plugx | 8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d

Analysis

max time kernel
76s
max time network
163s
platform
windows7_x64
resource
win7-20220414-en
submitted
24-05-2022 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe
Size

340KB
MD5

b2dc23e3ac76194e9ad5aee22b35267f
SHA1

98ab0d3125556c7fd2cc5e1ac95f8e53e1598c2e
SHA256

8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d
SHA512

f4bf84930d6d5ae1da8624be63d3d6cea2b94eda3a09dfc978a3e0556d7e077052bc03ea1195a50f6037a5c36567a8656d519f7f1d6e36482487caf5854cc86d

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects PlugX Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1972-77-0x0000000000880000-0x00000000008D1000-memory.dmp	family_plugx
behavioral1/memory/1712-78-0x0000000000830000-0x0000000000881000-memory.dmp	family_plugx
behavioral1/memory/680-84-0x0000000000390000-0x00000000003E1000-memory.dmp	family_plugx
behavioral1/memory/1724-89-0x00000000003B0000-0x0000000000401000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Executes dropped EXE 3 IoCs

Processes:

NvSmartMaxAPP.exeNvSmartMaxAPP.execheck_run_environment.exe

pid process

1972 NvSmartMaxAPP.exe
1712 NvSmartMaxAPP.exe
1984 check_run_environment.exe
Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

680 svchost.exe

pid	process
1972	NvSmartMaxAPP.exe
1712	NvSmartMaxAPP.exe
1984	check_run_environment.exe

pid	process
680	svchost.exe

Loads dropped DLL 9 IoCs

Processes:

8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exeNvSmartMaxAPP.exeNvSmartMaxAPP.exe

pid	process
800	8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe
800	8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe
800	8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe
800	8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe
800	8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe
1972	NvSmartMaxAPP.exe
1712	NvSmartMaxAPP.exe
1712	NvSmartMaxAPP.exe
1712	NvSmartMaxAPP.exe

Drops file in System32 directory 1 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1816 taskkill.exe

pid	process
1816	taskkill.exe

Modifies data under HKEY_USERS 55 IoCs

Processes:

svchost.exeNvSmartMaxAPP.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\9e-af-d0-55-28-1b	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	NvSmartMaxAPP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	NvSmartMaxAPP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDecisionTime = b065910b186fd801	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDetectedUrl	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadDecisionTime = 703c8706186fd801	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDecisionTime = 703c8706186fd801	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadNetworkName = "Network 2"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDecisionTime = f0ea87f5176fd801	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDecisionTime = 50e58a10186fd801	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	NvSmartMaxAPP.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadDecisionTime = f0ea87f5176fd801	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDecisionTime = 10fa8801186fd801	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadDecisionTime = 70849816186fd801	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadDecisionTime = 10fa8801186fd801	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadDecisionTime = b065910b186fd801	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadDecisionTime = 50e58a10186fd801	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDecisionTime = 909383fc176fd801	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000007000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadDecision = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadDecisionTime = 909383fc176fd801	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000008000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000009000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDecisionTime = 70849816186fd801	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-af-d0-55-28-1b\WpadDecision = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000006000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{606A73CD-7A82-4566-B9B4-D92522628883}\WpadDecisionReason = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe

Modifies registry class 2 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 30003000360032003100330044004300430041003700450037003400440046000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

check_run_environment.exesvchost.exemsiexec.exe

pid	process
1984	check_run_environment.exe
1984	check_run_environment.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
680	svchost.exe
680	svchost.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
680	svchost.exe
680	svchost.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
680	svchost.exe
680	svchost.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
680	svchost.exe
680	svchost.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
680	svchost.exe
680	svchost.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
680	svchost.exe
680	svchost.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe
1724	msiexec.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

NvSmartMaxAPP.exeNvSmartMaxAPP.execheck_run_environment.exesvchost.exetaskkill.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1972	NvSmartMaxAPP.exe
Token: SeTcbPrivilege	1972	NvSmartMaxAPP.exe
Token: SeDebugPrivilege	1712	NvSmartMaxAPP.exe
Token: SeTcbPrivilege	1712	NvSmartMaxAPP.exe
Token: SeTcbPrivilege	1984	check_run_environment.exe
Token: SeDebugPrivilege	1984	check_run_environment.exe
Token: SeDebugPrivilege	680	svchost.exe
Token: SeTcbPrivilege	680	svchost.exe
Token: SeDebugPrivilege	1816	taskkill.exe
Token: SeDebugPrivilege	1724	msiexec.exe
Token: SeTcbPrivilege	1724	msiexec.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exeNvSmartMaxAPP.execheck_run_environment.exesvchost.exe

description	pid	process	target process
PID 800 wrote to memory of 1972	800	8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe	NvSmartMaxAPP.exe
PID 800 wrote to memory of 1972	800	8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe	NvSmartMaxAPP.exe
PID 800 wrote to memory of 1972	800	8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe	NvSmartMaxAPP.exe
PID 800 wrote to memory of 1972	800	8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe	NvSmartMaxAPP.exe
PID 800 wrote to memory of 1972	800	8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe	NvSmartMaxAPP.exe
PID 800 wrote to memory of 1972	800	8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe	NvSmartMaxAPP.exe
PID 800 wrote to memory of 1972	800	8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe	NvSmartMaxAPP.exe
PID 1712 wrote to memory of 1984	1712	NvSmartMaxAPP.exe	check_run_environment.exe
PID 1712 wrote to memory of 1984	1712	NvSmartMaxAPP.exe	check_run_environment.exe
PID 1712 wrote to memory of 1984	1712	NvSmartMaxAPP.exe	check_run_environment.exe
PID 1712 wrote to memory of 1984	1712	NvSmartMaxAPP.exe	check_run_environment.exe
PID 1984 wrote to memory of 464	1984	check_run_environment.exe	services.exe
PID 1712 wrote to memory of 1816	1712	NvSmartMaxAPP.exe	taskkill.exe
PID 1712 wrote to memory of 1816	1712	NvSmartMaxAPP.exe	taskkill.exe
PID 1712 wrote to memory of 1816	1712	NvSmartMaxAPP.exe	taskkill.exe
PID 1712 wrote to memory of 1816	1712	NvSmartMaxAPP.exe	taskkill.exe
PID 1712 wrote to memory of 680	1712	NvSmartMaxAPP.exe	svchost.exe
PID 1712 wrote to memory of 680	1712	NvSmartMaxAPP.exe	svchost.exe
PID 1712 wrote to memory of 680	1712	NvSmartMaxAPP.exe	svchost.exe
PID 1712 wrote to memory of 680	1712	NvSmartMaxAPP.exe	svchost.exe
PID 1712 wrote to memory of 680	1712	NvSmartMaxAPP.exe	svchost.exe
PID 1712 wrote to memory of 680	1712	NvSmartMaxAPP.exe	svchost.exe
PID 1712 wrote to memory of 680	1712	NvSmartMaxAPP.exe	svchost.exe
PID 1712 wrote to memory of 680	1712	NvSmartMaxAPP.exe	svchost.exe
PID 1712 wrote to memory of 680	1712	NvSmartMaxAPP.exe	svchost.exe
PID 680 wrote to memory of 1724	680	svchost.exe	msiexec.exe
PID 680 wrote to memory of 1724	680	svchost.exe	msiexec.exe
PID 680 wrote to memory of 1724	680	svchost.exe	msiexec.exe
PID 680 wrote to memory of 1724	680	svchost.exe	msiexec.exe
PID 680 wrote to memory of 1724	680	svchost.exe	msiexec.exe
PID 680 wrote to memory of 1724	680	svchost.exe	msiexec.exe
PID 680 wrote to memory of 1724	680	svchost.exe	msiexec.exe
PID 680 wrote to memory of 1724	680	svchost.exe	msiexec.exe
PID 680 wrote to memory of 1724	680	svchost.exe	msiexec.exe
PID 680 wrote to memory of 1724	680	svchost.exe	msiexec.exe
PID 680 wrote to memory of 1724	680	svchost.exe	msiexec.exe
PID 680 wrote to memory of 1724	680	svchost.exe	msiexec.exe

