7f86693073367afd6e304c2146bae8bdebf2806dc464c9bc394c96ad1ac8360a

Analysis

max time kernel
147s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1c64eefc7a32213929b652e85c0f557c.exe
Size

96KB
MD5

1c64eefc7a32213929b652e85c0f557c
SHA1

e6491d2143fd9b30555eaf0e0cf314bc730907d7
SHA256

7f86693073367afd6e304c2146bae8bdebf2806dc464c9bc394c96ad1ac8360a
SHA512

27f65e3100c79c850e5b1182551daa87467fe09715354e399cb6142777ae66c8aaf7b10478021229770c18e2623af1442818eb73ccf7ac3a35a139a4b42005fe
SSDEEP

1536:e2V20XYBjJEd7+aDMNcHNMc6RqIbaXtZwXoErFnB5myN/N8L6surO0EE4:e2VdX7pD9NMBbaXA1rFnfmylN8L6sur4

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	dllhost.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	dllhost.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	1c64eefc7a32213929b652e85c0f557c.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	dllhost.exe

Deletes itself 1 IoCs

pid	Process
1948	dllhost.exe

Executes dropped EXE 1 IoCs

pid	Process
1948	dllhost.exe

Windows security modification 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	dllhost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	dllhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dllhost.exe	1c64eefc7a32213929b652e85c0f557c.exe
File created	C:\Windows\dllhost.exe	1c64eefc7a32213929b652e85c0f557c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 31 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BE749A50-E290-40DB-84B3-D1BDC8833446}\ca-02-04-c4-20-c8	dllhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-02-04-c4-20-c8\WpadDecision = "0"	dllhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BE749A50-E290-40DB-84B3-D1BDC8833446}\WpadDecision = "0"	dllhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	dllhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BE749A50-E290-40DB-84B3-D1BDC8833446}\WpadNetworkName = "Network 3"	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	dllhost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{B155BDF8-02F0-451E-9A26-AE317CFD7779} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 01000000000000001040a60be33eda01	dllhost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0078000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	dllhost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-02-04-c4-20-c8\WpadDecisionTime = 50fbf10fe33eda01	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	dllhost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	dllhost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BE749A50-E290-40DB-84B3-D1BDC8833446}\WpadDecisionTime = 50fbf10fe33eda01	dllhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	dllhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	dllhost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000b0dea30be33eda01	dllhost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BE749A50-E290-40DB-84B3-D1BDC8833446}\WpadDecisionTime = 50ac370ae33eda01	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BE749A50-E290-40DB-84B3-D1BDC8833446}	dllhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BE749A50-E290-40DB-84B3-D1BDC8833446}\WpadDecisionReason = "1"	dllhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-02-04-c4-20-c8\WpadDetectedUrl	dllhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	dllhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	dllhost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-02-04-c4-20-c8\WpadDecisionTime = 50ac370ae33eda01	dllhost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0078000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-02-04-c4-20-c8	dllhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-02-04-c4-20-c8\WpadDecisionReason = "1"	dllhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	dllhost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	dllhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	dllhost.exe

C:\Users\Admin\AppData\Local\Temp\1c64eefc7a32213929b652e85c0f557c.exe
"C:\Users\Admin\AppData\Local\Temp\1c64eefc7a32213929b652e85c0f557c.exe"
1⤵
- Looks for VMWare Tools registry key
- Drops file in Windows directory
PID:1852

C:\Windows\dllhost.exe
"C:\Windows\dllhost.exe"
1⤵
- Modifies security service
- Windows security bypass
- Looks for VMWare Tools registry key
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1852-0-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1852-2-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1852-1-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1852-9-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1948-14-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1948-16-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1948-10-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1948-11-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1948-12-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1948-13-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1948-8-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1948-7-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1948-17-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1948-18-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1948-19-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1948-20-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1948-21-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1948-22-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1948-23-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1948-24-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads