Malware Analysis Report

2024-10-19 02:31

Sample ID 220523-z77dqacbfp
Target f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7
SHA256 f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7
Tags
plugx trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7

Threat Level: Known bad

The file f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7 was found to be: Known bad.

Malicious Activity Summary

plugx trojan

PlugX

Detects PlugX Payload

Executes dropped EXE

Loads dropped DLL

Deletes itself

Checks computer location settings

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-05-23 21:22

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-23 21:22

Reported

2022-05-23 21:39

Platform

win10v2004-20220414-en

Max time kernel

154s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7.exe"

Signatures

Detects PlugX Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

PlugX

trojan plugx

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe N/A
N/A N/A C:\ProgramData\AVck\mcinsupd.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe N/A
N/A N/A C:\ProgramData\AVck\mcinsupd.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\CLASSES\FAST C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 46004100370032003200350045003200410033004600430041003100430042000000 C:\Windows\SysWOW64\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\AVck\mcinsupd.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\AVck\mcinsupd.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1888 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
PID 1888 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
PID 1888 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
PID 4976 wrote to memory of 3292 N/A C:\ProgramData\AVck\mcinsupd.exe C:\Windows\SysWOW64\svchost.exe
PID 4976 wrote to memory of 3292 N/A C:\ProgramData\AVck\mcinsupd.exe C:\Windows\SysWOW64\svchost.exe
PID 4976 wrote to memory of 3292 N/A C:\ProgramData\AVck\mcinsupd.exe C:\Windows\SysWOW64\svchost.exe
PID 4976 wrote to memory of 3292 N/A C:\ProgramData\AVck\mcinsupd.exe C:\Windows\SysWOW64\svchost.exe
PID 4976 wrote to memory of 3292 N/A C:\ProgramData\AVck\mcinsupd.exe C:\Windows\SysWOW64\svchost.exe
PID 4976 wrote to memory of 3292 N/A C:\ProgramData\AVck\mcinsupd.exe C:\Windows\SysWOW64\svchost.exe
PID 4976 wrote to memory of 3292 N/A C:\ProgramData\AVck\mcinsupd.exe C:\Windows\SysWOW64\svchost.exe
PID 4976 wrote to memory of 3292 N/A C:\ProgramData\AVck\mcinsupd.exe C:\Windows\SysWOW64\svchost.exe
PID 3292 wrote to memory of 2836 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 3292 wrote to memory of 2836 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 3292 wrote to memory of 2836 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 3292 wrote to memory of 2836 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 3292 wrote to memory of 2836 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 3292 wrote to memory of 2836 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 3292 wrote to memory of 2836 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 3292 wrote to memory of 2836 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7.exe

"C:\Users\Admin\AppData\Local\Temp\f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe"

C:\ProgramData\AVck\mcinsupd.exe

C:\ProgramData\AVck\mcinsupd.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\system32\svchost.exe 201 0

C:\Windows\SysWOW64\msiexec.exe

C:\Windows\system32\msiexec.exe 209 3292

Network

Country Destination Domain Proto
NL 104.110.191.140:80 tcp
N/A 10.127.255.255:53 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
US 20.42.65.84:443 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
NL 104.110.191.140:80 tcp
NL 104.110.191.133:80 tcp
US 209.197.3.8:80 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp

Files

memory/3880-130-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe

MD5 53c1f090734129fbccc2693d6b4afa04
SHA1 a06110c5b8092581f7aab798eb96d1a0511cf419
SHA256 507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091
SHA512 59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe

MD5 53c1f090734129fbccc2693d6b4afa04
SHA1 a06110c5b8092581f7aab798eb96d1a0511cf419
SHA256 507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091
SHA512 59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

C:\Users\Admin\AppData\Local\Temp\RarSFX0\mytilus3.dll

MD5 5ecdc718db6bea5e2faa31eafcd7ac9f
SHA1 f2adb07161b7486d153393d8ecb5c0470de47ce7
SHA256 9b75226a5ef9a0c8686fe40c34786acf16fb78d5bc02e0122a51f93c0c395bbf
SHA512 dc836aaa09a6a745156f27d2ba43d7cc08c9a7b58b37422e34e641b6bb3001f654206ad4a188b1bfb25e4cfdd0991c5d9935ab54bb159fe1801c87abeae0b22f

C:\Users\Admin\AppData\Local\Temp\RarSFX0\mytilus3.dll

MD5 5ecdc718db6bea5e2faa31eafcd7ac9f
SHA1 f2adb07161b7486d153393d8ecb5c0470de47ce7
SHA256 9b75226a5ef9a0c8686fe40c34786acf16fb78d5bc02e0122a51f93c0c395bbf
SHA512 dc836aaa09a6a745156f27d2ba43d7cc08c9a7b58b37422e34e641b6bb3001f654206ad4a188b1bfb25e4cfdd0991c5d9935ab54bb159fe1801c87abeae0b22f

