Overview

overview

10

Static

static

3

svchost32.exe

windows10-2004-x64

10

svchost32.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    31/05/2026, 15:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    svchost32.exe
  • Size 18KB
  • Sample260531-sl4blsa15x
  • SHA256 a0f039129e18179930cb96eb689b990d6d1d6a19dc75c63801662c018edfedee
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionpersistenceransomware

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
    persistence
  • Renames multiple (156) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Disables RegEdit via registry modification 4 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables cmd.exe use via registry modification 4 IoCs
    defense_evasion
  • Adds Run key to start application 2 TTPs 12 IoCs
    persistence
  • Kills process with taskkill 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\svchost32.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill" /f /im explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3368
  • C:\Users\Admin\AppData\Local\Temp\svchost32.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost32.exe" --init
    1⤵
    • Modifies WinLogon for persistence
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Windows\system32\taskkill.exe
      "taskkill" /f /im explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3608
  • C:\Users\Admin\AppData\Local\Temp\svchost32.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:8
    • C:\Windows\system32\taskkill.exe
      "taskkill" /f /im explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3696
  • C:\Users\Admin\AppData\Local\Temp\svchost32.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost32.exe" -startup
    1⤵
    • Modifies WinLogon for persistence
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3832
    • C:\Windows\system32\taskkill.exe
      "taskkill" /f /im explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1572

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        info-Locker.txt
        • Path C:\Users\Admin\Documents\info-Locker.txt
        • Size 201B
        • SHA256 ab9fdd3a8419cb10563e15c4c802142df3837e41380ee03b77af0f4ebd04aa67
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CloseAdd.mhtml.tmp
        • Path C:\Users\Admin\Downloads\CloseAdd.mhtml.tmp
        • Size 659KB
        • SHA256 3ea5830da669e6d3f076ae4eb7f060cd4f6f1d9eb5e7b8408797d4e213552945
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        desktop.ini.tmp
        • Path C:\Users\Admin\Downloads\desktop.ini.tmp
        • Size 282B
        • SHA256 3dbbbcad55f9d17f613f868932d92ba7fa4335e2d2e8eeb821fb4a55b2a730d5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        desktop.ini.tmp
        • Path C:\Users\Admin\Pictures\Camera Roll\desktop.ini.tmp
        • Size 190B
        • SHA256 9826065865d1d23130c205c7b52ad497c882af9e1ba3685d9ab273827a93f4bb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        desktop.ini.tmp
        • Path C:\Users\Admin\Pictures\desktop.ini.tmp
        • Size 504B
        • SHA256 01eb6e8214b3c82a6a86cdd8136b13484a5bbaa6fa851083461efb736479feea
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        desktop.ini.tmp
        • Path C:\Users\Admin\Videos\desktop.ini.tmp
        • Size 504B
        • SHA256 8ab9910fab5f4fd58575e3a07c23b831651c9041a8eaded1cf853400dcc19646
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2864-0-0x000001453BF00000-0x000001453BF0A000-memory.dmp
        Download

        memory/2864-1-0x000001453DB00000-0x000001453DB10000-memory.dmp
        Download

        memory/2864-2-0x000001453DB00000-0x000001453DB10000-memory.dmp
        Download