4934d7e29c8c4c4c9be0510fc7558fddf8db666a0343784c5cf1587b3af0.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
30bc4934d7e29c8c4c4c9be0510fc7558fddf8db666a0343784c5cf1587b3af0.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
338fdf3626aa4a48a5972f291aacf3d6172dd920fe16ac4da4dd6c5b999d2f13.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
338fdf3626aa4a48a5972f291aacf3d6172dd920fe16ac4da4dd6c5b999d2f13.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
34818CE171EA150B91429AC1DD6FBE49.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
34818CE171EA150B91429AC1DD6FBE49.dll
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
360390_crypt.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
360390_crypt.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
360390_tree.cmd
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
360390_tree.cmd
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
3896f8a37034429e9784d767765d85ef6dcde105320568516fac4e31400514db.exe_.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
3896f8a37034429e9784d767765d85ef6dcde105320568516fac4e31400514db.exe_.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral17
Sample
3a061ee07d87a6bb13e613e000e9f685cbffb96bd7024a9e7b4cb0be9a4af38c.dll
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
3a061ee07d87a6bb13e613e000e9f685cbffb96bd7024a9e7b4cb0be9a4af38c.dll
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
3af4fa2bffaab37fd557ae8146ae0a29ba0faf6d99ad8a1a8d5bf598ac9a23d1.dll
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
3af4fa2bffaab37fd557ae8146ae0a29ba0faf6d99ad8a1a8d5bf598ac9a23d1.dll
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe
Resource
win7-20250207-en
Behavioral task
behavioral22
Sample
3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral23
Sample
3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_Dumped_TDS=4FBA3695.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_Dumped_TDS=4FBA3695.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_TDS=4FBADA26.exe
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_TDS=4FBADA26.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
3e75e8238a6bbd8817164658696198af_72889f61171de37d6b4d59016c55ec52__2.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
3e75e8238a6bbd8817164658696198af_72889f61171de37d6b4d59016c55ec52__2.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral29
Sample
400cad56ff3d210346cf6c4795aeb607e5b211b3dc4a8421b9437621c254239a.exe
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
400cad56ff3d210346cf6c4795aeb607e5b211b3dc4a8421b9437621c254239a.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
40b3cb2a210fafdaabdebefe1430862bd1192a80fcde84f51ceb387136d1410c.exe
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
40b3cb2a210fafdaabdebefe1430862bd1192a80fcde84f51ceb387136d1410c.exe
Resource
win10v2004-20250314-en
General
-
Target
342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
-
Size
1.2MB
-
MD5
a393b9536a1caa34914636d3da7378b5
-
SHA1
5aced706d9f6a0bb6a95c8bdf1e123485219a123
-
SHA256
342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20
-
SHA512
4ac4b2c2f87d305f3073f79136cec44cacca296f75451c6d67653b9de4a2b871409a11631e5ff5d76478c3043e5f47040e72e2f86db1536079f586c12ebd42de
-
SSDEEP
12288:2CdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBgac9Q9bNHTQx:2Cdxte/80jYLT3U1jfsWakQpNHTQx
Malware Config
Signatures
-
Renames multiple (402) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe -
Executes dropped EXE 2 IoCs
pid Process 1276 scvhost.exe 4496 scvhost.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\scvhost.exe" scvhost.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\l: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\g: scvhost.exe File opened (read-only) \??\x: scvhost.exe File opened (read-only) \??\s: scvhost.exe File opened (read-only) \??\e: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\o: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\r: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\o: scvhost.exe File opened (read-only) \??\s: scvhost.exe File opened (read-only) \??\u: scvhost.exe File opened (read-only) \??\g: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\s: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\w: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\y: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\u: scvhost.exe File opened (read-only) \??\v: scvhost.exe File opened (read-only) \??\e: scvhost.exe File opened (read-only) \??\e: scvhost.exe File opened (read-only) \??\r: scvhost.exe File opened (read-only) \??\n: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\w: scvhost.exe File opened (read-only) \??\z: scvhost.exe File opened (read-only) \??\g: scvhost.exe File opened (read-only) \??\k: scvhost.exe File opened (read-only) \??\p: scvhost.exe File opened (read-only) \??\x: scvhost.exe File opened (read-only) \??\l: scvhost.exe File opened (read-only) \??\i: scvhost.exe File opened (read-only) \??\j: scvhost.exe File opened (read-only) \??\o: scvhost.exe File opened (read-only) \??\q: scvhost.exe File opened (read-only) \??\p: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\u: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\b: scvhost.exe File opened (read-only) \??\h: scvhost.exe File opened (read-only) \??\h: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\v: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\q: scvhost.exe File opened (read-only) \??