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464

C:\ProgramData\Intel\Intel(R) Management Engine Components\NvSmartMaxAPP.exe
"C:\ProgramData\Intel\Intel(R) Management Engine Components\NvSmartMaxAPP.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\TEMP\check_run_environment.exe
"C:\Windows\TEMP\check_run_environment.exe" "jhi_service"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe 201 0
3⤵
- Deletes itself
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\SysWOW64\msiexec.exe
C:\Windows\system32\msiexec.exe 209 680
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im check_run_environment.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Users\Admin\AppData\Local\Temp\8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe
"C:\Users\Admin\AppData\Local\Temp\8ac0df62c7312e542490a309a0c2479c1fb24f5ebc2ed9cf907e7e782602490d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:800

C:\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmartMaxAPP.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmartMaxAPP.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Intel\Intel(R) Management Engine Components\NvSmartMax.dll
Filesize
4KB

MD5
c62c4b09c8543821e0ff2213c633f5e5

SHA1
ff59b219fa140c48536d79a9a73027d4acf40bc9

SHA256
5afa8e6c54f264eb87c75e3c2a5b9b192fca608cb4b0ebeaf5c92a384c1e135c

SHA512
8e7ec29bbc3ed496821fa1ff4e95360b2ec33e093a74ed9021329d0f018cd07153e44a644b45674e808d04ad8b71bc4d75ff9cb34f9231f07fd0dadd0cb86c4e

Download Submit
C:\ProgramData\Intel\Intel(R) Management Engine Components\NvSmartMaxAPP.Config
Filesize
212KB

MD5
cdbf515d885c303ff2b2c6cf182fa19b

SHA1
9bc67dd9f4718f0dd3a995b5a41eac788f8ae76b

SHA256
3203294c334b0cc5db4e2bf09fdab1dc9bbcb6f536cef4db5c9ae275c0ac569c

SHA512
d8a4c196ff9cf708fe394519b27d4ed1b156b03ab43d1aae11b5ec49c557e9b6332194f74671010ab778beea39db3fcd78b8a98e9e4ed2fcc5360226d1e9f359

Download Submit
C:\ProgramData\Intel\Intel(R) Management Engine Components\NvSmartMaxAPP.exe
Filesize
60KB

MD5
4e3cae0eda4c873b0afdb803ea981a0d

SHA1
06ddb2a4a1c4d119efeed10147666afa0c4eda25

SHA256
11a57102b1a3cee266b9ea7390c5fd8dc218f1842c6c8c428a60b8fa2a26ed4e

SHA512
c8fba7cf63b8f127ebe622d58f3c66d4a35fb391ff32beb8c11a59bf71cae4f26af4b9426617aacc4ab502e741cffdb930f50a2c03860f24240da96fb3c10431

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmartMax.dll
Filesize
4KB

MD5
c62c4b09c8543821e0ff2213c633f5e5

SHA1
ff59b219fa140c48536d79a9a73027d4acf40bc9

SHA256
5afa8e6c54f264eb87c75e3c2a5b9b192fca608cb4b0ebeaf5c92a384c1e135c

SHA512
8e7ec29bbc3ed496821fa1ff4e95360b2ec33e093a74ed9021329d0f018cd07153e44a644b45674e808d04ad8b71bc4d75ff9cb34f9231f07fd0dadd0cb86c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmartMaxAPP.Config
Filesize
212KB

MD5
cdbf515d885c303ff2b2c6cf182fa19b

SHA1
9bc67dd9f4718f0dd3a995b5a41eac788f8ae76b

SHA256
3203294c334b0cc5db4e2bf09fdab1dc9bbcb6f536cef4db5c9ae275c0ac569c

SHA512
d8a4c196ff9cf708fe394519b27d4ed1b156b03ab43d1aae11b5ec49c557e9b6332194f74671010ab778beea39db3fcd78b8a98e9e4ed2fcc5360226d1e9f359

