Edit tour

Windows Analysis Report
svchost(1).exe

Overview

General Information

Sample name:	svchost(1).exe
Analysis ID:	1426767
MD5:	d9e224acffd36b1c83e8ee2031ccf349
SHA1:	557185cb2cfc025ba795dfe657b13c1509c290aa
SHA256:	82bb0e74c91357fdceaa9bc94ac01448f2a97e0087f7c9d11f08586accd77cf6
Infos:

Detection

Score:	5
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Analysis Advice

Sample is a service DLL but no service has been registered

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

System is w10x64

svchost(1).exe (PID: 6392 cmdline: "C:\Users\user\Desktop\svchost(1).exe" MD5: D9E224ACFFD36B1C83E8EE2031CCF349)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: svchost(1).exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: svchost(1).exe

Static PE information: certificate valid

Source: svchost(1).exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: svchost.pdb source: svchost(1).exe
Source:	Binary string: svchost.pdbUGP source: svchost(1).exe

Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B3150 NtSetInformationProcess,SetUnhandledExceptionFilter,SetErrorMode,GetProcessHeap,InitializeSRWLock,InitializeSRWLock,RegDisablePredefinedCacheEx,EventRegister,GetCommandLineW,memset,GetCurrentProcess,NtSetInformationProcess,HeapFree,HeapFree,ExitProcess,GetCurrentProcess,SetProcessAffinityUpdateMode,	0_2_004B3150
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B32D0 RtlImageNtHeader,RpcMgmtSetServerStackSize,I_RpcServerDisableExceptionFilter,RtlSetProcessIsCritical,SetProcessMitigationPolicy,SetProcessMitigationPolicy,SetProcessMitigationPolicy,SetProtectedPolicy,HeapSetInformation,HeapSetInformation,TpAllocTimer,EventRegister,EventSetInformation,GetTickCount64,GetTickCount64,TpSetTimer,NtSetInformationProcess,	0_2_004B32D0
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B2739 ReleaseSRWLockShared,HeapAlloc,memcpy,memcpy,AcquireSRWLockExclusive,ReleaseSRWLockExclusive,RegGetValueW,ActivateActCtx,LoadLibraryExW,MultiByteToWideChar,RtlRunOnceExecuteOnce,NtQuerySystemInformation,GetProcAddress,DeactivateActCtx,ActivateActCtx,MultiByteToWideChar,RtlRunOnceExecuteOnce,NtQuerySystemInformation,GetProcAddress,DeactivateActCtx,ActivateActCtx,MultiByteToWideChar,RtlRunOnceExecuteOnce,NtQuerySystemInformation,GetProcAddress,DeactivateActCtx,RegCloseKey,	0_2_004B2739
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B24B0 RegOpenKeyExW,RegOpenKeyExW,RegOpenKeyExW,RegCloseKey,RegCloseKey,HeapAlloc,RegQueryValueExW,ExpandEnvironmentStringsW,LCMapStringW,RegQueryValueExW,HeapFree,AcquireSRWLockShared,ReleaseSRWLockShared,HeapAlloc,memcpy,memcpy,AcquireSRWLockExclusive,ReleaseSRWLockExclusive,RegGetValueW,ActivateActCtx,LoadLibraryExW,MultiByteToWideChar,RtlRunOnceExecuteOnce,NtQuerySystemInformation,GetProcAddress,DeactivateActCtx,ActivateActCtx,MultiByteToWideChar,RtlRunOnceExecuteOnce,NtQuerySystemInformation,GetProcAddress,DeactivateActCtx,ActivateActCtx,MultiByteToWideChar,RtlRunOnceExecuteOnce,NtQuerySystemInformation,GetProcAddress,DeactivateActCtx,RegCloseKey,HeapAlloc,RegGetValueW,WideCharToMultiByte,HeapAlloc,WideCharToMultiByte,HeapFree,ExpandEnvironmentStringsW,HeapFree,CreateActCtxW,GetLastError,HeapFree,HeapFree,GetLastError,CreateActCtxW,GetLastError,ReleaseActCtx,GetLastError,GetLastError,RtlNtStatusToDosError,GetLastError,LoadLibraryExW,RtlNtStatusToDosError,LoadLibraryExW,RtlNtStatusToDosError,HeapFree,ReleaseActCtx,	0_2_004B24B0

Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B2739		0_2_004B2739
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B24B0		0_2_004B24B0

Source: svchost(1).exe, 00000000.00000000.2045451956.00000000004BB000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesvchost.exej% vs svchost(1).exe
Source: svchost(1).exe	Binary or memory string: OriginalFilenamesvchost.exej% vs svchost(1).exe

Source: svchost(1).exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: clean5.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\svchost(1).exe

Code function: 0_2_004B3120 I_RegisterSvchostNotificationCallback,StartServiceCtrlDispatcherW,ExitProcess,

0_2_004B3120

Source: C:\Users\user\Desktop\svchost(1).exe

Code function: 0_2_004B3120 I_RegisterSvchostNotificationCallback,StartServiceCtrlDispatcherW,ExitProcess,

0_2_004B3120

Source: svchost(1).exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\svchost(1).exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\svchost(1).exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

graph_0-1511

Source: svchost(1).exe

Static PE information: certificate valid

Source: initial sample

Static PE information: Valid certificate with Microsoft Issuer

Source: svchost(1).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: svchost(1).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: svchost(1).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: svchost(1).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: svchost(1).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: svchost(1).exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: svchost(1).exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, GUARD_CF, TERMINAL_SERVER_AWARE

Source: svchost(1).exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: svchost.pdb source: svchost(1).exe
Source:	Binary string: svchost.pdbUGP source: svchost(1).exe

Source: svchost(1).exe

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\svchost(1).exe

Code function: 0_2_004B3120 I_RegisterSvchostNotificationCallback,StartServiceCtrlDispatcherW,ExitProcess,

0_2_004B3120

Source: C:\Users\user\Desktop\svchost(1).exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-1696

Source: C:\Users\user\Desktop\svchost(1).exe

API coverage: 3.6 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\svchost(1).exe

API call chain: ExitProcess graph end node

graph_0-1485

Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B45C0 mov eax, dword ptr fs:[00000030h]	0_2_004B45C0
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B45C0 mov eax, dword ptr fs:[00000030h]	0_2_004B45C0
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B45C0 mov eax, dword ptr fs:[00000030h]	0_2_004B45C0
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B45C0 mov eax, dword ptr fs:[00000030h]	0_2_004B45C0
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B4FD0 mov eax, dword ptr fs:[00000030h]	0_2_004B4FD0
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B4FD0 mov ecx, dword ptr fs:[00000030h]	0_2_004B4FD0
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B43D0 mov eax, dword ptr fs:[00000030h]	0_2_004B43D0
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B43D0 mov eax, dword ptr fs:[00000030h]	0_2_004B43D0
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B32D0 mov eax, dword ptr fs:[00000030h]	0_2_004B32D0
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B32D0 mov eax, dword ptr fs:[00000030h]	0_2_004B32D0
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B32D0 mov eax, dword ptr fs:[00000030h]	0_2_004B32D0
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B2E20 mov eax, dword ptr fs:[00000030h]	0_2_004B2E20
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B2E20 mov eax, dword ptr fs:[00000030h]	0_2_004B2E20
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B2E20 mov eax, dword ptr fs:[00000030h]	0_2_004B2E20
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B2E20 mov eax, dword ptr fs:[00000030h]	0_2_004B2E20

Source: C:\Users\user\Desktop\svchost(1).exe

Code function: 0_2_004B3150 NtSetInformationProcess,SetUnhandledExceptionFilter,SetErrorMode,GetProcessHeap,InitializeSRWLock,InitializeSRWLock,RegDisablePredefinedCacheEx,EventRegister,GetCommandLineW,memset,GetCurrentProcess,NtSetInformationProcess,HeapFree,HeapFree,ExitProcess,GetCurrentProcess,SetProcessAffinityUpdateMode,

0_2_004B3150

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B3150 NtSetInformationProcess,SetUnhandledExceptionFilter,SetErrorMode,GetProcessHeap,InitializeSRWLock,InitializeSRWLock,RegDisablePredefinedCacheEx,EventRegister,GetCommandLineW,memset,GetCurrentProcess,NtSetInformationProcess,HeapFree,HeapFree,ExitProcess,GetCurrentProcess,SetProcessAffinityUpdateMode,		0_2_004B3150
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B514A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_004B514A

Source: C:\Users\user\Desktop\svchost(1).exe

Code function: 0_2_004B45C0 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,GetLastError,HeapAlloc,InitializeSecurityDescriptor,GetTokenInformation,GetTokenInformation,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,HeapAlloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,CloseHandle,GetLengthSid,AddAccessAllowedAce,GetLengthSid,AddAccessAllowedAce,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,HeapFree,HeapFree,

0_2_004B45C0

Source: C:\Users\user\Desktop\svchost(1).exe

Code function: 0_2_004B50B0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004B50B0

Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B67D0 RpcServerUnregisterIfEx,EnterCriticalSection,RpcMgmtStopServerListening,RpcMgmtWaitServerListen,LeaveCriticalSection,I_RpcMapWin32Status,	0_2_004B67D0
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B6780 RpcServerUnregisterIf,EnterCriticalSection,RpcMgmtStopServerListening,RpcMgmtWaitServerListen,LeaveCriticalSection,I_RpcMapWin32Status,	0_2_004B6780
Source: C:\Users\user\Desktop\svchost(1).exe	Code function: 0_2_004B6710 EnterCriticalSection,RpcServerListen,LeaveCriticalSection,I_RpcMapWin32Status,	0_2_004B6710

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	3 Windows Service	3 Windows Service	Direct Volume Access	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Service Execution	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Native API	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
svchost(1).exe	0%	ReversingLabs
svchost(1).exe	0%	Virustotal		Browse

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1426767
Start date and time:	2024-04-16 15:38:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	svchost(1).exe
Detection:	CLEAN
Classification:	clean5.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 75% Number of executed functions: 2 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.434813773926763
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	svchost(1).exe
File size:	45'488 bytes
MD5:	d9e224acffd36b1c83e8ee2031ccf349
SHA1:	557185cb2cfc025ba795dfe657b13c1509c290aa
SHA256:	82bb0e74c91357fdceaa9bc94ac01448f2a97e0087f7c9d11f08586accd77cf6
SHA512:	8109ebc84a8ed5228c7bdaf2f2c0f62b2d9b20be7eb6091cd933971b0c64fa8a722665cbc240138810e33aec75400f38eec9e7244431cbefe8e43a6826aec3c6
SSDEEP:	768:bJRYx30J+CVDfl4DoXagiPZCc8cVUyF4Q1PCfWoF9zupk:bd+CVDfl4DoXagiPZyXyFjPCf9Xzuq
TLSH:	AD137C519689C052E9F321B0227FA22B6D7FBE726781C9E75682545938717C0FF3C22E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........UJe..Je..Je../...He../...Ke..C.U.se..Je...e../...De../...Ce../.9.Ke../...Ke..RichJe..........PE..L......F.................Z.

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x403090
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x46FA82D7 [Wed Sep 26 16:03:35 2007 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	ec10f5be711cb724c2d4d18a3c10ad6d

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	27/01/2022 20:31:19 26/01/2023 20:31:19
Subject Chain	CN=Microsoft Windows Publisher, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	F5B9128CD5E7683597D6CF3824FA1276
Thumbprint SHA-1:	C60A14A6BD925780E9F0463BA19C3F37D5473E8B
Thumbprint SHA-256:	6F1EE3B86130D15010459132338EF2F3617283FFA802C4FA6061273604CC0CDA
Serial:	330000036CE57EEB5D1CC2BE1700000000036C

Entrypoint Preview

Instruction
call 00007F0A453C8D00h
jmp 00007F0A453C6CEBh
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
sub esp, 10h
lea eax, dword ptr [ebp-04h]
mov dword ptr [ebp-0Ch], 00000000h
push 004011FCh
push 004011F8h
mov dword ptr [ebp-04h], 00000000h
mov dword ptr [ebp-08h], eax
mov dword ptr [ebp-10h], 00000000h
call dword ptr [00408048h]
add esp, 08h
test eax, eax
jne 00007F0A453C6D0Fh
push eax
push eax
push eax
lea eax, dword ptr [ebp-08h]
push eax
lea eax, dword ptr [ebp-0Ch]
push eax
call dword ptr [0040804Ch]
push 004011F4h
push 004011F0h
call dword ptr [00408044h]
add esp, 1Ch
lea eax, dword ptr [ebp-10h]
push eax
call 00007F0A453C6CEEh
mov eax, 000000FFh
mov esp, ebp
pop ebp
ret
jmp 00007F0A453C6CF0h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push esi
call 00007F0A453C6D0Dh
mov esi, eax
test esi, esi
je 00007F0A453C6CF4h
push 00406030h
call dword ptr [004081C0h]
push esi
call dword ptr [004081B8h]
call 00007F0A453C83F0h
push 00000000h
call dword ptr [004080C4h]
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
and esp, FFFFFFF8h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8260	0x258	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb000	0x818	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x8a00	0x27b0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc000	0x660	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1a00	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1100	0xa4	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x25c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x6930	0x40	.text
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x59e8	0x5a00	d07f39300d943eea0b2dc5a75df85ab1	False	0.5348090277777777	data	6.090902221406976	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x7000	0x4b0	0x200	c9a18b9809ce46cb1bd5c2d761aa077a	False	0.0625	data	0.2201131574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x154c	0x1600	80bc3534a49271b71bbf01c72b337222	False	0.3856534090909091	data	5.031519188486823	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0xa000	0x14	0x200	097ab9033ed077b8a4f123dc3c367b98	False	0.046875	OpenPGP Secret Key	0.21310128450968063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xb000	0x818	0xa00	51d8a1d4731bafe606d1a8c1280b6c3f	False	0.38046875	data	3.747297110254232	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc000	0x660	0x800	fb7e0ac2c1401878659a65711ac726eb	False	0.7138671875	data	5.901056975990543	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
MUI	0xb750	0xc8	data	English	United States	0.545
RT_VERSION	0xb3a0	0x3b0	data	English	United States	0.4576271186440678
RT_MANIFEST	0xb0f0	0x2b0	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5232558139534884

Imports

DLL	Import
api-ms-win-core-crt-l2-1-0.dll	_initterm, _initterm_e, __wgetmainargs
api-ms-win-core-profile-l1-1-0.dll	QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0.dll	ExitProcess, GetCurrentProcessId, SetProcessAffinityUpdateMode, TerminateProcess, GetCurrentProcess, GetCurrentThreadId, OpenProcessToken
api-ms-win-core-sysinfo-l1-1-0.dll	GetTickCount, GetTickCount64, GetSystemTimeAsFileTime
api-ms-win-core-errorhandling-l1-1-0.dll	GetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, SetErrorMode
api-ms-win-service-private-l1-1-3.dll	I_RegisterSvchostNotificationCallback
api-ms-win-core-crt-l1-1-0.dll	memcpy, _wcsicmp, memset, memcmp, qsort_s
api-ms-win-core-libraryloader-l1-2-0.dll	GetProcAddress, LoadLibraryExW, FreeLibrary
api-ms-win-core-heap-l1-1-0.dll	HeapAlloc, HeapFree, HeapSetInformation, GetProcessHeap
api-ms-win-core-synch-l1-1-0.dll	ReleaseSRWLockExclusive, AcquireSRWLockExclusive, InitializeSRWLock, ReleaseSRWLockShared, AcquireSRWLockShared, LeaveCriticalSection, EnterCriticalSection
api-ms-win-service-winsvc-l1-1-0.dll	RegisterServiceCtrlHandlerW
api-ms-win-service-core-l1-1-0.dll	SetServiceStatus, StartServiceCtrlDispatcherW
api-ms-win-core-string-l1-1-0.dll	CompareStringOrdinal, MultiByteToWideChar, WideCharToMultiByte
api-ms-win-core-registry-l1-1-0.dll	RegEnumKeyExW, RegCloseKey, RegDisablePredefinedCacheEx, RegGetValueW, RegOpenKeyExW, RegQueryValueExW
api-ms-win-core-processenvironment-l1-1-0.dll	GetCommandLineW, ExpandEnvironmentStringsW
api-ms-win-core-processthreads-l1-1-1.dll	SetProcessMitigationPolicy
api-ms-win-core-processthreads-l1-1-2.dll	SetProtectedPolicy
RPCRT4.dll	RpcServerUnregisterIf, I_RpcMapWin32Status, RpcMgmtSetServerStackSize, I_RpcServerDisableExceptionFilter, RpcServerUseProtseqEpW, RpcServerUnregisterIfEx, RpcServerRegisterIf, RpcMgmtStopServerListening, RpcServerListen, RpcMgmtWaitServerListen
api-ms-win-core-localization-l1-2-0.dll	LCMapStringW
api-ms-win-security-base-l1-1-0.dll	SetSecurityDescriptorDacl, SetSecurityDescriptorOwner, MakeAbsoluteSD, InitializeSecurityDescriptor, InitializeAcl, AddAccessAllowedAce, GetLengthSid, SetSecurityDescriptorGroup, GetTokenInformation
api-ms-win-core-handle-l1-1-0.dll	CloseHandle
api-ms-win-eventing-provider-l1-1-0.dll	EventSetInformation, EventWriteTransfer, EventRegister
api-ms-win-crt-utility-l1-1-0.dll	bsearch_s
api-ms-win-core-sidebyside-l1-1-0.dll	DeactivateActCtx, CreateActCtxW, ReleaseActCtx, ActivateActCtx
api-ms-win-core-threadpool-private-l1-1-0.dll	RegisterWaitForSingleObjectEx
ntdll.dll	RtlSetProcessIsCritical, _vsnwprintf, TpSetTimer, RtlValidSecurityDescriptor, TpReleaseTimer, TpWaitForTimer, TpSetTimerEx, RtlFreeHeap, RtlAllocateHeap, RtlQueryHeapInformation, RtlRunOnceExecuteOnce, RtlNtStatusToDosError, EtwEventWrite, EtwEventEnabled, TpReleaseWait, RtlNtStatusToDosErrorNoTeb, TpSetWait, TpAllocWait, EtwEventRegister, NtQuerySystemInformation, RtlUnhandledExceptionFilter, RtlInitializeCriticalSection, RtlInitializeSid, RtlSubAuthoritySid, RtlGetDeviceFamilyInfoEnum, RtlReleaseSRWLockExclusive, RtlSubAuthorityCountSid, RtlAcquireSRWLockExclusive, RtlLengthRequiredSid, RtlDeriveCapabilitySidsFromName, RtlCopySid, NtSetInformationProcess, TpAllocTimer, RtlImageNtHeader
api-ms-win-core-heap-l2-1-0.dll	LocalAlloc, LocalFree
api-ms-win-core-delayload-l1-1-1.dll	ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0.dll	DelayLoadFailureHook

