Overview

overview

9

Static

static

5

DeviceHost.exe

windows10-2004-x64

9

DeviceHost.exe

windows11-ltsc_2024-x64

9

Analysis

  • user interaction
    yes
  • max time kernel
    129s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/06/2026, 04:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DeviceHost.exe
  • Size 780KB
  • Sample260629-fa2mesds7t
  • SHA256 74dd8cdc532329315bf12d2ad2376d5ad0eab28f25a931911bdb23264ad9e3e2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoverypersistenceransomwareupx

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 4 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Drops file in Drivers directory 64 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 2 IoCs
    defense_evasion
  • Manipulates Digital Signatures 4 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 4 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Modifies termsrv.dll 1 TTPs 1 IoCs

    Commonly used to allow simultaneous RDP sessions.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies registry class 3 IoCs
  • Opens file in notepad (likely ransom note) 3 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DeviceHost.exe
    "C:\Users\Admin\AppData\Local\Temp\DeviceHost.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Looks for VMWare services registry key.
    • Checks computer location settings
    • Maps connected drives based on registry
    • Checks system information in the registry
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe path win32_VideoController get name /value
      2⤵
      • Detects videocard installed
      • Suspicious use of AdjustPrivilegeToken
      PID:540
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe computersystem get manufacturer /value
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4828
    • C:\Windows\System32\Wbem\wmic.exe
      wmic.exe computersystem get model /value
      2⤵
        PID:4980
      • C:\Windows\System32\Wbem\wmic.exe
        wmic.exe bios get manufacturer /value
        2⤵
          PID:408
        • C:\Windows\System32\Wbem\wmic.exe
          wmic.exe bios get serialnumber /value
          2⤵
            PID:3816
          • C:\Windows\System32\Wbem\wmic.exe
            wmic.exe bios get version /value
            2⤵
              PID:4408
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\kill_yourself.cmd"
              2⤵
              • Drops file in Drivers directory
              • Manipulates Digital Signatures
              • Boot or Logon Autostart Execution: Print Processors
              • Drops desktop.ini file(s)
              • Drops autorun.inf file
              • Drops file in System32 directory
              • Modifies termsrv.dll
              • Drops file in Windows directory
              PID:1060
          • C:\Program Files\VideoLAN\VLC\vlc.exe
            "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\StartFind.mp3"
            1⤵
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:2116
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
            1⤵
              PID:4888
            • C:\Windows\system32\OpenWith.exe
              C:\Windows\system32\OpenWith.exe -Embedding
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3208
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\CheckpointAssert.ocx
                2⤵
                • Opens file in notepad (likely ransom note)
                PID:2268
            • C:\Windows\system32\OpenWith.exe
              C:\Windows\system32\OpenWith.exe -Embedding
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2672
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\SyncUnlock.pptx
                2⤵
                • Opens file in notepad (likely ransom note)
                PID:2084
            • C:\Windows\SysWOW64\mshta.exe
              "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Downloads\FindRestore.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
              1⤵
              • System Location Discovery: System Language Discovery
              PID:2328
            • C:\Windows\System32\Notepad.exe
              "C:\Windows\System32\Notepad.exe" C:\Users\Admin\Desktop\ConvertRequest.vbe
              1⤵
              • Opens file in notepad (likely ransom note)
              PID:1900
            • C:\Windows\system32\mspaint.exe
              "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Pictures\tNOiRVO.jpg" /ForceBootstrapPaint3D
              1⤵
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:3388
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
              1⤵
                PID:832
              • C:\Windows\system32\OpenWith.exe
                C:\Windows\system32\OpenWith.exe -Embedding
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:4248
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:1840
                • C:\Windows\system32\dashost.exe
                  dashost.exe {32e5e004-a70a-437e-a8266a3d3d2b6249}
                  2⤵
                    PID:4760

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      kill_yourself.cmd
                      • Path C:\Users\Admin\AppData\Local\Temp\kill_yourself.cmd
                      • Size 80B
                      • SHA256 fe94e1a862ff2deb2f466b6986ea571810cf2958325d9e6d90758243c06fe362
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/832-31-0x0000021278FE0000-0x0000021278FE1000-memory.dmp
                      Download

                      memory/832-35-0x0000021279070000-0x0000021279071000-memory.dmp
                      Download

                      memory/832-37-0x0000021279080000-0x0000021279081000-memory.dmp
                      Download

                      memory/832-36-0x0000021279080000-0x0000021279081000-memory.dmp
                      Download

                      memory/832-34-0x0000021279070000-0x0000021279071000-memory.dmp
                      Download

                      memory/832-18-0x0000021270C60000-0x0000021270C70000-memory.dmp
                      Download

                      memory/832-22-0x0000021270CA0000-0x0000021270CB0000-memory.dmp
                      Download

                      memory/832-29-0x0000021278F60000-0x0000021278F61000-memory.dmp
                      Download

                      memory/832-33-0x0000021278FE0000-0x0000021278FE1000-memory.dmp
                      Download

                      memory/2116-17-0x00007FFEC7FB0000-0x00007FFEC8266000-memory.dmp
                      Download

                      memory/2116-15-0x00007FF692E20000-0x00007FF692F18000-memory.dmp
                      Download

                      memory/2116-16-0x00007FFECA0A0000-0x00007FFECA0D4000-memory.dmp
                      Download

                      memory/2864-0-0x00007FF6E40D0000-0x00007FF6E4318000-memory.dmp
                      Download

                      memory/2864-4-0x00007FF6E40D0000-0x00007FF6E4318000-memory.dmp
                      Download