# Malware Under The Microscope: Manual Analysis

Satoban VBS malware persists via a fake 'system' service running Windows XP svchost.exe with a 'msg' argument that loads a config.txt pointing to a malicious VBScript.

- Payout: Real-world hack
- Program: Microsoft
- Analysis by: Huntress
- Disclosed: 2021-01-12
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/malware-under-the-microscope-manual-analysis
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-malware-under-the-microscope-manual-analysis
- Tags: area:os domain:desktop impact:data-leak impact:integrity kind:incident platform:threat-intel tech:windows technique:legacy-endpoint technique:source-review vuln:misconfiguration

**Target:** Windows service registry / svchost.exe
**Root cause:** Attacker registered a service named 'system' whose ImagePath points to a legitimate Windows XP svchost.exe copied into C:\Windows\System32\system, abusing its first-argument file-path parsing to load a local config.txt and kickstart a malicious VBScript.
**Steps:**
1. Registry key `HKLM\SYSTEM\CurrentControlSet\Services\system` created with ImagePath `C:\Windows\System32\system\svchost.exe msg`
2. Legitimate Windows XP svchost.exe copied to `C:\Windows\System32\system\svchost.exe` to evade AV
3. Directory `C:\Windows\System32\system\msg` created containing `config.txt` with `Source=C:\security\system.vbs`
4. On service start, svchost.exe reads msg\config.txt and executes `C:\security\system.vbs`
5. system.vbs runs `svchost.exe /e:VBScript.Encode "C:\security\blood.dat"` where svchost.exe is a renamed wscript.exe
6. blood.dat decoded VBScript spreads to USB drives, disables defenses, deletes shadow volumes, downloads further payloads
**How found:** SOC noticed an out-of-place svchost.exe under a 'system' subdirectory in the Services registry ImagePath, then traced the msg argument to a config.txt and the referenced VBScript.
**Exploitation:** Persistence via service autorun; the XP svchost.exe loads a local config to launch the VBScript chain, which then spreads to removable drives and fetches additional malware from external domains.
**Escalation:** Chained service persistence -> VBScript loader -> encoded payload that spreads via USB and downloads more malware.
**Insight:** Legitimate old Windows binaries (XP svchost.exe) can be repurposed as LOLBins for service persistence; check ImagePath values pointing to svchost.exe outside System32 and inspect first-argument directories for config files.

## Proof of concept (copied exactly from the original report)

**Malicious service ImagePath registry value**

```
HKLM\SYSTEM\CurrentControlSet\Services\system

For those that might not know, this is the “Services” registry tree inside the HKEY_LOCAL_MACHINE hive. This stores information about each service on the system, with the last string system referring to the name of the defined service.
Inside each key within the Service registry key, the interesting value to examine further is the ImagePath value, which specifies the full command that is run or executed as the service starts. For this system service, the ImagePath value was set to:
C:\Windows\System32\system\svchost.exe msg
```

**VBScript launching encoded blood.dat**

```
set variable=createobject("wscript.shell") variable.run "svchost.exe /e:VBScript.Encode ""C:\security\blood.dat",false
```

**Malicious msg service config.txt contents**

```
DisplayName=msgDescription=DescriptionServiceType=272WaitActive=0StartType=2ErrorControl=1Source=C:\security\system.vbsResetPeriod=0RebootMsg=Command=nActions=0Actions=StartAtTime=OneTime
```