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	15:39:24
Start date:	16/04/2024
Path:	C:\Users\user\Desktop\svchost(1).exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\svchost(1).exe"
Imagebase:	0x4b0000
File size:	45'488 bytes
MD5 hash:	D9E224ACFFD36B1C83E8EE2031CCF349
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	50.9%
Total number of Nodes:	638
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004B3150 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 118
memorynativeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationProcess.NTDLL(000000FF,00000036,?), ref: 004B3183
SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(004B6110), ref: 004B318E
SetErrorMode.KERNELBASE(00000001), ref: 004B3196
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 004B319C
InitializeSRWLock.API-MS-WIN-CORE-SYNCH-L1-1-0(004B7380), ref: 004B31C0
InitializeSRWLock.API-MS-WIN-CORE-SYNCH-L1-1-0(004B7360), ref: 004B31CB
RegDisablePredefinedCacheEx.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 004B31D1
EventRegister.API-MS-WIN-EVENTING-PROVIDER-L1-1-0(004B13B0,00000000,00000000,004B73C0), ref: 004B31E3
GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 004B31F6

Part of subcall function 004B3F50: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000064,00000000,?,?,00000004), ref: 004B3F8A
Part of subcall function 004B3F50: memcpy.API-MS-WIN-CORE-CRT-L1-1-0(00000064,00000000,00000000,?,?,00000004), ref: 004B3FAA
Part of subcall function 004B3F50: LCMapStringW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000400,00000100,?,?,?,?,?,?,?,00000004), ref: 004B4031

GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000052,?,00000090,?,?,?,?,00000004), ref: 004B3258
NtSetInformationProcess.NTDLL(00000000), ref: 004B325F

Part of subcall function 004B35A0: RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,Software\Microsoft\Windows NT\CurrentVersion\Svchost,00000000,00020019,l2K,?,?,004B326C,?,?,?,?,00000004), ref: 004B35C3
Part of subcall function 004B35A0: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(l2K,00000000,00000000,?,?,004B326C,?,?,?,?,00000004), ref: 004B35E0
Part of subcall function 004B35A0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000000,00000000,?,?,004B326C,?,?,?,?,00000004), ref: 004B3646
Part of subcall function 004B35A0: InitializeSRWLock.API-MS-WIN-CORE-SYNCH-L1-1-0(00000010,?,?,004B326C,?,?,?,?,00000004), ref: 004B3677

Part of subcall function 004B3540: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,00000000,004B3271,?,?,?,?,00000004), ref: 004B3563

HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,?,?,?,00000004), ref: 004B3292
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,?,00000004), ref: 004B32B7
ExitProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 004B32C1

Part of subcall function 004B32D0: RpcMgmtSetServerStackSize.RPCRT4(?), ref: 004B332E
Part of subcall function 004B32D0: I_RpcServerDisableExceptionFilter.RPCRT4 ref: 004B333A
Part of subcall function 004B32D0: RtlSetProcessIsCritical.NTDLL ref: 004B334C
Part of subcall function 004B32D0: SetProcessMitigationPolicy.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1(00000002,?,00000004), ref: 004B3367
Part of subcall function 004B32D0: SetProcessMitigationPolicy.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1(00000008,?,00000004), ref: 004B337F
Part of subcall function 004B32D0: SetProcessMitigationPolicy.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1(00000006,?,00000004), ref: 004B33A6
Part of subcall function 004B32D0: SetProtectedPolicy.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2(NoUrlMimeFilters,00000001,00000000), ref: 004B33B5
Part of subcall function 004B32D0: HeapSetInformation.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000001,00000000,00000000), ref: 004B33C3
Part of subcall function 004B32D0: HeapSetInformation.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000004,00000000,00000000), ref: 004B33FB
Part of subcall function 004B32D0: TpAllocTimer.NTDLL ref: 004B340E

memset.API-MS-WIN-CORE-CRT-L1-1-0(?,00000000,00000090), ref: 004B3219

Part of subcall function 004B3EF0: _vsnwprintf.NTDLL ref: 004B3F21

GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000001), ref: 004B590C
SetProcessAffinityUpdateMode.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000000), ref: 004B5913

Strings

[%ws], xrefs: 004B3238
[%ws] [%ws], xrefs: 004B5928

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: Process$Heap$AllocInformationPolicy$InitializeLockMitigation$CurrentDisableExceptionFilterFreeModeServer$AffinityCacheCloseCommandCriticalErrorEventExitLineMgmtOpenPredefinedProtectedRegisterSizeStackStringTimerUnhandledUpdate_vsnwprintfmemcpymemset
String ID: [%ws]$[%ws] [%ws]
API String ID: 350296402-2631382080
Opcode ID: 15025254753791d0fc9112a829cbdd4d89af21bf2fbb493e667c81a33a9b2f4b
Instruction ID: 3805ae598f4f8083cb9ee09dcb67a5a670eb105ce1b6a6ae81c7fff810738229
Opcode Fuzzy Hash: 15025254753791d0fc9112a829cbdd4d89af21bf2fbb493e667c81a33a9b2f4b
Instruction Fuzzy Hash: 8E41B271604700ABD7206F76DC0AF9B3AACAB84B45F14022EFA05962D1DF789905CB7E

Uniqueness

Uniqueness Score: -1.00%

Function 004B3120 Relevance: 4.5, APIs: 3, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004B3150: NtSetInformationProcess.NTDLL(000000FF,00000036,?), ref: 004B3183
Part of subcall function 004B3150: SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(004B6110), ref: 004B318E
Part of subcall function 004B3150: SetErrorMode.KERNELBASE(00000001), ref: 004B3196
Part of subcall function 004B3150: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 004B319C
Part of subcall function 004B3150: InitializeSRWLock.API-MS-WIN-CORE-SYNCH-L1-1-0(004B7380), ref: 004B31C0
Part of subcall function 004B3150: InitializeSRWLock.API-MS-WIN-CORE-SYNCH-L1-1-0(004B7360), ref: 004B31CB
Part of subcall function 004B3150: RegDisablePredefinedCacheEx.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 004B31D1
Part of subcall function 004B3150: EventRegister.API-MS-WIN-EVENTING-PROVIDER-L1-1-0(004B13B0,00000000,00000000,004B73C0), ref: 004B31E3
Part of subcall function 004B3150: GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 004B31F6
Part of subcall function 004B3150: memset.API-MS-WIN-CORE-CRT-L1-1-0(?,00000000,00000090), ref: 004B3219
Part of subcall function 004B3150: GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000052,?,00000090,?,?,?,?,00000004), ref: 004B3258
Part of subcall function 004B3150: NtSetInformationProcess.NTDLL(00000000), ref: 004B325F
Part of subcall function 004B3150: HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,?,?,?,00000004), ref: 004B3292

I_RegisterSvchostNotificationCallback.API-MS-WIN-SERVICE-PRIVATE-L1-1-3(Function_00006030), ref: 004B3133
StartServiceCtrlDispatcherW.API-MS-WIN-SERVICE-CORE-L1-1-0(00000000), ref: 004B313A
ExitProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 004B3147

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: Process$HeapInformationInitializeLockRegister$CacheCallbackCommandCtrlCurrentDisableDispatcherErrorEventExceptionExitFilterFreeLineModeNotificationPredefinedServiceStartSvchostUnhandledmemset
String ID:
API String ID: 721293443-0
Opcode ID: 399117f65811ee820ce7b261a469fbdc1bf1d915f3d4e2b10b249dce3ac45ed1
Instruction ID: 051253731249955a378a46c9b49ec48071177b1edb2a323866456e0485f597c8
Opcode Fuzzy Hash: 399117f65811ee820ce7b261a469fbdc1bf1d915f3d4e2b10b249dce3ac45ed1
Instruction Fuzzy Hash: 04D0123140392057C2513F6F5C0DB8F351C6F85B43B0A022DF515661518E3C8902CABD

