aab77d3b1891b93b6fd235cb023127c2b34365026057bb0200b714f9483cab80

General

Target

svchost.bin.exe
Size

312KB
MD5

fbd82a5f5bfe23872fad17cf62c41a6e
SHA1

03dff661da8207517fc4cb3c0809e8c0fe7f76fa
SHA256

a1b6faa0465ec8bf30e3450f9679f121ff9e724257577c38c813b77e82e1f42f
SHA512

ac653d1f6b2222c56c3b73715219028a70ca078c87585a11ee2260d68d336e76a794d5d4c111c7c423aa916ed375d18a0cc3a6eb4789e40414243467e11da9bc

Score

10^/10

persistence evasion trojan ransomware

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

svchost.bin.exepowershell.exe

pid process

316 svchost.bin.exe
316 svchost.bin.exe
316 svchost.bin.exe
316 svchost.bin.exe
1092 powershell.exe
1092 powershell.exe

pid	process
316	svchost.bin.exe
316	svchost.bin.exe
316	svchost.bin.exe
316	svchost.bin.exe
1092	powershell.exe
1092	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

svchost.bin.execmd.execmd.exe

description	pid	process	target process
PID 316 wrote to memory of 1512	316	svchost.bin.exe	cmd.exe
PID 316 wrote to memory of 1512	316	svchost.bin.exe	cmd.exe
PID 316 wrote to memory of 1512	316	svchost.bin.exe	cmd.exe
PID 316 wrote to memory of 1512	316	svchost.bin.exe	cmd.exe
PID 316 wrote to memory of 868	316	svchost.bin.exe	cmd.exe
PID 316 wrote to memory of 868	316	svchost.bin.exe	cmd.exe
PID 316 wrote to memory of 868	316	svchost.bin.exe	cmd.exe
PID 316 wrote to memory of 868	316	svchost.bin.exe	cmd.exe
PID 1512 wrote to memory of 756	1512	cmd.exe	sc.exe
PID 1512 wrote to memory of 756	1512	cmd.exe	sc.exe
PID 1512 wrote to memory of 756	1512	cmd.exe	sc.exe
PID 1512 wrote to memory of 756	1512	cmd.exe	sc.exe
PID 316 wrote to memory of 1092	316	svchost.bin.exe	powershell.exe
PID 316 wrote to memory of 1092	316	svchost.bin.exe	powershell.exe
PID 316 wrote to memory of 1092	316	svchost.bin.exe	powershell.exe
PID 316 wrote to memory of 1092	316	svchost.bin.exe	powershell.exe
PID 868 wrote to memory of 1060	868	cmd.exe	vssadmin.exe
PID 868 wrote to memory of 1060	868	cmd.exe	vssadmin.exe
PID 868 wrote to memory of 1060	868	cmd.exe	vssadmin.exe
PID 868 wrote to memory of 1060	868	cmd.exe	vssadmin.exe
PID 868 wrote to memory of 1880	868	cmd.exe	WMIC.exe
PID 868 wrote to memory of 1880	868	cmd.exe	WMIC.exe
PID 868 wrote to memory of 1880	868	cmd.exe	WMIC.exe
PID 868 wrote to memory of 1880	868	cmd.exe	WMIC.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Drops file in Drivers directory 1 IoCs

Processes:

svchost.bin.exe

description ioc process

File created C:\Windows\System32\drivers\etc\host svchost.bin.exe

description	ioc	process
File created	C:\Windows\System32\drivers\etc\host	svchost.bin.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

Processes:

vssvc.exeWMIC.exepowershell.exe

description	pid	process
Token: SeBackupPrivilege	1700	vssvc.exe
Token: SeRestorePrivilege	1700	vssvc.exe
Token: SeAuditPrivilege	1700	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1880	WMIC.exe
Token: SeSecurityPrivilege	1880	WMIC.exe
Token: SeTakeOwnershipPrivilege	1880	WMIC.exe
Token: SeLoadDriverPrivilege	1880	WMIC.exe
Token: SeSystemProfilePrivilege	1880	WMIC.exe
Token: SeSystemtimePrivilege	1880	WMIC.exe
Token: SeProfSingleProcessPrivilege	1880	WMIC.exe
Token: SeIncBasePriorityPrivilege	1880	WMIC.exe
Token: SeCreatePagefilePrivilege	1880	WMIC.exe
Token: SeBackupPrivilege	1880	WMIC.exe
Token: SeRestorePrivilege	1880	WMIC.exe
Token: SeShutdownPrivilege	1880	WMIC.exe
Token: SeDebugPrivilege	1880	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1880	WMIC.exe
Token: SeRemoteShutdownPrivilege	1880	WMIC.exe
Token: SeUndockPrivilege	1880	WMIC.exe
Token: SeManageVolumePrivilege	1880	WMIC.exe
Token: 33	1880	WMIC.exe
Token: 34	1880	WMIC.exe
Token: 35	1880	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1880	WMIC.exe
Token: SeSecurityPrivilege	1880	WMIC.exe
Token: SeTakeOwnershipPrivilege	1880	WMIC.exe
Token: SeLoadDriverPrivilege	1880	WMIC.exe
Token: SeSystemProfilePrivilege	1880	WMIC.exe
Token: SeSystemtimePrivilege	1880	WMIC.exe
Token: SeProfSingleProcessPrivilege	1880	WMIC.exe
Token: SeIncBasePriorityPrivilege	1880	WMIC.exe
Token: SeCreatePagefilePrivilege	1880	WMIC.exe
Token: SeBackupPrivilege	1880	WMIC.exe
Token: SeRestorePrivilege	1880	WMIC.exe
Token: SeShutdownPrivilege	1880	WMIC.exe
Token: SeDebugPrivilege	1880	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1880	WMIC.exe
Token: SeRemoteShutdownPrivilege	1880	WMIC.exe
Token: SeUndockPrivilege	1880	WMIC.exe
Token: SeManageVolumePrivilege	1880	WMIC.exe
Token: 33	1880	WMIC.exe
Token: 34	1880	WMIC.exe
Token: 35	1880	WMIC.exe
Token: SeDebugPrivilege	1092	powershell.exe

System policy modification 1 TTPs 17 IoCs

evasion

Modify Registry

T1112

Processes:

svchost.bin.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.bin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption	svchost.bin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "3"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\dontdisplaylastusername = "0"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "5"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	svchost.bin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "5"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "1"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "1"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\scforceoption = "0"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\undockwithoutlogon = "1"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "1"	svchost.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "1"	svchost.bin.exe

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

svchost.bin.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.bin.exe
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1060 vssadmin.exe

pid	process
1060	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\svchost.bin.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.bin.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Drops file in Drivers directory
- System policy modification
- Checks whether UAC is enabled
PID:316

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc config "AppCheck" start=disabled
2⤵
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\SysWOW64\sc.exe
sc config "AppCheck" start=disabled
3⤵
PID:756

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
2⤵
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:1060

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1880

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1092