C:\Users\Admin\AppData\Local\Temp\RarSFX0\mytilus3.dll.obj

MD5 d2b2513b6f223f33691367bfa9e2d09f
SHA1 1f1133ff1edc07347821c3dcc01e67db5d8faad9
SHA256 b6223ac144171d59234061ca54cb5e2fead4b0774df1b111996ea32ee337df7c
SHA512 9d765429b429da80b795998e0301307142cb9654524fa5bdc60f1f3495055902f400fb506601cfe62fd2381af0d73cd6f670bacea94fd63e6183a67c6282e50b

C:\ProgramData\AVck\mcinsupd.exe

MD5 53c1f090734129fbccc2693d6b4afa04
SHA1 a06110c5b8092581f7aab798eb96d1a0511cf419
SHA256 507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091
SHA512 59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

C:\ProgramData\AVck\mcinsupd.exe

MD5 53c1f090734129fbccc2693d6b4afa04
SHA1 a06110c5b8092581f7aab798eb96d1a0511cf419
SHA256 507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091
SHA512 59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

C:\ProgramData\AVck\mytilus3.dll

MD5 5ecdc718db6bea5e2faa31eafcd7ac9f
SHA1 f2adb07161b7486d153393d8ecb5c0470de47ce7
SHA256 9b75226a5ef9a0c8686fe40c34786acf16fb78d5bc02e0122a51f93c0c395bbf
SHA512 dc836aaa09a6a745156f27d2ba43d7cc08c9a7b58b37422e34e641b6bb3001f654206ad4a188b1bfb25e4cfdd0991c5d9935ab54bb159fe1801c87abeae0b22f

C:\ProgramData\AVck\mytilus3.dll

MD5 5ecdc718db6bea5e2faa31eafcd7ac9f
SHA1 f2adb07161b7486d153393d8ecb5c0470de47ce7
SHA256 9b75226a5ef9a0c8686fe40c34786acf16fb78d5bc02e0122a51f93c0c395bbf
SHA512 dc836aaa09a6a745156f27d2ba43d7cc08c9a7b58b37422e34e641b6bb3001f654206ad4a188b1bfb25e4cfdd0991c5d9935ab54bb159fe1801c87abeae0b22f

C:\ProgramData\AVck\mytilus3.dll.obj

MD5 d2b2513b6f223f33691367bfa9e2d09f
SHA1 1f1133ff1edc07347821c3dcc01e67db5d8faad9
SHA256 b6223ac144171d59234061ca54cb5e2fead4b0774df1b111996ea32ee337df7c
SHA512 9d765429b429da80b795998e0301307142cb9654524fa5bdc60f1f3495055902f400fb506601cfe62fd2381af0d73cd6f670bacea94fd63e6183a67c6282e50b

memory/3292-141-0x0000000000000000-mapping.dmp

memory/4976-142-0x0000000000E50000-0x0000000000F50000-memory.dmp

memory/4976-143-0x0000000000DC0000-0x0000000000DF1000-memory.dmp

C:\ProgramData\SxS\bug.log

MD5 e11a035e7de16016474a051532eddb88
SHA1 2458fd520ff9e01c0097f339bf046da89f768153
SHA256 dbc697e5300759744d333194beab538a54997126aae30a8ceb7977b6fdaf7f82
SHA512 6b1c779e77c0fcd925d38df9346e7459e0378218b9ec98b1d77fd5e2c27d8e8cddc927bd95db78bcd0876469d2d53f896f0173f712b2925c104bc52d79879ac2

C:\ProgramData\SxS\bug.log

MD5 dd61d3281788ccbc04f4f0bd5bb01812
SHA1 92c248a4628cf87c1dea94ca2ffcdd9e012fd636
SHA256 be984811af4fbcbc792debac85407559ba0e2f730a48e10351b0802f9feca4cd
SHA512 57df04e006ce0eec1587083cadd18b7035c5b2854c4cf994c783912be02d1a4eb345b35eda9a0f27cb8355ef9a31e0d0e23df855454b632d727ee2d0fd8f5253

memory/3880-146-0x0000000002210000-0x0000000002241000-memory.dmp

memory/3292-147-0x0000000000570000-0x00000000005A1000-memory.dmp

memory/2836-148-0x0000000000000000-mapping.dmp

memory/2836-149-0x00000000008E0000-0x0000000000911000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-23 21:22

Reported

2022-05-23 21:40

Platform

win7-20220414-en

Max time kernel

151s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7.exe"