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004B24B0 Relevance: 132.1, APIs: 65, Strings: 10, Instructions: 860registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,System\CurrentControlSet\Services,00000000,00020019,?,00000000,-004B7390), ref: 004B2585
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,00020019,?), ref: 004B25A5
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,Parameters,00000000,00020019,?), ref: 004B25C9
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 004B25EB
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 004B25FC
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,0000020A), ref: 004B2616
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,ServiceDll,00000000,?,00000000,?), ref: 004B2651
ExpandEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000,?,00000104), ref: 004B2682
LCMapStringW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000400,00000100,?,?,?,?), ref: 004B26B9
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,ServiceManifest,00000000,00000002,00000000,0000020A), ref: 004B26E5
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 004B2705
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(004B7380), ref: 004B2718

Strings

Parameters, xrefs: 004B25BE
System\CurrentControlSet\Services, xrefs: 004B256F
ServiceManifest, xrefs: 004B26DA
ServiceDll, xrefs: 004B2646
SvchostPushServiceGlobals, xrefs: 004B2AD0, 004B2B26
`Cu, xrefs: 004B2682, 004B54EE
ServiceMain, xrefs: 004B28E8, 004B293B, 004B29A0
, xrefs: 004B2548
SvchostPushServiceGlobalsEx, xrefs: 004B2A0A, 004B2A60
ServiceMain, xrefs: 004B28B6, 004B2BCA

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: Open$CloseHeapQueryValue$AcquireAllocEnvironmentExpandFreeLockSharedStringStrings
String ID: $Parameters$ServiceDll$ServiceMain$ServiceMain$ServiceManifest$SvchostPushServiceGlobals$SvchostPushServiceGlobalsEx$System\CurrentControlSet\Services$`Cu
API String ID: 3542892692-601186239
Opcode ID: 1827bd0882e6f2f359e76e045a0662b00b73a0da52e69b468a3a8c77b22e0013
Instruction ID: 82e982061f927b127f1190bd4a7ebdca525b24fc82f865e24340715eab63a8b6
Opcode Fuzzy Hash: 1827bd0882e6f2f359e76e045a0662b00b73a0da52e69b468a3a8c77b22e0013
Instruction Fuzzy Hash: 60727F70A04615DBDB249F24CD44BEAB7F8FF54700F1482AAE949A7290DF749D81CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004B45C0 Relevance: 70.3, APIs: 38, Strings: 2, Instructions: 258
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000008,00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 004B45EC
OpenProcessToken.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000000), ref: 004B45F3
GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 004B460C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 004B4616
GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,00000005(TokenIntegrityLevel),00000000,00000000,?), ref: 004B4634
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 004B463E
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,00000008,?), ref: 004B466F
InitializeSecurityDescriptor.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,00000001), ref: 004B4688
GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,00000001(TokenIntegrityLevel),00000014,?,?), ref: 004B46A3
GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,00000005(TokenIntegrityLevel),?,?,?), ref: 004B46C0
SetSecurityDescriptorOwner.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,00000014,00000000), ref: 004B46D3
SetSecurityDescriptorGroup.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,?,00000000), ref: 004B46E9
GetLengthSid.API-MS-WIN-SECURITY-BASE-L1-1-0(004B14C0), ref: 004B46FC
GetLengthSid.API-MS-WIN-SECURITY-BASE-L1-1-0(004B14CC), ref: 004B470F
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,00000008,00000008), ref: 004B4738
InitializeAcl.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,00000008,00000002), ref: 004B474C
AddAccessAllowedAce.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,00000002,00000001,004B14C0), ref: 004B4764
AddAccessAllowedAce.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,00000002,00000001,004B14CC), ref: 004B4782
SetSecurityDescriptorDacl.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,00000001,00000000,00000000), ref: 004B47A6
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000), ref: 004B47CC
GetLengthSid.API-MS-WIN-SECURITY-BASE-L1-1-0(004B14DC), ref: 004B47F2
AddAccessAllowedAce.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,00000002,00000001,004B14DC), ref: 004B480C
GetLengthSid.API-MS-WIN-SECURITY-BASE-L1-1-0(004B150C), ref: 004B4820
AddAccessAllowedAce.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,00000002,00000001,004B150C), ref: 004B483A
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 004B5C47
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 004B5CD0
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 004B5CDD

Strings

z, xrefs: 004B461E
z, xrefs: 004B4646

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: ErrorLastToken$AccessAllowedDescriptorInformationLengthSecurity$AllocHeapInitializeProcess$CloseCurrentDaclGroupHandleOpenOwner
String ID: z$z
API String ID: 3690069739-3877588240
Opcode ID: fd193018951083e90caee284604feb3b2380162c62e600052fb4213cf573d950
Instruction ID: 8947e408bfbca98de6e07fb3e56de0521ac8cbf03ef216a56cfee2a407268f8c
Opcode Fuzzy Hash: fd193018951083e90caee284604feb3b2380162c62e600052fb4213cf573d950
Instruction Fuzzy Hash: 3791A630640705EFDB115FA4DC49BEA7BB8FB45B41F10422AF602E62A1DF748901DB79

Uniqueness

Uniqueness Score: -1.00%

Function 004B2739 Relevance: 54.5, APIs: 27, Strings: 4, Instructions: 299librarynativeloaderCOMMON

Download Yara Rule

APIs

ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(004B7380), ref: 004B2785
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000000), ref: 004B27E2
memcpy.API-MS-WIN-CORE-CRT-L1-1-0(0000001C,?), ref: 004B2812
memcpy.API-MS-WIN-CORE-CRT-L1-1-0(?,?,00000000,0000001C,?), ref: 004B2825
AcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(004B7380), ref: 004B283B
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(004B7380), ref: 004B2868
RegGetValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000,ServiceMain,0000FFFF,?,00000000,00000000), ref: 004B28BE
ActivateActCtx.API-MS-WIN-CORE-SIDEBYSIDE-L1-1-0(?,?), ref: 004B28FF
LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,00000000,00000008), ref: 004B291A
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(00000000,00000000,00000000,000000FF,?,00000104), ref: 004B2940
RtlRunOnceExecuteOnce.NTDLL(004B73B8,004B4F10,00000000,00000000), ref: 004B295C
NtQuerySystemInformation.NTDLL(000000A4,?,00000020,00000000), ref: 004B2979
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,00000000), ref: 004B29A2
DeactivateActCtx.API-MS-WIN-CORE-SIDEBYSIDE-L1-1-0(00000000,?), ref: 004B29BA
ActivateActCtx.API-MS-WIN-CORE-SIDEBYSIDE-L1-1-0(?,?), ref: 004B29E3
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(00000000,00000000,SvchostPushServiceGlobalsEx,000000FF,?,00000104), ref: 004B2A13
RtlRunOnceExecuteOnce.NTDLL(004B73B8,004B4F10,00000000,00000000), ref: 004B2A2B
NtQuerySystemInformation.NTDLL(000000A4,?,00000020,00000000), ref: 004B2A49
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,SvchostPushServiceGlobalsEx), ref: 004B2A66
DeactivateActCtx.API-MS-WIN-CORE-SIDEBYSIDE-L1-1-0(00000000,?), ref: 004B2A76
ActivateActCtx.API-MS-WIN-CORE-SIDEBYSIDE-L1-1-0(?,?), ref: 004B2AA9
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(00000000,00000000,SvchostPushServiceGlobals,000000FF,?,00000104), ref: 004B2AD9
RtlRunOnceExecuteOnce.NTDLL(004B73B8,004B4F10,00000000,00000000), ref: 004B2AF1
NtQuerySystemInformation.NTDLL(000000A4,?,00000020,00000000), ref: 004B2B0F
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,SvchostPushServiceGlobals), ref: 004B2B2C
DeactivateActCtx.API-MS-WIN-CORE-SIDEBYSIDE-L1-1-0(00000000,?), ref: 004B2B3C
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 004B2B59

Strings

SvchostPushServiceGlobals, xrefs: 004B2AD0, 004B2B26
ServiceMain, xrefs: 004B28E8, 004B293B, 004B29A0
SvchostPushServiceGlobalsEx, xrefs: 004B2A0A, 004B2A60
ServiceMain, xrefs: 004B28B6

