File name:

hh.exe

Full analysis: https://app.any.run/tasks/a1f7f955-1552-47a2-b964-29886a5335db
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: July 24, 2024, 22:09:01
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
quasar
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (console) x86-64, for MS Windows
MD5:

B9BEDF77EAC39D6D5C4B00C625ADA5ED

SHA1:

B418E67D9D00FD2B05D8F7889E612AA198775EC4

SHA256:

486BCDE161B5EB425DE3E7CE7A684B0EC88FC7D231BBF10111498329B9162566

SSDEEP:

98304:xxUgiBgSYdPeI6jfsQpzg8/5A+shLUz9xY9C9T:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • hh.exe (PID: 5196)

    • Drops the executable file immediately after the start

      • hh.exe (PID: 5196)

    • QUASAR has been detected (YARA)

      • RegSvcs.exe (PID: 3896)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • hh.exe (PID: 5196)

    • Checks for external IP

      • RegSvcs.exe (PID: 3896)

    • Connects to unusual port

      • RegSvcs.exe (PID: 3896)

  • INFO

    • Reads the machine GUID from the registry

      • RegSvcs.exe (PID: 3896)

    • Checks supported languages

      • hh.exe (PID: 5196)
      • RegSvcs.exe (PID: 3896)

    • Disables trace logs

      • RegSvcs.exe (PID: 3896)

    • Reads Environment values

      • RegSvcs.exe (PID: 3896)

    • Checks proxy server information

      • RegSvcs.exe (PID: 3896)

    • Creates files or folders in the user directory

      • RegSvcs.exe (PID: 3896)

    • Reads the computer name

      • RegSvcs.exe (PID: 3896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(3896) RegSvcs.exe
Version1.3.0.0
C2 (2)datacenterclient.ddns.net:11276
Sub_Dirmicrosofte
Install_NameUpdate service.exe
MutexQSR_MUTEX_USHHV6Bt9sa1Tgpylt
Startupservice update
Tag---trens--
LogDirLogs
Signature
Certificate
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:07:23 02:19:53+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.4
CodeSize: 1184256
InitializedDataSize: 1011712
UninitializedDataSize: 231424
EntryPoint: 0x6b0e0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 4.25.578.0
ProductVersionNumber: 4.25.578.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: getIsPublicRuntimeEventSource
FileDescription: getIsPublicRuntimeEventSource
FileVersion: 4.25.578.0
InternalName: getIsPublicRuntimeEventSource.dll
LegalCopyright:
OriginalFileName: getIsPublicRuntimeEventSource.dll
ProductName: getIsPublicRuntimeEventSource
ProductVersion: 4.25.578.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start hh.exe conhost.exe no specs msbuild.exe no specs #QUASAR regsvcs.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
320"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe—hh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.8.9037.0 built by: NET481REL1
3896"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
hh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Quasar
(PID) Process(3896) RegSvcs.exe
Version1.3.0.0
C2 (2)datacenterclient.ddns.net:11276
Sub_Dirmicrosofte
Install_NameUpdate service.exe
MutexQSR_MUTEX_USHHV6Bt9sa1Tgpylt
Startupservice update
Tag---trens--
LogDirLogs
Signature
Certificate
4188\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—hh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5196"C:\Users\admin\AppData\Local\Temp\hh.exe" C:\Users\admin\AppData\Local\Temp\hh.exe
explorer.exe
User:
admin
Company:
getIsPublicRuntimeEventSource
Integrity Level:
MEDIUM
Description:
getIsPublicRuntimeEventSource
Exit code:
0
Version:
4.25.578.0
Modules
Images
c:\users\admin\appdata\local\temp\hh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6596C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
2 239
Read events
2 223
Write events
16
Delete events
0

Modification events

(PID) Process:(5196) hh.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:hh
Value:
C:\Users\admin\hh.exe
(PID) Process:(3896) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3896) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3896) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3896) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3896) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3896) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3896) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3896) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3896) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regsvcs_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5196hh.exeC:\Users\admin\hh.exeexecutable
MD5:B9BEDF77EAC39D6D5C4B00C625ADA5ED
SHA256:486BCDE161B5EB425DE3E7CE7A684B0EC88FC7D231BBF10111498329B9162566
3896RegSvcs.exeC:\Users\admin\AppData\Roaming\Logs\07-24-2024binary
MD5:785749F23B8577AF5B4EC6C6C98284A4
SHA256:3058A47B197B49BB3CA5A56E1E0C7465CCAA2E0990C434909A3AB73B52DB4CED
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
48
DNS requests
18
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3896
RegSvcs.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
shared
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5272
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
700
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6944
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6012
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4288
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4360
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
104.126.37.185:443
—
Akamai International B.V.
DE
unknown
4204
svchost.exe
4.208.221.206:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3896
RegSvcs.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
3896
RegSvcs.exe
94.156.68.126:11276
datacenterclient.ddns.net
Terasyst Ltd
BG
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.174
whitelisted
ip-api.com
  • 208.95.112.1
shared
datacenterclient.ddns.net
  • 94.156.68.126
malicious
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
www.bing.com
  • 2.23.209.130
  • 2.23.209.133
  • 2.23.209.149
  • 2.23.209.182
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.23
  • 20.190.159.75
  • 20.190.159.2
  • 20.190.159.68
  • 20.190.159.71
  • 20.190.159.4
  • 40.126.31.71
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted

Threats

PID
Process
Class
Message
—
—
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
—
—
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
—
—
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
—
—
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
hh.exe