plugx | 099f63ed88e191e9222b5cc93f4b43b07414ad82662d3de8184a5707e91e40c8

Analysis

max time kernel
135s
max time network
131s
platform
windows7_x64
resource
win7-20220414-en
submitted
30-05-2022 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

msvvcs/msvvcs.exe
Size

36KB
MD5

5ad9c956883633298c8e435d90d8394c
SHA1

d666343073acf7b97884bff37b2a902a78901b07
SHA256

b364c54bb671c0979964e13bf429ba4b128f0d3534d0b9c8de4958f2f37b93d4
SHA512

9def3c08808addcc232aabe6594297ddf25953e3002c44170387fcda942c26e83de87bda509d85dd4bdf6fc741172c0d27789a55efa5c41d171ab9205ba70882

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects Talisman variant of PlugX 2 IoCs

resource	yara_rule
behavioral1/memory/276-54-0x0000000010000000-0x0000000010038000-memory.dmp	family_plugx_talisman
behavioral1/memory/276-59-0x0000000000220000-0x0000000000254000-memory.dmp	family_plugx_talisman

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx

Executes dropped EXE 1 IoCs

pid	Process
1352	msvvcs.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	msvvcs.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1608	schtasks.exe

Modifies data under HKEY_USERS 35 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform	msvvcs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	msvvcs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-1c-d9-a0-cd-b8\WpadDecision = "0"	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msvvcs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0EC86CC3-F026-455A-8695-46AD69EE8224}\WpadDecisionTime = 706b52fa6574d801	msvvcs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-1c-d9-a0-cd-b8\WpadDecisionReason = "1"	msvvcs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-1c-d9-a0-cd-b8\WpadDecisionTime = 706b52fa6574d801	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0EC86CC3-F026-455A-8695-46AD69EE8224}	msvvcs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00a7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msvvcs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	msvvcs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0EC86CC3-F026-455A-8695-46AD69EE8224}\WpadNetworkName = "Network 2"	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0EC86CC3-F026-455A-8695-46AD69EE8224}\f2-1c-d9-a0-cd-b8	msvvcs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent	msvvcs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msvvcs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	msvvcs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0EC86CC3-F026-455A-8695-46AD69EE8224}\WpadDecision = "0"	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	msvvcs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	msvvcs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-1c-d9-a0-cd-b8	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent	msvvcs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	msvvcs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0EC86CC3-F026-455A-8695-46AD69EE8224}\WpadDecisionReason = "1"	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	msvvcs.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\MPLS\CLSID = 42004600440038003800430041003100420039003100450046004400460032000000	msvvcs.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\MPLS	msvvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1352	msvvcs.exe
1352	msvvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	276	msvvcs.exe
Token: SeTcbPrivilege	276	msvvcs.exe
Token: SeDebugPrivilege	1352	msvvcs.exe
Token: SeTcbPrivilege	1352	msvvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 276 wrote to memory of 1508	276	msvvcs.exe	28
PID 276 wrote to memory of 1508	276	msvvcs.exe	28
PID 276 wrote to memory of 1508	276	msvvcs.exe	28
PID 276 wrote to memory of 1508	276	msvvcs.exe	28
PID 1508 wrote to memory of 1608	1508	cmd.exe	30
PID 1508 wrote to memory of 1608	1508	cmd.exe	30
PID 1508 wrote to memory of 1608	1508	cmd.exe	30
PID 1508 wrote to memory of 1608	1508	cmd.exe	30
PID 1804 wrote to memory of 1352	1804	taskeng.exe	32
PID 1804 wrote to memory of 1352	1804	taskeng.exe	32
PID 1804 wrote to memory of 1352	1804	taskeng.exe	32
PID 1804 wrote to memory of 1352	1804	taskeng.exe	32

C:\Users\Admin\AppData\Local\Temp\msvvcs\msvvcs.exe
"C:\Users\Admin\AppData\Local\Temp\msvvcs\msvvcs.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c schtasks /create /sc minute /mo 2 /tn "msvvcs" /tr "\"C:\ProgramData\msvvcs\msvvcs.exe\"" /ru "system"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 2 /tn "msvvcs" /tr "\"C:\ProgramData\msvvcs\msvvcs.exe\"" /ru "system"
    3⤵
    - Creates scheduled task(s)
    PID:1608

C:\Windows\system32\taskeng.exe
taskeng.exe {22708FF8-7725-41A9-9AE6-88A875DD5C32} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\ProgramData\msvvcs\msvvcs.exe
  C:\ProgramData\msvvcs\msvvcs.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\msvvcs\msvvcs.dat

Filesize
205KB

MD5
95056f4bbd695d9b871799748b1da85d

SHA1
739e0a4d7e890f7a0e83aa7cd82fb35cf2f8a85c

SHA256
683cc375477485a47ceb6940b08b6844f58bd02eed03ad29ab89428bfb38884f

SHA512
37285f29cc97b63092e067d7c7b58031f1324c5ee2c57cff55a1345d9b923969d7257eaf2804dafd73c8c43799a16fc0b1dfafef017a637d2115da14572b0af8

Download Submit
C:\ProgramData\msvvcs\msvvcs.exe

Filesize
36KB

MD5
5ad9c956883633298c8e435d90d8394c

SHA1
d666343073acf7b97884bff37b2a902a78901b07

SHA256
b364c54bb671c0979964e13bf429ba4b128f0d3534d0b9c8de4958f2f37b93d4

SHA512
9def3c08808addcc232aabe6594297ddf25953e3002c44170387fcda942c26e83de87bda509d85dd4bdf6fc741172c0d27789a55efa5c41d171ab9205ba70882

Download Submit
C:\ProgramData\msvvcs\msvvcs.exe

Filesize
36KB

MD5
5ad9c956883633298c8e435d90d8394c

SHA1
d666343073acf7b97884bff37b2a902a78901b07

SHA256
b364c54bb671c0979964e13bf429ba4b128f0d3534d0b9c8de4958f2f37b93d4

SHA512
9def3c08808addcc232aabe6594297ddf25953e3002c44170387fcda942c26e83de87bda509d85dd4bdf6fc741172c0d27789a55efa5c41d171ab9205ba70882

Download Submit
memory/276-54-0x0000000010000000-0x0000000010038000-memory.dmp

Filesize
224KB

Download
memory/276-58-0x0000000075721000-0x0000000075723000-memory.dmp

Filesize
8KB

Download
memory/276-59-0x0000000000220000-0x0000000000254000-memory.dmp

Filesize
208KB

Download