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: Once$ActivateAddressByteCharDeactivateExecuteInformationLockMultiProcQuerySystemWide$ExclusiveReleasememcpy$AcquireAllocCloseHeapLibraryLoadSharedValue
String ID: ServiceMain$ServiceMain$SvchostPushServiceGlobals$SvchostPushServiceGlobalsEx
API String ID: 2864900979-679183997
Opcode ID: 243ee3d1804adfa7c2dea058b9f47d85932b00ef539766060d3910a1fbb4fb89
Instruction ID: c452e045ebc62b72f37b75d52781ca5d8a3aaf6719a67d27b1f481563fa88987
Opcode Fuzzy Hash: 243ee3d1804adfa7c2dea058b9f47d85932b00ef539766060d3910a1fbb4fb89
Instruction Fuzzy Hash: 33B18031640615ABDB209F24CD45BEAB7F8FF54700F1582AAE948A7290DFB4DD41CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004B2E20 Relevance: 52.7, APIs: 28, Strings: 2, Instructions: 175
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(004B7440,00000000,-004B7390,?,004B2450,?,000000FF,00000000), ref: 004B2E54
RtlLengthRequiredSid.NTDLL(00000001), ref: 004B2E68
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,00000000,00000000,?,004B2450,?,000000FF,00000000), ref: 004B2E7A
RtlInitializeSid.NTDLL(00000000,004B1014,00000001), ref: 004B2E94
RtlSubAuthoritySid.NTDLL(004B7490,00000000), ref: 004B2EA4
RtlSubAuthorityCountSid.NTDLL(?), ref: 004B2EE2
RtlLengthRequiredSid.NTDLL(?), ref: 004B2EF0
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,00000000,?,004B2450,?,000000FF,00000000), ref: 004B2EFF
RtlCopySid.NTDLL ref: 004B2F14
RtlSubAuthorityCountSid.NTDLL(00000000), ref: 004B2F27
RtlSubAuthoritySid.NTDLL(htK,?), ref: 004B2F34
RtlLengthRequiredSid.NTDLL(00000002), ref: 004B2F4D
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,00000000,00000000,?,004B2450,?,000000FF,00000000), ref: 004B2F5F
RtlInitializeSid.NTDLL(00000000,00000000,00000002), ref: 004B2F79
RtlSubAuthoritySid.NTDLL(00000000), ref: 004B2F87
RtlSubAuthoritySid.NTDLL(00000001), ref: 004B2F9B
RtlDeriveCapabilitySidsFromName.NTDLL ref: 004B2FB6
RtlLengthRequiredSid.NTDLL(00000006), ref: 004B2FD2
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,00000000,00000000,?,004B2450,?,000000FF,00000000), ref: 004B2FE4
RtlInitializeSid.NTDLL(00000000,00000000,00000006), ref: 004B2FFE
RtlSubAuthoritySid.NTDLL(00000000), ref: 004B300D
RtlSubAuthoritySid.NTDLL(00000001), ref: 004B3021
RtlSubAuthoritySid.NTDLL(00000002), ref: 004B3031
RtlSubAuthoritySid.NTDLL(00000003), ref: 004B3041
RtlSubAuthoritySid.NTDLL(00000004), ref: 004B3051
RtlSubAuthoritySid.NTDLL(00000005), ref: 004B3061
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(004B7440,?,004B2450,?,000000FF,00000000), ref: 004B306E

Strings

P$K, xrefs: 004B2F3A
htK, xrefs: 004B2ECC, 004B2F32

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: Authority$AllocHeapLengthRequired$Initialize$CountExclusiveLock$AcquireCapabilityCopyDeriveFromNameReleaseSids
String ID: P$K$htK
API String ID: 4098953902-3463356074
Opcode ID: 228857f704698c8f3736687f959ef9094cdb0b765e3ecfa500feab288f2709c2
Instruction ID: 62d5f03ae5ba499649e54d04c0ca160fe81a22d964d1b5fcf0d74eae2ec22247
Opcode Fuzzy Hash: 228857f704698c8f3736687f959ef9094cdb0b765e3ecfa500feab288f2709c2
Instruction Fuzzy Hash: C1616C71540605EFDB159FA8EC59B6A7BB8FB08705F0006B8F601A72B0CF759850DB69

Uniqueness

Uniqueness Score: -1.00%

Function 004B32D0 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
memorytimenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlImageNtHeader.NTDLL(?), ref: 004B3321
RpcMgmtSetServerStackSize.RPCRT4(?), ref: 004B332E
I_RpcServerDisableExceptionFilter.RPCRT4 ref: 004B333A
RtlSetProcessIsCritical.NTDLL ref: 004B334C
SetProcessMitigationPolicy.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1(00000002,?,00000004), ref: 004B3367
SetProcessMitigationPolicy.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1(00000008,?,00000004), ref: 004B337F
SetProcessMitigationPolicy.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1(00000006,?,00000004), ref: 004B33A6
SetProtectedPolicy.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2(NoUrlMimeFilters,00000001,00000000), ref: 004B33B5
HeapSetInformation.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000001,00000000,00000000), ref: 004B33C3
HeapSetInformation.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000004,00000000,00000000), ref: 004B33FB
TpAllocTimer.NTDLL ref: 004B340E
EventRegister.API-MS-WIN-EVENTING-PROVIDER-L1-1-0(?,004B4EB0,004B7000,004B7018), ref: 004B3461
EventSetInformation.API-MS-WIN-EVENTING-PROVIDER-L1-1-0(00000002,?,00000000), ref: 004B3484
GetTickCount64.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 004B3492
GetTickCount64.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 004B34A3
TpSetTimer.NTDLL ref: 004B34DE
NtSetInformationProcess.NTDLL(000000FF,00000034,00000004,00000008), ref: 004B3503

Strings

NoUrlMimeFilters, xrefs: 004B33B0
~2K, xrefs: 004B32DF

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: Process$InformationPolicy$Mitigation$Count64EventHeapServerTickTimer$AllocCriticalDisableExceptionFilterHeaderImageMgmtProtectedRegisterSizeStack
String ID: NoUrlMimeFilters$~2K
API String ID: 1743967075-1706826827
Opcode ID: bb294d15d18bb3e5c6dfcf12c1ac5de680b0a33af92d5979f7ebe5443c92712f
Instruction ID: 951ed3a0a216203bae23ba6a58679d80645a7e4851a5ab7ccf8834bd9207df05
Opcode Fuzzy Hash: bb294d15d18bb3e5c6dfcf12c1ac5de680b0a33af92d5979f7ebe5443c92712f
Instruction Fuzzy Hash: A5718370A44304AFDB20DF65DC49BAA7BF8FB44705F10466EFA01E62D0DB75A904CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004B4FD0 Relevance: 9.1, APIs: 6, Instructions: 95
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MakeAbsoluteSD.API-MS-WIN-SECURITY-BASE-L1-1-0(?,00000000,004B4592,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,004B4592,00000000), ref: 004B4FFF
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,004B4592,00000000,00000000), ref: 004B500D
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,00000008,?,?,?,?,?,004B4592,00000000,00000000), ref: 004B5034
MakeAbsoluteSD.API-MS-WIN-SECURITY-BASE-L1-1-0(?,00000000,004B4592,?,00000000,00000000,00000000,?,?,?,?,00000000,?), ref: 004B5077
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000000,?,?,?,?,004B4592,00000000,00000000), ref: 004B5F86
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,00000000,00000000,?,?,?,?,00000000,?,?,?,?,004B4592,00000000,00000000), ref: 004B5F9B

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: AbsoluteErrorHeapLastMake$AllocFree
String ID:
API String ID: 2337675216-0
Opcode ID: 24d0f8bd3778132949439701d0f0aff63138e3a80925eb8c8be68bafeed1377e
Instruction ID: 3887ca1bc9ee2a6f01b49c68110bcef407fbc97274f1b3e1d2c6e433648f19cf
Opcode Fuzzy Hash: 24d0f8bd3778132949439701d0f0aff63138e3a80925eb8c8be68bafeed1377e
Instruction Fuzzy Hash: F7312F76A00509AFDB14DF98CC85FFEB7BCEF44704F140169E605E7280EA74AA06CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004B67D0 Relevance: 9.0, APIs: 6, Instructions: 23COMMON

Download Yara Rule

APIs

RpcServerUnregisterIfEx.RPCRT4(?,00000000,00000001), ref: 004B67DD
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(004B7428), ref: 004B67EA
RpcMgmtStopServerListening.RPCRT4(00000000), ref: 004B67FB
RpcMgmtWaitServerListen.RPCRT4 ref: 004B6801
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(004B7428), ref: 004B680C
I_RpcMapWin32Status.RPCRT4(00000000), ref: 004B6813

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: Server$CriticalMgmtSection$EnterLeaveListenListeningStatusStopUnregisterWaitWin32
String ID:
API String ID: 3168261810-0
Opcode ID: a228b6fe6c120d0c8a6ec2b51b3186e81d57125baf2588a5ee83008d98aa2f8d
Instruction ID: b1e6ecee0721bd608aea136abfa24277584ce099f89fecd9a455b96c8177a61f
Opcode Fuzzy Hash: a228b6fe6c120d0c8a6ec2b51b3186e81d57125baf2588a5ee83008d98aa2f8d
Instruction Fuzzy Hash: 11E06532140200ABCA203BA5AC0EB8A3F2CAB807A2F110239F301A11A0CEA88415CB7D

Uniqueness

Uniqueness Score: -1.00%

Function 004B6780 Relevance: 9.0, APIs: 6, Instructions: 23COMMON

Download Yara Rule

APIs

RpcServerUnregisterIf.RPCRT4(?,00000000,00000001), ref: 004B678D
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(004B7428), ref: 004B679A
RpcMgmtStopServerListening.RPCRT4(00000000), ref: 004B67AB
RpcMgmtWaitServerListen.RPCRT4 ref: 004B67B1
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(004B7428), ref: 004B67BC
I_RpcMapWin32Status.RPCRT4(00000000), ref: 004B67C3