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmartMaxAPP.exe
Filesize
60KB

MD5
4e3cae0eda4c873b0afdb803ea981a0d

SHA1
06ddb2a4a1c4d119efeed10147666afa0c4eda25

SHA256
11a57102b1a3cee266b9ea7390c5fd8dc218f1842c6c8c428a60b8fa2a26ed4e

SHA512
c8fba7cf63b8f127ebe622d58f3c66d4a35fb391ff32beb8c11a59bf71cae4f26af4b9426617aacc4ab502e741cffdb930f50a2c03860f24240da96fb3c10431

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmartMaxAPP.exe
Filesize
60KB

MD5
4e3cae0eda4c873b0afdb803ea981a0d

SHA1
06ddb2a4a1c4d119efeed10147666afa0c4eda25

SHA256
11a57102b1a3cee266b9ea7390c5fd8dc218f1842c6c8c428a60b8fa2a26ed4e

SHA512
c8fba7cf63b8f127ebe622d58f3c66d4a35fb391ff32beb8c11a59bf71cae4f26af4b9426617aacc4ab502e741cffdb930f50a2c03860f24240da96fb3c10431

Download Submit
C:\Windows\Temp\check_run_environment.exe
Filesize
11KB

MD5
6622918d92a44e67175f7aeb3fcb5a05

SHA1
0b226563fa229783bea7aa27e28f908967c729e6

SHA256
b0e1832ff379dfbfeac0aa26ba49188019d2aa7a5ead67256ef7f10ed8a6c62c

SHA512
65ff16d6d4eb4308f5950dec33b7598c10da54e4ae124107f19159675cc2cc445da8b70a5cb5f509b7c988358f1973b77b3be361d712a3cd44bda6e3697008fe

Download Submit
\ProgramData\Intel\Intel(R) Management Engine Components\NvSmartMax.dll
Filesize
4KB

MD5
c62c4b09c8543821e0ff2213c633f5e5

SHA1
ff59b219fa140c48536d79a9a73027d4acf40bc9

SHA256
5afa8e6c54f264eb87c75e3c2a5b9b192fca608cb4b0ebeaf5c92a384c1e135c

SHA512
8e7ec29bbc3ed496821fa1ff4e95360b2ec33e093a74ed9021329d0f018cd07153e44a644b45674e808d04ad8b71bc4d75ff9cb34f9231f07fd0dadd0cb86c4e

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmartMax.dll
Filesize
4KB

MD5
c62c4b09c8543821e0ff2213c633f5e5

SHA1
ff59b219fa140c48536d79a9a73027d4acf40bc9

SHA256
5afa8e6c54f264eb87c75e3c2a5b9b192fca608cb4b0ebeaf5c92a384c1e135c

SHA512
8e7ec29bbc3ed496821fa1ff4e95360b2ec33e093a74ed9021329d0f018cd07153e44a644b45674e808d04ad8b71bc4d75ff9cb34f9231f07fd0dadd0cb86c4e

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmartMaxAPP.exe
Filesize
60KB

MD5
4e3cae0eda4c873b0afdb803ea981a0d

SHA1
06ddb2a4a1c4d119efeed10147666afa0c4eda25

SHA256
11a57102b1a3cee266b9ea7390c5fd8dc218f1842c6c8c428a60b8fa2a26ed4e

SHA512
c8fba7cf63b8f127ebe622d58f3c66d4a35fb391ff32beb8c11a59bf71cae4f26af4b9426617aacc4ab502e741cffdb930f50a2c03860f24240da96fb3c10431

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmartMaxAPP.exe
Filesize
60KB

MD5
4e3cae0eda4c873b0afdb803ea981a0d

SHA1
06ddb2a4a1c4d119efeed10147666afa0c4eda25

SHA256
11a57102b1a3cee266b9ea7390c5fd8dc218f1842c6c8c428a60b8fa2a26ed4e

SHA512
c8fba7cf63b8f127ebe622d58f3c66d4a35fb391ff32beb8c11a59bf71cae4f26af4b9426617aacc4ab502e741cffdb930f50a2c03860f24240da96fb3c10431