Signatures

Detects PlugX Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

PlugX

trojan plugx

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe N/A
N/A N/A C:\ProgramData\AVck\mcinsupd.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\CLASSES\FAST C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 45004300360033003800440033004500320037003700310046004400340030000000 C:\Windows\SysWOW64\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\AVck\mcinsupd.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\AVck\mcinsupd.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1480 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
PID 1480 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
PID 1480 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
PID 1480 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
PID 1480 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
PID 1480 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
PID 1480 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
PID 2024 wrote to memory of 2012 N/A C:\ProgramData\AVck\mcinsupd.exe C:\Windows\SysWOW64\svchost.exe
PID 2024 wrote to memory of 2012 N/A C:\ProgramData\AVck\mcinsupd.exe C:\Windows\SysWOW64\svchost.exe
PID 2024 wrote to memory of 2012 N/A C:\ProgramData\AVck\mcinsupd.exe C:\Windows\SysWOW64\svchost.exe
PID 2024 wrote to memory of 2012 N/A C:\ProgramData\AVck\mcinsupd.exe C:\Windows\SysWOW64\svchost.exe
PID 2024 wrote to memory of 2012 N/A C:\ProgramData\AVck\mcinsupd.exe C:\Windows\SysWOW64\svchost.exe
PID 2024 wrote to memory of 2012 N/A C:\ProgramData\AVck\mcinsupd.exe C:\Windows\SysWOW64\svchost.exe
PID 2024 wrote to memory of 2012 N/A C:\ProgramData\AVck\mcinsupd.exe C:\Windows\SysWOW64\svchost.exe
PID 2024 wrote to memory of 2012 N/A C:\ProgramData\AVck\mcinsupd.exe C:\Windows\SysWOW64\svchost.exe
PID 2024 wrote to memory of 2012 N/A C:\ProgramData\AVck\mcinsupd.exe C:\Windows\SysWOW64\svchost.exe
PID 2012 wrote to memory of 1060 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2012 wrote to memory of 1060 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2012 wrote to memory of 1060 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2012 wrote to memory of 1060 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2012 wrote to memory of 1060 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2012 wrote to memory of 1060 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2012 wrote to memory of 1060 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2012 wrote to memory of 1060 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2012 wrote to memory of 1060 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2012 wrote to memory of 1060 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2012 wrote to memory of 1060 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2012 wrote to memory of 1060 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7.exe

"C:\Users\Admin\AppData\Local\Temp\f54b6b92b5264dc3346c777fcfa1d8d77b5712f4afb6724bb9187c5e570af1d7.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe"

C:\ProgramData\AVck\mcinsupd.exe

C:\ProgramData\AVck\mcinsupd.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\system32\svchost.exe 201 0

C:\Windows\SysWOW64\msiexec.exe

C:\Windows\system32\msiexec.exe 209 2012

Network

Country Destination Domain Proto
N/A 10.127.255.255:53 udp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp
N/A 127.0.0.1:12345 tcp

Files

memory/1480-54-0x0000000075871000-0x0000000075873000-memory.dmp

\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe

MD5 53c1f090734129fbccc2693d6b4afa04
SHA1 a06110c5b8092581f7aab798eb96d1a0511cf419
SHA256 507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091
SHA512 59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe

MD5 53c1f090734129fbccc2693d6b4afa04
SHA1 a06110c5b8092581f7aab798eb96d1a0511cf419
SHA256 507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091
SHA512 59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe

MD5 53c1f090734129fbccc2693d6b4afa04
SHA1 a06110c5b8092581f7aab798eb96d1a0511cf419
SHA256 507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091
SHA512 59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe

MD5 53c1f090734129fbccc2693d6b4afa04
SHA1 a06110c5b8092581f7aab798eb96d1a0511cf419
SHA256 507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091
SHA512 59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

memory/1656-59-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe

MD5 53c1f090734129fbccc2693d6b4afa04
SHA1 a06110c5b8092581f7aab798eb96d1a0511cf419
SHA256 507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091
SHA512 59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

\Users\Admin\AppData\Local\Temp\RarSFX0\mytilus3.dll

MD5 5ecdc718db6bea5e2faa31eafcd7ac9f
SHA1 f2adb07161b7486d153393d8ecb5c0470de47ce7
SHA256 9b75226a5ef9a0c8686fe40c34786acf16fb78d5bc02e0122a51f93c0c395bbf
SHA512 dc836aaa09a6a745156f27d2ba43d7cc08c9a7b58b37422e34e641b6bb3001f654206ad4a188b1bfb25e4cfdd0991c5d9935ab54bb159fe1801c87abeae0b22f

C:\Users\Admin\AppData\Local\Temp\RarSFX0\mytilus3.dll.obj

MD5 d2b2513b6f223f33691367bfa9e2d09f
SHA1 1f1133ff1edc07347821c3dcc01e67db5d8faad9
SHA256 b6223ac144171d59234061ca54cb5e2fead4b0774df1b111996ea32ee337df7c
SHA512 9d765429b429da80b795998e0301307142cb9654524fa5bdc60f1f3495055902f400fb506601cfe62fd2381af0d73cd6f670bacea94fd63e6183a67c6282e50b

C:\Users\Admin\AppData\Local\Temp\RarSFX0\mytilus3.dll

MD5 5ecdc718db6bea5e2faa31eafcd7ac9f
SHA1 f2adb07161b7486d153393d8ecb5c0470de47ce7
SHA256 9b75226a5ef9a0c8686fe40c34786acf16fb78d5bc02e0122a51f93c0c395bbf
SHA512 dc836aaa09a6a745156f27d2ba43d7cc08c9a7b58b37422e34e641b6bb3001f654206ad4a188b1bfb25e4cfdd0991c5d9935ab54bb159fe1801c87abeae0b22f

C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe

MD5 53c1f090734129fbccc2693d6b4afa04
SHA1 a06110c5b8092581f7aab798eb96d1a0511cf419
SHA256 507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091
SHA512 59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

C:\ProgramData\AVck\mcinsupd.exe

MD5 53c1f090734129fbccc2693d6b4afa04
SHA1 a06110c5b8092581f7aab798eb96d1a0511cf419
SHA256 507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091
SHA512 59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

C:\ProgramData\AVck\mytilus3.dll

MD5 5ecdc718db6bea5e2faa31eafcd7ac9f
SHA1 f2adb07161b7486d153393d8ecb5c0470de47ce7
SHA256 9b75226a5ef9a0c8686fe40c34786acf16fb78d5bc02e0122a51f93c0c395bbf
SHA512 dc836aaa09a6a745156f27d2ba43d7cc08c9a7b58b37422e34e641b6bb3001f654206ad4a188b1bfb25e4cfdd0991c5d9935ab54bb159fe1801c87abeae0b22f

\ProgramData\AVck\mytilus3.dll

MD5 5ecdc718db6bea5e2faa31eafcd7ac9f
SHA1 f2adb07161b7486d153393d8ecb5c0470de47ce7
SHA256 9b75226a5ef9a0c8686fe40c34786acf16fb78d5bc02e0122a51f93c0c395bbf
SHA512 dc836aaa09a6a745156f27d2ba43d7cc08c9a7b58b37422e34e641b6bb3001f654206ad4a188b1bfb25e4cfdd0991c5d9935ab54bb159fe1801c87abeae0b22f

C:\ProgramData\AVck\mytilus3.dll.obj

MD5 d2b2513b6f223f33691367bfa9e2d09f
SHA1 1f1133ff1edc07347821c3dcc01e67db5d8faad9
SHA256 b6223ac144171d59234061ca54cb5e2fead4b0774df1b111996ea32ee337df7c
SHA512 9d765429b429da80b795998e0301307142cb9654524fa5bdc60f1f3495055902f400fb506601cfe62fd2381af0d73cd6f670bacea94fd63e6183a67c6282e50b

memory/2012-71-0x00000000000E0000-0x00000000000FD000-memory.dmp

memory/2012-73-0x0000000000000000-mapping.dmp

memory/2024-75-0x0000000000440000-0x0000000000540000-memory.dmp

memory/2024-76-0x0000000000390000-0x00000000003C1000-memory.dmp

C:\ProgramData\SxS\bug.log

MD5 c512960e78727103e247735fe32770a4
SHA1 a635bbab813ca40eb787aff5453a4e6f0f5f5ce5
SHA256 f1b487c246915170734a142ed78c54af18b083aa0d1b3acfa74d45d140ce9be5
SHA512 22067e94c0882ce3024e56dee283f7eed1cca0c841b61cfbf7e07e60a30fb82e42278f0c0c944316246a981818b289a3b94d1f7c7b724576429766200e4b1dbe

memory/1656-78-0x00000000008E0000-0x0000000000980000-memory.dmp

memory/1656-79-0x0000000000840000-0x0000000000871000-memory.dmp

memory/2012-80-0x0000000000200000-0x0000000000231000-memory.dmp

C:\ProgramData\SxS\bug.log

MD5 8b56f9e427edec303039ed01ad2b352f
SHA1 4245967ffa8ae50a04dc274cabc90e7441e23bc8
SHA256 5ef9c5476118c7d8f7e94954dc33248388e02c788380e750258cb77cb20ed24c
SHA512 d132390418d8e6e40b6b3e6317b589d5f0eb211fd6191ac1c35a336d424af0bc5f5cd7f73d440a9ac58f195d462e7fb02ae0a140859e1001c08ff08834ad240a

memory/1060-84-0x0000000000000000-mapping.dmp

memory/1060-86-0x0000000000350000-0x0000000000381000-memory.dmp