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: Server$CriticalMgmtSection$EnterLeaveListenListeningStatusStopUnregisterWaitWin32
String ID:
API String ID: 3168261810-0
Opcode ID: 91bf0badca7fcda817dd9719619b2db02c4e315275f9aaea33a16009524e7824
Instruction ID: 79e9cdbe50b27f3314ac70acd026ddce826e6d8fd00808ebb3f88f4384aa9124
Opcode Fuzzy Hash: 91bf0badca7fcda817dd9719619b2db02c4e315275f9aaea33a16009524e7824
Instruction Fuzzy Hash: 04E01A32544214ABCB103BA5BC0EBDE3F6CEB857A6F150239F705A51A0CEB98415CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 004B50B0 Relevance: 7.6, APIs: 5, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(00000000), ref: 004B50DD
GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 004B50EC
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 004B50F5
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 004B50FE
QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0(?), ref: 004B5113

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 9a232d40d056365fe62951d84c80ab9c7901f1e2a807e712aa2ce8375defff89
Instruction ID: 80fcc37d7f26306a02a519b9303f68786cca9573caebcc4d259384ba56f290b0
Opcode Fuzzy Hash: 9a232d40d056365fe62951d84c80ab9c7901f1e2a807e712aa2ce8375defff89
Instruction Fuzzy Hash: 30111F71D15208EBCB10EFB8D94869EB7F9FF48351F52496AD805E7210EB349A04CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004B6710 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(004B7428), ref: 004B671B

Part of subcall function 004B665C: LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0(00000000), ref: 004B6688

RpcServerListen.RPCRT4(?,00003039,?), ref: 004B6749
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(004B7428), ref: 004B6760
I_RpcMapWin32Status.RPCRT4(00000000), ref: 004B6767

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: CriticalSection$AllocEnterLeaveListenLocalServerStatusWin32
String ID:
API String ID: 3342318003-0
Opcode ID: 171422472bd3f1d6badf0c1a667bd09117802cf023586a4b212f74958828dd95
Instruction ID: 818b5eac8138d0f40cb6175944ba9a520f6516d7d6322c323d056645731203e1
Opcode Fuzzy Hash: 171422472bd3f1d6badf0c1a667bd09117802cf023586a4b212f74958828dd95
Instruction Fuzzy Hash: 16F0BE32900224AF8B11AB68AC498EA3B5CEB84B513120225FD05A7210CB389C02CBE8

Uniqueness

Uniqueness Score: -1.00%

Function 004B514A Relevance: 6.0, APIs: 4, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,004B5280,@pK), ref: 004B5151
UnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(004B5280,?,004B5280,@pK), ref: 004B515A
GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(C0000409,?,004B5280,@pK), ref: 004B5165
TerminateProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000000,?,004B5280,@pK), ref: 004B516C

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 024614ed6ea006697dee96f04b3b5b0370105ecb83468637a404ce49a3aeb68d
Instruction ID: 6a6d9e786e65294c0773416b8ace1b45e8359541100f36af803b72861a4d0846
Opcode Fuzzy Hash: 024614ed6ea006697dee96f04b3b5b0370105ecb83468637a404ce49a3aeb68d
Instruction Fuzzy Hash: E9D00272044108FFD7403BE1ED0DA4A3F2DEB44796F064524F70D96461DF715459DB69

Uniqueness

Uniqueness Score: -1.00%

Function 004B43D0 Relevance: 3.9, APIs: 3, Instructions: 190memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004B45C0: GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000008,00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 004B45EC
Part of subcall function 004B45C0: OpenProcessToken.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000000), ref: 004B45F3
Part of subcall function 004B45C0: GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 004B460C
Part of subcall function 004B45C0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 004B4616
Part of subcall function 004B45C0: GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,00000005(TokenIntegrityLevel),00000000,00000000,?), ref: 004B4634
Part of subcall function 004B45C0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 004B463E
Part of subcall function 004B45C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,00000008,?), ref: 004B466F
Part of subcall function 004B45C0: InitializeSecurityDescriptor.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,00000001), ref: 004B4688
Part of subcall function 004B45C0: GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,00000001(TokenIntegrityLevel),00000014,?,?), ref: 004B46A3
Part of subcall function 004B45C0: GetTokenInformation.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,00000005(TokenIntegrityLevel),?,?,?), ref: 004B46C0
Part of subcall function 004B45C0: SetSecurityDescriptorOwner.API-MS-WIN-SECURITY-BASE-L1-1-0(00000000,00000014,00000000), ref: 004B46D3

HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004B453D
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004B4556
memcmp.API-MS-WIN-CORE-CRT-L1-1-0(-00000024,004B1570,00000010), ref: 004B4577

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: Token$Information$Heap$DescriptorErrorFreeLastProcessSecurity$AllocCurrentInitializeOpenOwnermemcmp
String ID:
API String ID: 2676371371-0
Opcode ID: 90f575a4eae364ddffe4623bab793dc367d646e49d803eb7f4937cd7234c2c0a
Instruction ID: a0845540b393d19d1a4b57b4300e99baae8e1cab9dfd12ee59e36b4e5b21ef6f
Opcode Fuzzy Hash: 90f575a4eae364ddffe4623bab793dc367d646e49d803eb7f4937cd7234c2c0a
Instruction Fuzzy Hash: 1B511A31A00A21BFDB34CB54CC50BAE77A9AF84714F154166FA01E7391DB74ED01CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004B2160 Relevance: 42.3, APIs: 21, Strings: 3, Instructions: 302
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringOrdinal.API-MS-WIN-CORE-STRING-L1-1-0(?,000000FF,00000000,000000FF,00000001), ref: 004B21BF
AcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(-004B7380,?,000000FF,00000000,000000FF,00000001), ref: 004B21EE
AcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(004B7360,00000000,00000000,00000002,?,000000FF,00000000,000000FF,00000001), ref: 004B2238
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(004B7360,?,000000FF,00000000,000000FF,00000001), ref: 004B2250
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(-004B7380,00000000,00000000,00000002,?,000000FF,00000000,000000FF,00000001), ref: 004B227D
EtwEventEnabled.NTDLL ref: 004B22D2
EtwEventEnabled.NTDLL ref: 004B2309
AcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(-004B7380,?,000000FF,00000000,000000FF,00000001), ref: 004B2330
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,System\CurrentControlSet\Services,00000000,00020019,?,?,000000FF,00000000,000000FF,00000001), ref: 004B235E
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,?,00000000,00020019,00000000,?,000000FF,00000000,000000FF,00000001), ref: 004B2378
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,Parameters,00000000,00020019,00000000,?,00000000,00020019,00000000,?,000000FF,00000000,000000FF,00000001), ref: 004B2396
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,?,000000FF,00000000,000000FF,00000001), ref: 004B23B2
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,?,000000FF,00000000,000000FF,00000001), ref: 004B23C0
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,ServiceDllUnloadOnStop,00000000,?,00000000,00000004,?,000000FF,00000000,000000FF,00000001), ref: 004B23DF
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(-004B7380,?,000000FF,00000000,000000FF,00000001), ref: 004B23FE
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,?,000000FF,00000000,000000FF,00000001), ref: 004B240C
ActivateActCtx.API-MS-WIN-CORE-SIDEBYSIDE-L1-1-0(00000000,?,?,000000FF,00000000,000000FF,00000001), ref: 004B2466
FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,000000FF,00000000,000000FF,00000001), ref: 004B2476
DeactivateActCtx.API-MS-WIN-CORE-SIDEBYSIDE-L1-1-0(00000000,00000000,?,000000FF,00000000,000000FF,00000001), ref: 004B248B

Strings

System\CurrentControlSet\Services, xrefs: 004B2346
Parameters, xrefs: 004B238E
ServiceDllUnloadOnStop, xrefs: 004B23D7

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: ExclusiveLock$AcquireCloseOpenRelease$EnabledEvent$ActivateCompareDeactivateFreeLibraryOrdinalQueryStringValue
String ID: Parameters$ServiceDllUnloadOnStop$System\CurrentControlSet\Services
API String ID: 701447889-2925796325
Opcode ID: 0ce7aa46df32183bfe03112a278f65e9ba167ec88ca11608d557d5ed4c473651
Instruction ID: 9b4b2afb6253436d37ef4c4703a03f2be9cf1a91020248976dd1faec2e781643
Opcode Fuzzy Hash: 0ce7aa46df32183bfe03112a278f65e9ba167ec88ca11608d557d5ed4c473651
Instruction Fuzzy Hash: 0DC15135900208DFDB24DFA4DD54BEEBBB9FB44301F14516AEC12A3360DBB99905DB68

Uniqueness

Uniqueness Score: -1.00%

Function 004B4D90 Relevance: 15.1, APIs: 10, Instructions: 130
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringOrdinal.API-MS-WIN-CORE-STRING-L1-1-0(?,000000FF,00000000,000000FF,00000001), ref: 004B4DF3
AcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(-004B7380), ref: 004B4E22
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000008), ref: 004B4E3C
RegisterWaitForSingleObjectEx.API-MS-WIN-CORE-THREADPOOL-PRIVATE-L1-1-0(00000000,Function_00001FA0,00000000,000000FF,?), ref: 004B4E6D
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(-004B7380), ref: 004B4E8F