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmartMaxAPP.exe
Filesize
60KB

MD5
4e3cae0eda4c873b0afdb803ea981a0d

SHA1
06ddb2a4a1c4d119efeed10147666afa0c4eda25

SHA256
11a57102b1a3cee266b9ea7390c5fd8dc218f1842c6c8c428a60b8fa2a26ed4e

SHA512
c8fba7cf63b8f127ebe622d58f3c66d4a35fb391ff32beb8c11a59bf71cae4f26af4b9426617aacc4ab502e741cffdb930f50a2c03860f24240da96fb3c10431

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmartMaxAPP.exe
Filesize
60KB

MD5
4e3cae0eda4c873b0afdb803ea981a0d

SHA1
06ddb2a4a1c4d119efeed10147666afa0c4eda25

SHA256
11a57102b1a3cee266b9ea7390c5fd8dc218f1842c6c8c428a60b8fa2a26ed4e

SHA512
c8fba7cf63b8f127ebe622d58f3c66d4a35fb391ff32beb8c11a59bf71cae4f26af4b9426617aacc4ab502e741cffdb930f50a2c03860f24240da96fb3c10431

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmartMaxAPP.exe
Filesize
60KB

MD5
4e3cae0eda4c873b0afdb803ea981a0d

SHA1
06ddb2a4a1c4d119efeed10147666afa0c4eda25

SHA256
11a57102b1a3cee266b9ea7390c5fd8dc218f1842c6c8c428a60b8fa2a26ed4e

SHA512
c8fba7cf63b8f127ebe622d58f3c66d4a35fb391ff32beb8c11a59bf71cae4f26af4b9426617aacc4ab502e741cffdb930f50a2c03860f24240da96fb3c10431

Download Submit
\Windows\Temp\check_run_environment.exe
Filesize
11KB

MD5
6622918d92a44e67175f7aeb3fcb5a05

SHA1
0b226563fa229783bea7aa27e28f908967c729e6

SHA256
b0e1832ff379dfbfeac0aa26ba49188019d2aa7a5ead67256ef7f10ed8a6c62c

SHA512
65ff16d6d4eb4308f5950dec33b7598c10da54e4ae124107f19159675cc2cc445da8b70a5cb5f509b7c988358f1973b77b3be361d712a3cd44bda6e3697008fe

Download Submit
\Windows\Temp\check_run_environment.exe
Filesize
11KB

MD5
6622918d92a44e67175f7aeb3fcb5a05

SHA1
0b226563fa229783bea7aa27e28f908967c729e6

SHA256
b0e1832ff379dfbfeac0aa26ba49188019d2aa7a5ead67256ef7f10ed8a6c62c

SHA512
65ff16d6d4eb4308f5950dec33b7598c10da54e4ae124107f19159675cc2cc445da8b70a5cb5f509b7c988358f1973b77b3be361d712a3cd44bda6e3697008fe

Download Submit
memory/680-82-0x0000000000000000-mapping.dmp

Download
memory/680-80-0x00000000000A0000-0x00000000000D2000-memory.dmp

Filesize
200KB

Download
memory/680-84-0x0000000000390000-0x00000000003E1000-memory.dmp

Filesize
324KB

Download
memory/800-54-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download
memory/1712-78-0x0000000000830000-0x0000000000881000-memory.dmp

Filesize
324KB

Download
memory/1724-87-0x0000000000000000-mapping.dmp

Download
memory/1724-89-0x00000000003B0000-0x0000000000401000-memory.dmp

Filesize
324KB

Download
memory/1816-79-0x0000000000000000-mapping.dmp

Download
memory/1972-77-0x0000000000880000-0x00000000008D1000-memory.dmp

Filesize
324KB

Download
memory/1972-76-0x0000000000280000-0x00000000002B6000-memory.dmp

Filesize
216KB

Download
memory/1972-60-0x0000000000000000-mapping.dmp

Download
memory/1984-74-0x0000000000000000-mapping.dmp

Download