Analysis
- max time kernel
29s - max time network
32s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 15:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
svchost.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
30 seconds
Behavioral task
behavioral2
Sample
svchost.exe
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
18 signatures
30 seconds
General
- Target svchost.exe
- Size 106KB
- Sample260701-td8f2ahy2n
- SHA256 123adbf441db301f6158641655ddca8ef8a75e00da86c511cb4af83d763fc26e
- MD5 d091898b20cafa852f53fe7954eb056b
- SHA1 40fc416ac7cf0ec0ff6244ccaec8ea07e166c010
- SHA512 8bc0b5c1285b1a18edff87533ad446c03587e38f560b4e986a7a7e4b8dc6250bc1a8846f19af1d39158cbca4f18afd611c9654569a8177d756af1664f4c7b2dd
- SSDEEP 3072:7d3IAxz324N7tjJ5qm9aex3RRkiw0RFY9U2:R4A5faIRLw4m9
- TLSH T1A4B3F15A6BFC4A3AF3BD873159F58653C2F2F9826654DE1D05C243860E32A448256F3F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule behavioral2/memory/1324-11-0x000002242DBD0000-0x000002242DBE1000-memory.dmp family_donutloader - Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions svchost.exe - Looks for VMWare Tools registry key 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools svchost.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe - Drops startup file 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk svchost.exe - Executes dropped EXE 1 IoCs
pid Process 5420 svchost.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 api.ipify.org 2 ip-api.com - Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S svchost.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer svchost.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4624 schtasks.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3684 wmic.exe 3684 wmic.exe 3684 wmic.exe 3684 wmic.exe 5740 svchost.exe 5740 svchost.exe 460 wmic.exe 460 wmic.exe 460 wmic.exe 460 wmic.exe 5420 svchost.exe 5420 svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3684 wmic.exe Token: SeSecurityPrivilege 3684 wmic.exe Token: SeTakeOwnershipPrivilege 3684 wmic.exe Token: SeLoadDriverPrivilege 3684 wmic.exe Token: SeSystemProfilePrivilege 3684 wmic.exe Token: SeSystemtimePrivilege 3684 wmic.exe Token: SeProfSingleProcessPrivilege 3684 wmic.exe Token: SeIncBasePriorityPrivilege 3684 wmic.exe Token: SeCreatePagefilePrivilege 3684 wmic.exe Token: SeBackupPrivilege 3684 wmic.exe Token: SeRestorePrivilege 3684 wmic.exe Token: SeShutdownPrivilege 3684 wmic.exe Token: SeDebugPrivilege 3684 wmic.exe Token: SeSystemEnvironmentPrivilege 3684 wmic.exe Token: SeRemoteShutdownPrivilege 3684 wmic.exe Token: SeUndockPrivilege 3684 wmic.exe Token: SeManageVolumePrivilege 3684 wmic.exe Token: 33 3684 wmic.exe Token: 34 3684 wmic.exe Token: 35 3684 wmic.exe Token: 36 3684 wmic.exe Token: SeIncreaseQuotaPrivilege 3684 wmic.exe Token: SeSecurityPrivilege 3684 wmic.exe Token: SeTakeOwnershipPrivilege 3684 wmic.exe Token: SeLoadDriverPrivilege 3684 wmic.exe Token: SeSystemProfilePrivilege 3684 wmic.exe Token: SeSystemtimePrivilege 3684 wmic.exe Token: SeProfSingleProcessPrivilege 3684 wmic.exe Token: SeIncBasePriorityPrivilege 3684 wmic.exe Token: SeCreatePagefilePrivilege 3684 wmic.exe Token: SeBackupPrivilege 3684 wmic.exe Token: SeRestorePrivilege 3684 wmic.exe Token: SeShutdownPrivilege 3684 wmic.exe Token: SeDebugPrivilege 