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: ExclusiveLock$AcquireAllocCompareHeapObjectOrdinalRegisterReleaseSingleStringWait
String ID:
API String ID: 1836250775-0
Opcode ID: c48d2ca7b6b0e3d650544a0fa242d470d3cff7e086bd347b86bc80d3188d354e
Instruction ID: cbcce671c3245deb88b079adfea5d3b0088d1f8224d5a99b709e90aeae5be1ee
Opcode Fuzzy Hash: c48d2ca7b6b0e3d650544a0fa242d470d3cff7e086bd347b86bc80d3188d354e
Instruction Fuzzy Hash: 7E41B271A04614EFDB208FA8DC04BEABBB9BB44350F14426AF915E7390C7789C42DB69

Uniqueness

Uniqueness Score: -1.00%

Function 004B4940 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 168
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlQueryHeapInformation.NTDLL(00000000,00000004,?,00000140,00000140), ref: 004B49A3
qsort_s.API-MS-WIN-CORE-CRT-L1-1-0(?,?,00000014,004B4F90,00000000,?,-004B7370), ref: 004B49DB
bsearch_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,00000014,004B4F90,00000000), ref: 004B4A63
__aulldiv.LIBCMT ref: 004B4B1E
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000140,?,-004B7370), ref: 004B4B5C
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,-004B7370), ref: 004B4B80

Strings

#, xrefs: 004B49B1

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: Heap$AllocFreeInformationQuery__aulldivbsearch_sqsort_s
String ID: #
API String ID: 3915933142-1885708031
Opcode ID: 1618b0403a5c2225a5f904aa503ed4a884ae62cef8ede208daa154d1adbbf19e
Instruction ID: 05fdf298cc960f238abea2724f9559c2419a1f2f8172dc2393f8cbe1bf1a53cd
Opcode Fuzzy Hash: 1618b0403a5c2225a5f904aa503ed4a884ae62cef8ede208daa154d1adbbf19e
Instruction Fuzzy Hash: 38614DB1900618DFDB24CF29CC44BDAB7B5BB88304F1042AAE509A7351D775AD91CF98

Uniqueness

Uniqueness Score: -1.00%

Function 004B35A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 117
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,Software\Microsoft\Windows NT\CurrentVersion\Svchost,00000000,00020019,l2K,?,?,004B326C,?,?,?,?,00000004), ref: 004B35C3

Part of subcall function 004B36B0: RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(l2K,?,00000000,00020019,00000000,00000007,004B7394,?,00000000,00000000,00000000), ref: 004B374A
Part of subcall function 004B36B0: RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004B3787
Part of subcall function 004B36B0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 004B37D3

RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(l2K,00000000,00000000,?,?,004B326C,?,?,?,?,00000004), ref: 004B35E0
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000000,00000000,?,?,004B326C,?,?,?,?,00000004), ref: 004B3646
InitializeSRWLock.API-MS-WIN-CORE-SYNCH-L1-1-0(00000010,?,?,004B326C,?,?,?,?,00000004), ref: 004B3677

Strings

Software\Microsoft\Windows NT\CurrentVersion\Svchost, xrefs: 004B35B6
l2K, xrefs: 004B35A9, 004B35D1, 004B35DB, 004B35AE

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: AllocHeapOpen$CloseEnumInitializeLock
String ID: Software\Microsoft\Windows NT\CurrentVersion\Svchost$l2K
API String ID: 4187173433-593795201
Opcode ID: ba0f3952db90568a55c1e8ab70b355e0fbeb892501bcbc6a4a7b2334b55b83ab
Instruction ID: 44ed1971baf9cf71659a805f4ec2df665c8f30cee70a40e7a7634de30ad53142
Opcode Fuzzy Hash: ba0f3952db90568a55c1e8ab70b355e0fbeb892501bcbc6a4a7b2334b55b83ab
Instruction Fuzzy Hash: EE412675900301EBCB309F69CC457A7B7B8FB94346B05062AEC4297350E774AE62C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 004B2000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(00000004,?,?), ref: 004B2025

Part of subcall function 004B20C0: RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,System\CurrentControlSet\Services,00000000,00020019,?,00000004,?), ref: 004B20F2
Part of subcall function 004B20C0: RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,?,00000000,00020019,00000000), ref: 004B210C
Part of subcall function 004B20C0: RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,Parameters,00000000,00020019,00000000,?,00000000,00020019,00000000), ref: 004B2127
Part of subcall function 004B20C0: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000), ref: 004B2143
Part of subcall function 004B20C0: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000), ref: 004B2151

RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,ServiceDllUnloadOnStop,00000000,00000000,00000000,00000004), ref: 004B2052
ActivateActCtx.API-MS-WIN-CORE-SIDEBYSIDE-L1-1-0(?,?), ref: 004B207A
FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?), ref: 004B208A
DeactivateActCtx.API-MS-WIN-CORE-SIDEBYSIDE-L1-1-0(00000000,?), ref: 004B209F
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(00000004), ref: 004B20A6
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000), ref: 004B20B6

Strings

ServiceDllUnloadOnStop, xrefs: 004B204A

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: CloseOpen$ExclusiveLock$AcquireActivateDeactivateFreeLibraryQueryReleaseValue
String ID: ServiceDllUnloadOnStop
API String ID: 875000390-2673481689
Opcode ID: d99c850f141573d9ce8c80f27f76a1c47d90834d9f88c1d40ccc7b464f56dd6c
Instruction ID: ce1b52b0aecdf4163282b535b8cfb4b898b014abe5aa770c45c448022fa66e06
Opcode Fuzzy Hash: d99c850f141573d9ce8c80f27f76a1c47d90834d9f88c1d40ccc7b464f56dd6c
Instruction Fuzzy Hash: B8213A71900208EBDB20EF94DE48B9FBBFCBF08701F10456AE615A2250DB749A05CF65

Uniqueness

Uniqueness Score: -1.00%

Function 004B665C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 67
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0(00000000), ref: 004B6688
RpcServerUseProtseqEpW.RPCRT4(ncacn_np,0000000A,00000000,00000000), ref: 004B66C1
RpcServerRegisterIf.RPCRT4(?,00000000,00000000), ref: 004B66DC
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(00000000), ref: 004B66E5
I_RpcMapWin32Status.RPCRT4(00000000), ref: 004B66EC
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(00000000), ref: 004B66F5

Strings

ncacn_np, xrefs: 004B66BC

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: Local$FreeServer$AllocProtseqRegisterStatusWin32
String ID: ncacn_np
API String ID: 1007250533-272970834
Opcode ID: 7a6eefeaabe9ececffc1d84471675c75065d3f08dd8e79d120b8049643902f08
Instruction ID: f3282937fe862b54f99fe7c4c170ebdc73dd80f7817193ae921b85af68696cbb
Opcode Fuzzy Hash: 7a6eefeaabe9ececffc1d84471675c75065d3f08dd8e79d120b8049643902f08
Instruction Fuzzy Hash: 49110232B0421067D3202B695C49BEB76AD9BD97A8F13012AFE09E3350EE7C9D0185FD

Uniqueness

Uniqueness Score: -1.00%

Function 004B20C0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,System\CurrentControlSet\Services,00000000,00020019,?,00000004,?), ref: 004B20F2
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,?,00000000,00020019,00000000), ref: 004B210C
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,Parameters,00000000,00020019,00000000,?,00000000,00020019,00000000), ref: 004B2127
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000), ref: 004B2143
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000), ref: 004B2151

Strings

System\CurrentControlSet\Services, xrefs: 004B20DD
Parameters, xrefs: 004B211F

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: Open$Close
String ID: Parameters$System\CurrentControlSet\Services
API String ID: 3083169812-135649160
Opcode ID: 8808219b9bf7fdc86cdf631ffca38e47482edade7300f7195eb1fa64ea2e45e8
Instruction ID: 029d08cc366de525204e46e1b49338b3bf2ad9241a75b0333c4ff09e06dfa184
Opcode Fuzzy Hash: 8808219b9bf7fdc86cdf631ffca38e47482edade7300f7195eb1fa64ea2e45e8
Instruction Fuzzy Hash: B4116075A41228BBD7208B689D49B9FBBACEB14751F110166ED44E3310D6748E01DAA4

Uniqueness

Uniqueness Score: -1.00%

Function 004B4350 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlGetDeviceFamilyInfoEnum.NTDLL(00000000,?,00000000), ref: 004B4363
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,System\CurrentControlSet\Control\SCMConfig,00000000,00020019,?), ref: 004B438A
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,EnableSvchostMitigationPolicy,00000000,?,80000002,00000000,80000002,System\CurrentControlSet\Control\SCMConfig), ref: 004B43B0
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,EnableSvchostMitigationPolicy,00000000,?,80000002,00000000,80000002), ref: 004B43C0

Strings

System\CurrentControlSet\Control\SCMConfig, xrefs: 004B4380
EnableSvchostMitigationPolicy, xrefs: 004B43A8