\r: scvhost.exe File opened (read-only) \??\b: scvhost.exe File opened (read-only) \??\i: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\n: scvhost.exe File opened (read-only) \??\t: scvhost.exe File opened (read-only) \??\i: scvhost.exe File opened (read-only) \??\v: scvhost.exe File opened (read-only) \??\y: scvhost.exe File opened (read-only) \??\t: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\j: scvhost.exe File opened (read-only) \??\l: scvhost.exe File opened (read-only) \??\t: scvhost.exe File opened (read-only) \??\a: scvhost.exe File opened (read-only) \??\h: scvhost.exe File opened (read-only) \??\j: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\k: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\x: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\m: scvhost.exe File opened (read-only) \??\p: scvhost.exe File opened (read-only) \??\w: scvhost.exe File opened (read-only) \??\a: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\m: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\z: 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe File opened (read-only) \??\k: scvhost.exe File opened (read-only) \??\y: scvhost.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral6/files/0x000a0000000227af-11.dat autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1276 scvhost.exe 1276 scvhost.exe 4496 scvhost.exe 4496 scvhost.exe 4496 scvhost.exe 4496 scvhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1276 scvhost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 6124 wrote to memory of 1276 6124 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe 87 PID 6124 wrote to memory of 1276 6124 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe 87 PID 6124 wrote to memory of 1276 6124 342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe 87 PID 5844 wrote to memory of 4496 5844 cmd.exe 92 PID 5844 wrote to memory of 4496 5844 cmd.exe 92 PID 5844 wrote to memory of 4496 5844 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe"C:\Users\Admin\AppData\Local\Temp\342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Users\Admin\AppData\Roaming\scvhost.exe"C:\Users\Admin\AppData\Roaming\scvhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1276
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\scvhost.exe1⤵
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Roaming\scvhost.exeC:\Users\Admin\AppData\Roaming\scvhost.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4496
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133864073326065394.txt.locked
Filesize77KB
MD5e7c4a0f3c79924828527d4c510d7929e
SHA13c2eb239296b1667f2652335e2b52ee1168693cd
SHA256c27b9f76e435675ed26cd0d9797194bd5e2e85dd16b601dc70b39b4ee1acd1fd
SHA5129d5253a084850ba3ebb2e9461cac375bc694eed30eec9850864a59bd4a22b885c4c7bc4c6df420112a0426d4b650fed686bb7245aee5829c4c74299a6f988dc4
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133864078989255826.txt.locked
Filesize48KB
MD533bcbc8396d4e18110868a9dfe1291eb
SHA1f6c75a9bd688183a79589c7dba7f026ec9bc2ba4
SHA256fff2e0196e51cdbe5be0ed4fd09107d228735d0e9de731992c0ebf1e70fdb44d
SHA512f6f91981d5ee98452a86fcc89341a505d7a1b94b8122592054e3547e073be0a115d5c63f72a798615120dc4ab66f9a9f54c712fdf6b21886ced1c6a9dbefed6e
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133864081664967149.txt.locked
Filesize65KB
MD5a4393d9f56c4d4339df5bdb0c27e44d2
SHA1536f2248cecbf7c162d941f2e6b0a1fdf2e10a09
SHA25640cbf60b942dcdc0963947b69dcde14ae9fd385c7b3287acc275c15c8af7a7bb
SHA51269b04ad679ed1f81abe8dd4593de4bd525d6506a8bc201974a3730c8d7e2078d47b0c20a79dc0bb36fbdea3f42d9141bc8b2097d8937b8b43c055ae251db626e
-
Filesize
5KB
MD5bf12a5e778353606c4d1e164251e8253
SHA15d68c7e6464c8109367320aeb8383e10de8398ab
SHA2568200344a9c877424f0016d3fd1d309d9eaec7f9fd93821fc73602526700cfa57
SHA512e71293b65a503f8dfe3d74649e6264f586a48f4f97343ce5f215058b238d97350d428604853cf4dd2e8d05569032db45a23d72bd21245060a9fd8f49955ddc31
-
Filesize
26KB
MD5daa74c9be0ea2bcbf174c3398e98dbfb
SHA1e5a23e3853fdcf2fab54d6a708091086a0370282
SHA2564c37593255835b87267a97e401eb97a177f9ee96fd8edb83b7df4e539d2f26ac
SHA5126b3ccf7a0ce3a68bf0f7e8823e9129baa10c26b56d698a079564bc2c8a1ca60ecae7ae9b24f3b592f53a07f2b3128f0520e3a02c408e8d927c24ff720ac28d9c
-
Filesize
31B
MD5776dbc21c927d4c3c76c357005173a22
SHA17ddb8a3cd3f8518badbf63c5285c805a204be6b1
SHA256a60c22098ffe54de24699d8a8e4a086db15eb50b20b46cf588b79c4bb62bb1fb
SHA512bf31b71633c1ea231be16a2bd9a49ba5a657244fd4908824b33c95f4e3d671ec9a4a4d8dfca72dbe3dbd2c907e4fc99c4467edc5b3de2fc5b3afdac112d195dd
-
Filesize
55B
MD51bddfddd28ae6ea7ced6138f75374f7d
SHA14262418511b23cf91f12f59c986861727a2b72ca
SHA256663e9942e5dd533373b24f10d1a299f99c7ffb8ad8dad6abbcde8be4921218f9
SHA512d66f8b2fc4820782ba3c4921acf33a3ff9d3011c244d3af2c7569fd4be662015d2d3a4dfa0168da5e7b896816ecc118734dafc0fdafdb058ee909bf10be07d21
-
Filesize
4KB
MD523b8456edd79cafe0fe0a6ffe38cba9a
SHA122ee66a87e524231912caeb05da690a771f73afd
SHA256908cf01851fee15467d3f746fff8bc3a2c51cff623bedd20e4eb93a63bfd2af9
SHA51237fa2306f0f3c07ffd13456d6ae1b06dbf61f8247fb69ef3373d96e59d61b2fc093603a4b5e8c293db21adbee6e2b82ce3aff21b64f0382c2cc14de0e94d5008
-
Filesize
1.2MB
MD5a393b9536a1caa34914636d3da7378b5
SHA15aced706d9f6a0bb6a95c8bdf1e123485219a123
SHA256342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20
SHA5124ac4b2c2f87d305f3073f79136cec44cacca296f75451c6d67653b9de4a2b871409a11631e5ff5d76478c3043e5f47040e72e2f86db1536079f586c12ebd42de