3684 wmic.exe Token: SeSystemEnvironmentPrivilege 3684 wmic.exe Token: SeRemoteShutdownPrivilege 3684 wmic.exe Token: SeUndockPrivilege 3684 wmic.exe Token: SeManageVolumePrivilege 3684 wmic.exe Token: 33 3684 wmic.exe Token: 34 3684 wmic.exe Token: 35 3684 wmic.exe Token: 36 3684 wmic.exe Token: SeDebugPrivilege 5740 svchost.exe Token: SeDebugPrivilege 1324 svchost.exe Token: SeIncreaseQuotaPrivilege 460 wmic.exe Token: SeSecurityPrivilege 460 wmic.exe Token: SeTakeOwnershipPrivilege 460 wmic.exe Token: SeLoadDriverPrivilege 460 wmic.exe Token: SeSystemProfilePrivilege 460 wmic.exe Token: SeSystemtimePrivilege 460 wmic.exe Token: SeProfSingleProcessPrivilege 460 wmic.exe Token: SeIncBasePriorityPrivilege 460 wmic.exe Token: SeCreatePagefilePrivilege 460 wmic.exe Token: SeBackupPrivilege 460 wmic.exe Token: SeRestorePrivilege 460 wmic.exe Token: SeShutdownPrivilege 460 wmic.exe Token: SeDebugPrivilege 460 wmic.exe Token: SeSystemEnvironmentPrivilege 460 wmic.exe Token: SeRemoteShutdownPrivilege 460 wmic.exe Token: SeUndockPrivilege 460 wmic.exe Token: SeManageVolumePrivilege 460 wmic.exe Token: 33 460 wmic.exe Token: 34 460 wmic.exe Token: 35 460 wmic.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 5740 wrote to memory of 3684 5740 svchost.exe 88 PID 5740 wrote to memory of 796 5740 svchost.exe 91 PID 5740 wrote to memory of 4624 5740 svchost.exe 93 PID 5740 wrote to memory of 1324 5740 svchost.exe 29 PID 5420 wrote to memory of 460 5420 svchost.exe 97 PID 5420 wrote to memory of 4668 5420 svchost.exe 99 PID 5420 wrote to memory of 1324 5420 svchost.exe 29 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1324
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Drops startup file
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3684
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /Query /TN "svchost"2⤵PID:796
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /f /tn "svchost" /tr "C:\Users\Public\svchost.exe" /sc onlogon /rl highest2⤵
- Scheduled Task/Job: Scheduled Task
PID:4624
-
-
C:\Users\Public\svchost.exeC:\Users\Public\svchost.exe1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Drops startup file
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:460
-
-
C:\Windows\System32\schtasks.exe"schtasks" /Query /TN "svchost"2⤵PID:4668
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk
- Size 1020B
- SHA256 c442ea0b0eae55e189063fb1ee1cf5124a1c166fd6dcaeb9c0142b835bcd574c
- MD5 0403530875348ed66402ab54a6e1b3e1
- SHA1 c7f9c0f4a3312e4b1dfcf652fb7c5a5dce587ebc
- SHA512 e9df9a1abd13cbb78264b44b59e567761fdd1ab6ba9443460058e5e5f6cfb15953364690d667f62af0921f0ced226e88fd85b36180a77c8261b0b09c7aeebfcf
- TLSH T114118C1C07822F21C3A0D5B2A86B2352AB367942FFAD1F190AC6434C5899695BC6DD2F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\svchost.exe
- Size 106KB
- SHA256 123adbf441db301f6158641655ddca8ef8a75e00da86c511cb4af83d763fc26e
- MD5 d091898b20cafa852f53fe7954eb056b
- SHA1 40fc416ac7cf0ec0ff6244ccaec8ea07e166c010
- SHA512 8bc0b5c1285b1a18edff87533ad446c03587e38f560b4e986a7a7e4b8dc6250bc1a8846f19af1d39158cbca4f18afd611c9654569a8177d756af1664f4c7b2dd
- SSDEEP 3072:7d3IAxz324N7tjJ5qm9aex3RRkiw0RFY9U2:R4A5faIRLw4m9
- TLSH T1A4B3F15A6BFC4A3AF3BD873159F58653C2F2F9826654DE1D05C243860E32A448256F3F
- MD5 SHA1 SHA512 SSDEEP TLSH