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: CloseDeviceEnumFamilyInfoOpenQueryValue
String ID: EnableSvchostMitigationPolicy$System\CurrentControlSet\Control\SCMConfig
API String ID: 3374871968-1194725368
Opcode ID: c480f565b94656961aefa0513ba7c7ee19de1829a34a1ecd3e42c7eeb6e8d72e
Instruction ID: 90d2fa330f87d10cd81a29442972ad7b4b4235c92a09987b4f19b24fcba88f7a
Opcode Fuzzy Hash: c480f565b94656961aefa0513ba7c7ee19de1829a34a1ecd3e42c7eeb6e8d72e
Instruction Fuzzy Hash: 32014434A44209BBEB14DA948C86FFFB3ACEB44304F640567E910E1252D7789E549A79

Uniqueness

Uniqueness Score: -1.00%

Function 004B3E30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80registrymemoryCOMMON

Download Yara Rule

APIs

RegGetValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0(l2K,00000000,?,0000FFFF,00000000,00000000,00000000,00000000,l2K,00000000,?,00000000,00000000), ref: 004B3E6E
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 004B3E99
RegGetValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,00000000,?,0000FFFF,00000000,00000000,00000000), ref: 004B3EBA

Strings

l2K, xrefs: 004B3E39, 004B3E60

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: Value$AllocHeap
String ID: l2K
API String ID: 1008940825-3002214207
Opcode ID: 143e6d90752bdc661b7b55d0df266dcc2b322ca4993cfe5f4453cfa61f223f59
Instruction ID: 5119bba01712f7cbb01910df6b14b06d97a1e9e241ba79b4fac16e15e04f2902
Opcode Fuzzy Hash: 143e6d90752bdc661b7b55d0df266dcc2b322ca4993cfe5f4453cfa61f223f59
Instruction Fuzzy Hash: 66213C71604209FFEB10DF99DC45FAAB7A8EB54311F10016AF900E6290EB75AE51DB64

Uniqueness

Uniqueness Score: -1.00%

Function 004B3DF0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,CoInitializeSecurityParam,00000000,s9K,s9K,?,00000001,004B3973), ref: 004B3E10

Strings

s9K, xrefs: 004B3DF9, 004B3E00
CoInitializeSecurityParam, xrefs: 004B3E0E
s9K, xrefs: 004B3E01, 004B3E0B

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: QueryValue
String ID: CoInitializeSecurityParam$s9K$s9K
API String ID: 3660427363-1459389152
Opcode ID: 4af1d61cc3cd7ea02c0fce7bf4fcb276a57aad6bec24e1f97e5ceb2f957e582e
Instruction ID: 3baa0264fed814f9add8d5a030d8d6140ecda796653f715906c2f344c18e3c8a
Opcode Fuzzy Hash: 4af1d61cc3cd7ea02c0fce7bf4fcb276a57aad6bec24e1f97e5ceb2f957e582e
Instruction Fuzzy Hash: 33E030B1500108EBEB209F559C05BEBB7ACDB40311F104167A90196140D678EE5586BA

Uniqueness

Uniqueness Score: -1.00%

Function 004B4F10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(WLDP.DLL,00000000,00000800), ref: 004B4F1C
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,WldpIsAllowedEntryPoint), ref: 004B4F31

Strings

WldpIsAllowedEntryPoint, xrefs: 004B4F2B
WLDP.DLL, xrefs: 004B4F17

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: WLDP.DLL$WldpIsAllowedEntryPoint
API String ID: 2574300362-3624529204
Opcode ID: d6f949af1748da7095eca5f5116006975a95ab4d89239f175931a4c7f33fbd1a
Instruction ID: 3d9af98786c688e1bd903b7067f39108b52ccbf5d3eaf1a9f465384a09b2c847
Opcode Fuzzy Hash: d6f949af1748da7095eca5f5116006975a95ab4d89239f175931a4c7f33fbd1a
Instruction Fuzzy Hash: BDD0C774654301ABD3505B746C16B8635D4ABA4B41F604136A906D66E2DB748014CA3C

Uniqueness

Uniqueness Score: -1.00%

Function 004B3F50 Relevance: 6.2, APIs: 4, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000064,00000000,?,?,00000004), ref: 004B3F8A
memcpy.API-MS-WIN-CORE-CRT-L1-1-0(00000064,00000000,00000000,?,?,00000004), ref: 004B3FAA
LCMapStringW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000400,00000100,?,?,?,?,?,?,?,00000004), ref: 004B4031

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: AllocHeapStringmemcpy
String ID:
API String ID: 132164024-0
Opcode ID: a541357c7b9ef7cb1361ec3a752a1eea874ede0234e69bd66b3c75e106abb91b
Instruction ID: f6936528feda815fda8eb719524b0aedf05a2657f9167087ee277d34c1493de0
Opcode Fuzzy Hash: a541357c7b9ef7cb1361ec3a752a1eea874ede0234e69bd66b3c75e106abb91b
Instruction Fuzzy Hash: 3C71D674A0022287DB24AF1888543F772E1EBD4344F99402BEDC59B786E63DDD82D779

Uniqueness

Uniqueness Score: -1.00%

Function 004B3090 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 004B50B0: GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(00000000), ref: 004B50DD
Part of subcall function 004B50B0: GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 004B50EC
Part of subcall function 004B50B0: GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 004B50F5
Part of subcall function 004B50B0: GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 004B50FE
Part of subcall function 004B50B0: QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0(?), ref: 004B5113

_initterm_e.API-MS-WIN-CORE-CRT-L2-1-0(004B11F8,004B11FC), ref: 004B30CD
__wgetmainargs.API-MS-WIN-CORE-CRT-L2-1-0(?,?,00000000,00000000,00000000), ref: 004B30E5
_initterm.API-MS-WIN-CORE-CRT-L2-1-0(004B11F0,004B11F4), ref: 004B30F5

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick__wgetmainargs_initterm_initterm_e
String ID:
API String ID: 543135555-0
Opcode ID: 89ef8b3449e86d3d3c20a3c92dda167ce81a7a31b23b22a4fc9401d023f8c8ac
Instruction ID: 95b3a51529d589cadd910aee417f1fdb055d738df91cb4c0a0e1e5d8b4399d11
Opcode Fuzzy Hash: 89ef8b3449e86d3d3c20a3c92dda167ce81a7a31b23b22a4fc9401d023f8c8ac
Instruction Fuzzy Hash: 7DF06271840209ABDB00EF9DDC5ABEE7BBCEB04309F500166E514A2142DB7856188BB9

Uniqueness

Uniqueness Score: -1.00%

Function 004B5FC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerW.API-MS-WIN-SERVICE-WINSVC-L1-1-0(?,004B4F80), ref: 004B6005
SetServiceStatus.API-MS-WIN-SERVICE-CORE-L1-1-0(00000000,00000030), ref: 004B6014

Strings

0, xrefs: 004B5FD8

Memory Dump Source

Source File: 00000000.00000002.2045743246.00000000004B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004B0000, based on PE: true

Associated: 00000000.00000002.2045710143.00000000004B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2045767502.00000000004BB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b0000_svchost(1).jbxd

Similarity

API ID: Service$CtrlHandlerRegisterStatus
String ID: 0
API String ID: 786618493-4108050209
Opcode ID: 23514c546214fc970fa6d327655dbee9638b8a756315c49421eb159ee8c075b8
Instruction ID: 7c32c53cc68cf4b36a3344a07228ced5667bfb5d050b6dd84142b6520647b83a
Opcode Fuzzy Hash: 23514c546214fc970fa6d327655dbee9638b8a756315c49421eb159ee8c075b8
Instruction Fuzzy Hash: 36F030709012089BDB04DF95D8597EFBBF8EF48308F50415DE80567280DBB95605CFA4

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report svchost(1).exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: svchost(1).exePID: 6392, Parent PID: 1028

General

Chronological Activities

Disassembly

Analysis Process: svchost(1).exePID: 6392, Parent PID: 1028COMMON

Execution Graph

Graph

Callgraph

Executed Functions

Windows Analysis Report
svchost(1).exe

Function 004B3150 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 118
memorynativeregistryCOMMON

Function 004B3120 Relevance: 4.5, APIs: 3, Instructions: 13
COMMON

Function 004B45C0 Relevance: 70.3, APIs: 38, Strings: 2, Instructions: 258
memoryCOMMON

Function 004B2E20 Relevance: 52.7, APIs: 28, Strings: 2, Instructions: 175
memoryCOMMON

Function 004B32D0 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
memorytimenativeCOMMON

Function 004B4FD0 Relevance: 9.1, APIs: 6, Instructions: 95
memoryCOMMON

Function 004B2160 Relevance: 42.3, APIs: 21, Strings: 3, Instructions: 302
registryCOMMON

Function 004B4D90 Relevance: 15.1, APIs: 10, Instructions: 130
memoryregistryCOMMON

Function 004B4940 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 168
memoryCOMMON

Function 004B35A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 117
registrymemoryCOMMON

Function 004B2000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 65
registryCOMMON

Function 004B665C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 67
memoryCOMMON

Function 004B20C0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64
registryCOMMON

Function 004B4350 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
registryCOMMON