3738f00e252e56c1f8f975be5e2892ab5a5d4dc9356aed5c3115100518ea86aa

General

Target

3738f00e252e56c1f8f975be5e2892ab5a5d4dc9356aed5c3115100518ea86aa.exe
Size

521KB
MD5

467a138cd67baef27295ac0b3cbc495e
SHA1

ef26a33665791d728f280bfe88c091ad5ace8c21
SHA256

3738f00e252e56c1f8f975be5e2892ab5a5d4dc9356aed5c3115100518ea86aa
SHA512

af31891a154b6de2091f6d00631bee1400feb6fb34535f51afdcf87dc1fdd31602fdcd0dc9d0de4950337a24b8473242b87ceaaf103919cc29433ca7db1c3290
SSDEEP

3072:eI1Y7fEq+P0cxxVu8jEhIGRZwW2JoYYubdWKOgt:c+8MfomoazJlXZWdg

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

whssvc.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" whssvc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	whssvc.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

whssvc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	whssvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	whssvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	whssvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	whssvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	whssvc.exe

Executes dropped EXE 1 IoCs

Processes:

whssvc.exe

pid process

3116 whssvc.exe

pid	process
3116	whssvc.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

3738f00e252e56c1f8f975be5e2892ab5a5d4dc9356aed5c3115100518ea86aa.exewhssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	3738f00e252e56c1f8f975be5e2892ab5a5d4dc9356aed5c3115100518ea86aa.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	whssvc.exe

Windows security modification 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

whssvc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	whssvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	whssvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	whssvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	whssvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	whssvc.exe

Drops file in System32 directory 4 IoCs

Processes:

whssvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	whssvc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	whssvc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	whssvc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	whssvc.exe

Drops file in Windows directory 2 IoCs

Processes:

3738f00e252e56c1f8f975be5e2892ab5a5d4dc9356aed5c3115100518ea86aa.exe

description	ioc	process
File created	C:\Windows\whssvc.exe	3738f00e252e56c1f8f975be5e2892ab5a5d4dc9356aed5c3115100518ea86aa.exe
File opened for modification	C:\Windows\whssvc.exe	3738f00e252e56c1f8f975be5e2892ab5a5d4dc9356aed5c3115100518ea86aa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 11 IoCs

Processes:

whssvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	whssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	whssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	whssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	whssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 01000000000000000e1cb168a6ffd801	whssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	whssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	whssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	whssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 01000000000000007380b368a6ffd801	whssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	whssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	whssvc.exe

C:\Users\Admin\AppData\Local\Temp\3738f00e252e56c1f8f975be5e2892ab5a5d4dc9356aed5c3115100518ea86aa.exe
"C:\Users\Admin\AppData\Local\Temp\3738f00e252e56c1f8f975be5e2892ab5a5d4dc9356aed5c3115100518ea86aa.exe"
1⤵
- Looks for VMWare Tools registry key
- Drops file in Windows directory
PID:4192

C:\Windows\whssvc.exe
"C:\Windows\whssvc.exe"
1⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Windows security modification
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\whssvc.exe

Filesize
521KB

MD5
467a138cd67baef27295ac0b3cbc495e

SHA1
ef26a33665791d728f280bfe88c091ad5ace8c21

SHA256
3738f00e252e56c1f8f975be5e2892ab5a5d4dc9356aed5c3115100518ea86aa

SHA512
af31891a154b6de2091f6d00631bee1400feb6fb34535f51afdcf87dc1fdd31602fdcd0dc9d0de4950337a24b8473242b87ceaaf103919cc29433ca7db1c3290

Download Submit
C:\Windows\whssvc.exe

Filesize
521KB

MD5
467a138cd67baef27295ac0b3cbc495e

SHA1
ef26a33665791d728f280bfe88c091ad5ace8c21

SHA256
3738f00e252e56c1f8f975be5e2892ab5a5d4dc9356aed5c3115100518ea86aa

SHA512
af31891a154b6de2091f6d00631bee1400feb6fb34535f51afdcf87dc1fdd31602fdcd0dc9d0de4950337a24b8473242b87ceaaf103919cc29433ca7db1c3290

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads