Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
5F9F8AC1F7...D_.doc
windows7_x64
45F9F8AC1F7...D_.doc
windows10-2004_x64
16B97B3CD2F...et.exe
windows7_x64
16B97B3CD2F...et.exe
windows10-2004_x64
1901FA02FFD...ar.dll
windows7_x64
1901FA02FFD...ar.dll
windows10-2004_x64
1C116CD0832..._2.exe
windows7_x64
10C116CD0832..._2.exe
windows10-2004_x64
10PlugX_3C74...20.dll
windows7_x64
10PlugX_3C74...20.dll
windows10-2004_x64
10originalfi...ae.rtf
windows7_x64
4originalfi...ae.rtf
windows10-2004_x64
1Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
28/05/2022, 02:43
Static task
static1
Behavioral task
behavioral1
Sample
5F9F8AC1F749B0637ECA6EF15910BF21_~WINWORD_.doc
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
5F9F8AC1F749B0637ECA6EF15910BF21_~WINWORD_.doc
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
6B97B3CD2FCFB4B74985143230441463_Gadget.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
6B97B3CD2FCFB4B74985143230441463_Gadget.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
901FA02FFD43DE5B2D7C8C6B8C2F6A43_SideBar.dll
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
901FA02FFD43DE5B2D7C8C6B8C2F6A43_SideBar.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
C116CD083284CC599C024C3479CA9B70_2.exe
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
C116CD083284CC599C024C3479CA9B70_2.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
PlugX_3C74A85C2CF883BD9D4B9F8B9746030F_DW20.dll
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
PlugX_3C74A85C2CF883BD9D4B9F8B9746030F_DW20.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
originalfile/PlugX_RTF_dropper_42fba80f105aa53dfbf50aeba2d73cae.rtf
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
originalfile/PlugX_RTF_dropper_42fba80f105aa53dfbf50aeba2d73cae.rtf
Resource
win10v2004-20220414-en
General
-
Target
C116CD083284CC599C024C3479CA9B70_2.exe
-
Size
225KB
-
MD5
c116cd083284cc599c024c3479ca9b70
-
SHA1
bf831962162a0446454e3e32d764cc0e5daafde0
-
SHA256
90a5c1c5dc2278063478fbc8f2ac072ccf0489d7b3f81a6ed35b7d712b4b7b84
-
SHA512
d89ac7d971e46ee67f6857a71d3712205d28170320386a83d9cdbda97d270626cf2a0e91e0b866d368c65eb3e47766c20c07a2baeb51feb3fe7b8d98d848e560
Malware Config
Signatures
-
Detects PlugX Payload 6 IoCs
resource yara_rule behavioral8/memory/2224-141-0x0000000000590000-0x00000000005C0000-memory.dmp family_plugx behavioral8/memory/1548-144-0x0000000000790000-0x00000000007C0000-memory.dmp family_plugx behavioral8/memory/676-145-0x0000000001070000-0x00000000010A0000-memory.dmp family_plugx behavioral8/memory/1404-147-0x0000000002950000-0x0000000002980000-memory.dmp family_plugx behavioral8/memory/676-148-0x0000000001070000-0x00000000010A0000-memory.dmp family_plugx behavioral8/memory/1404-149-0x0000000002950000-0x0000000002980000-memory.dmp family_plugx -
Executes dropped EXE 2 IoCs
pid Process 2224 Gadget.exe 1548 Gadget.exe -
Loads dropped DLL 2 IoCs
pid Process 2224 Gadget.exe 1548 Gadget.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 39003300370037003400300046003600310031004400340033004200320035000000 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 676 svchost.exe 676 svchost.exe 676 svchost.exe 676 svchost.exe 676 svchost.exe 676 svchost.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 676 svchost.exe 676 svchost.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 676 svchost.exe 676 svchost.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 676 svchost.exe 676 svchost.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 676 svchost.exe 676 svchost.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe 1404 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 676 svchost.exe 1404 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2224 Gadget.exe Token: SeTcbPrivilege 2224 Gadget.exe Token: SeDebugPrivilege 1548 Gadget.exe Token: SeTcbPrivilege 1548 Gadget.exe Token: SeDebugPrivilege 676 svchost.exe Token: SeTcbPrivilege 676 svchost.exe Token: SeDebugPrivilege 1404 msiexec.exe Token: SeTcbPrivilege 1404 msiexec.