Scenario: A user thought they were downloading the SysInternals tool suite, but the tools
never launched and became inaccessible. Since then, the system has gradually slowed down and become less
responsive — classic symptoms of a trojanized download quietly establishing persistence in the background.
Q1What was the malicious executable file name that the user downloaded?
An Autopsy disk image triage of
Users\Public\Downloads shows a single unallocated, recently-created executable sitting where the real SysInternals suite should be.answerSysInternals.exe
Q2When was the last time the malicious executable file was modified?
The AppCompatCache (Shimcache) entry for
C:\Users\Public\Downloads\SysInternals.exe records its last modified timestamp — useful for anchoring the initial infection time.answer2022-11-15 21:18
Q3What is the SHA1 hash value of the malware?
AmcacheParser.exe -f Amcache.hve --csv .
Eric Zimmerman's
AmcacheParser parses the Amcache.hve registry hive, which records SHA1 hashes for every executable that has run on the system — including ones long since deleted.answerfa1002b02fc5551e075ec44bb4ff9cc13d563dcf
Q4Based on the Alibaba vendor, what is the malware's family?
VirusTotal's code insights confirm this is a downloader/Trojan masquerading as legitimate VMware software, using XOR string obfuscation (key 0x41) to hide its C2 infrastructure.
answerRozena
Q5What is the first mapped domain's Fully Qualified Domain Name (FQDN)?
53/71 vendors flagged the file. VirusTotal's Relations tab lists the URLs the sample contacted at runtime.
answerwww.malware430.com
Q6The mapped domain is linked to an IP address. What is that IP address?
The malware modified
C:\Windows\System32\drivers\etc\hosts to hardcode DNS resolution for both its C2 domain and the legitimate sysinternals.com — a classic DNS-hijack / lookalike technique.answer192.168.15.10
Q7What is the name of the executable dropped by the first-stage executable?
Process command-line logging shows the first-stage binary spawning
cmd.exe to install and start a second-stage payload from C:\Windows.answervmtoolsIO.exe
Q8What is the name of the service installed by the 2nd-stage executable?
The same command line installs and auto-starts a Windows service to establish persistence, disguised with a VMware-themed name.
answerVMwareIOHelperService
IOC Summary
| Item | Value |
|---|---|
| Malicious Download | SysInternals.exe |
| Last Modified | 2022-11-15 21:18 |
| SHA1 Hash | fa1002b02fc5551e075ec44bb4ff9cc13d563dcf |
| Malware Family | Rozena |
| C2 Domain | www.malware430.com |
| Hardcoded IP (hosts file) | 192.168.15.10 |
| Dropped 1st-Stage Payload | vmtoolsIO.exe |
| Persistence Mechanism | VMwareIOHelperService (Windows service) |
Lessons learned: A slowdown with no obvious cause is often the only visible symptom of a
trojanized download — the file system and registry tell the real story. AppCompatCache and Amcache are two of
the most durable execution artifacts on Windows: both persist long after a malicious file is deleted, and Amcache's
SHA1 hashes make pivoting straight to threat intel (VirusTotal) trivial. The hosts file hijack here is a cheap but
effective trick — hardcoding a C2 domain locally means the malware doesn't even need working DNS to reach out,
and a lookalike entry for the real sysinternals.com adds a layer of misdirection. Finally, the two-stage drop
(vmtoolsIO.exe → VMwareIOHelperService) shows why service creation events are worth alerting on: a VMware-themed
name on a host that isn't running VMware is a cheap, high-confidence detection opportunity.