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2224 2124 C116CD083284CC599C024C3479CA9B70_2.exe 80 PID 2124 wrote to memory of 2224 2124 C116CD083284CC599C024C3479CA9B70_2.exe 80 PID 2124 wrote to memory of 2224 2124 C116CD083284CC599C024C3479CA9B70_2.exe 80 PID 1548 wrote to memory of 676 1548 Gadget.exe 82 PID 1548 wrote to memory of 676 1548 Gadget.exe 82 PID 1548 wrote to memory of 676 1548 Gadget.exe 82 PID 1548 wrote to memory of 676 1548 Gadget.exe 82 PID 1548 wrote to memory of 676 1548 Gadget.exe 82 PID 1548 wrote to memory of 676 1548 Gadget.exe 82 PID 1548 wrote to memory of 676 1548 Gadget.exe 82 PID 1548 wrote to memory of 676 1548 Gadget.exe 82 PID 676 wrote to memory of 1404 676 svchost.exe 87 PID 676 wrote to memory of 1404 676 svchost.exe 87 PID 676 wrote to memory of 1404 676 svchost.exe 87 PID 676 wrote to memory of 1404 676 svchost.exe 87 PID 676 wrote to memory of 1404 676 svchost.exe 87 PID 676 wrote to memory of 1404 676 svchost.exe 87 PID 676 wrote to memory of 1404 676 svchost.exe 87 PID 676 wrote to memory of 1404 676 svchost.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\C116CD083284CC599C024C3479CA9B70_2.exe"C:\Users\Admin\AppData\Local\Temp\C116CD083284CC599C024C3479CA9B70_2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\Gadget.exeC:\Users\Admin\AppData\Local\Temp\\Gadget.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2224
-
-
C:\ProgramData\WS\Gadget.exeC:\ProgramData\WS\Gadget.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 201 02⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 6763⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD56b97b3cd2fcfb4b74985143230441463
SHA18985c2394ed9a58c36f907962b0724fe66c204a6
SHA2565c859ca16583d660449fb044677c128a9cdedd603d9598d4670235c52e359bf9
SHA512736631b2ca37426c3915f496d5c3abdac23ffa91bd90fd8b215be2ad8735403ff9d58d1effe6791fa34a72141a5218f19808c0c4ece4100a525adbdeea4c1715
-
Filesize
25KB
MD56b97b3cd2fcfb4b74985143230441463
SHA18985c2394ed9a58c36f907962b0724fe66c204a6
SHA2565c859ca16583d660449fb044677c128a9cdedd603d9598d4670235c52e359bf9
SHA512736631b2ca37426c3915f496d5c3abdac23ffa91bd90fd8b215be2ad8735403ff9d58d1effe6791fa34a72141a5218f19808c0c4ece4100a525adbdeea4c1715
-
Filesize
41KB
MD5901fa02ffd43de5b2d7c8c6b8c2f6a43
SHA18bb71adf1c418061510c40240852c3cd61fb214c
SHA2563144079c68ba00cebfd05239a2f5bd406096ec02e13e8571ca24313df7a5b679
SHA5126500b1a0e1a5995226bfcdaf1a33867bd9ccd5b84552db73f46dc1ee44461dbb29de6d16e8bf0da0c56d15ea60a4f44f105d005de139924ecb46d274cce90bab
-
Filesize
41KB
MD5901fa02ffd43de5b2d7c8c6b8c2f6a43
SHA18bb71adf1c418061510c40240852c3cd61fb214c
SHA2563144079c68ba00cebfd05239a2f5bd406096ec02e13e8571ca24313df7a5b679
SHA5126500b1a0e1a5995226bfcdaf1a33867bd9ccd5b84552db73f46dc1ee44461dbb29de6d16e8bf0da0c56d15ea60a4f44f105d005de139924ecb46d274cce90bab
-
Filesize
121KB
MD597c11e7d6b1926cd4be13804b36239ac
SHA1b388b86a782ae14fee2a31bc7626a816c3eabc5a
SHA256a13161d957ef1bf6362cbc488a82ffca8f6f52f48143f1110616b9c540e5997a
SHA5128ee3c39651b8d5790750436d04178e0d124c6573f1f773265349683635047a8f1adc34195f1a58001e96c57da3d3504a86026d3165a832117f10e9ebb233a121
-
Filesize
25KB
MD56b97b3cd2fcfb4b74985143230441463
SHA18985c2394ed9a58c36f907962b0724fe66c204a6
SHA2565c859ca16583d660449fb044677c128a9cdedd603d9598d4670235c52e359bf9
SHA512736631b2ca37426c3915f496d5c3abdac23ffa91bd90fd8b215be2ad8735403ff9d58d1effe6791fa34a72141a5218f19808c0c4ece4100a525adbdeea4c1715
-
Filesize
25KB
MD56b97b3cd2fcfb4b74985143230441463
SHA18985c2394ed9a58c36f907962b0724fe66c204a6
SHA2565c859ca16583d660449fb044677c128a9cdedd603d9598d4670235c52e359bf9
SHA512736631b2ca37426c3915f496d5c3abdac23ffa91bd90fd8b215be2ad8735403ff9d58d1effe6791fa34a72141a5218f19808c0c4ece4100a525adbdeea4c1715
-
Filesize
41KB
MD5901fa02ffd43de5b2d7c8c6b8c2f6a43
SHA18bb71adf1c418061510c40240852c3cd61fb214c
SHA2563144079c68ba00cebfd05239a2f5bd406096ec02e13e8571ca24313df7a5b679
SHA5126500b1a0e1a5995226bfcdaf1a33867bd9ccd5b84552db73f46dc1ee44461dbb29de6d16e8bf0da0c56d15ea60a4f44f105d005de139924ecb46d274cce90bab
-
Filesize
121KB
MD597c11e7d6b1926cd4be13804b36239ac
SHA1b388b86a782ae14fee2a31bc7626a816c3eabc5a
SHA256a13161d957ef1bf6362cbc488a82ffca8f6f52f48143f1110616b9c540e5997a
SHA5128ee3c39651b8d5790750436d04178e0d124c6573f1f773265349683635047a8f1adc34195f1a58001e96c57da3d3504a86026d3165a832117f10e9ebb233a121
-
Filesize
41KB
MD5901fa02ffd43de5b2d7c8c6b8c2f6a43
SHA18bb71adf1c418061510c40240852c3cd61fb214c
SHA2563144079c68ba00cebfd05239a2f5bd406096ec02e13e8571ca24313df7a5b679
SHA5126500b1a0e1a5995226bfcdaf1a33867bd9ccd5b84552db73f46dc1ee44461dbb29de6d16e8bf0da0c56d15ea60a4f44f105d005de139924ecb46d274cce90bab