plugx | 099f63ed88e191e9222b5cc93f4b43b07414ad82662d3de8184a5707e91e40c8

General

Target

msvvcs/msvvcs.exe
Size

36KB
MD5

5ad9c956883633298c8e435d90d8394c
SHA1

d666343073acf7b97884bff37b2a902a78901b07
SHA256

b364c54bb671c0979964e13bf429ba4b128f0d3534d0b9c8de4958f2f37b93d4
SHA512

9def3c08808addcc232aabe6594297ddf25953e3002c44170387fcda942c26e83de87bda509d85dd4bdf6fc741172c0d27789a55efa5c41d171ab9205ba70882

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects Talisman variant of PlugX 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/276-54-0x0000000010000000-0x0000000010038000-memory.dmp	family_plugx_talisman
behavioral1/memory/276-59-0x0000000000220000-0x0000000000254000-memory.dmp	family_plugx_talisman

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Executes dropped EXE 1 IoCs

Processes:

msvvcs.exe

pid process

1352 msvvcs.exe

pid	process
1352	msvvcs.exe

Drops file in System32 directory 1 IoCs

Processes:

msvvcs.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	msvvcs.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1608 schtasks.exe

pid	process
1608	schtasks.exe

Modifies data under HKEY_USERS 35 IoCs

Processes:

msvvcs.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform	msvvcs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	msvvcs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-1c-d9-a0-cd-b8\WpadDecision = "0"	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msvvcs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0EC86CC3-F026-455A-8695-46AD69EE8224}\WpadDecisionTime = 706b52fa6574d801	msvvcs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-1c-d9-a0-cd-b8\WpadDecisionReason = "1"	msvvcs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-1c-d9-a0-cd-b8\WpadDecisionTime = 706b52fa6574d801	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0EC86CC3-F026-455A-8695-46AD69EE8224}	msvvcs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00a7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msvvcs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	msvvcs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0EC86CC3-F026-455A-8695-46AD69EE8224}\WpadNetworkName = "Network 2"	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0EC86CC3-F026-455A-8695-46AD69EE8224}\f2-1c-d9-a0-cd-b8	msvvcs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent	msvvcs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msvvcs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	msvvcs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0EC86CC3-F026-455A-8695-46AD69EE8224}\WpadDecision = "0"	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	msvvcs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	msvvcs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-1c-d9-a0-cd-b8	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent	msvvcs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	msvvcs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0EC86CC3-F026-455A-8695-46AD69EE8224}\WpadDecisionReason = "1"	msvvcs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	msvvcs.exe

Modifies registry class 2 IoCs

Processes:

msvvcs.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\MPLS\CLSID = 42004600440038003800430041003100420039003100450046004400460032000000	msvvcs.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\MPLS	msvvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msvvcs.exe

pid process

1352 msvvcs.exe
1352 msvvcs.exe

pid	process
1352	msvvcs.exe
1352	msvvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

msvvcs.exemsvvcs.exe

description	pid	process
Token: SeDebugPrivilege	276	msvvcs.exe
Token: SeTcbPrivilege	276	msvvcs.exe
Token: SeDebugPrivilege	1352	msvvcs.exe
Token: SeTcbPrivilege	1352	msvvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

msvvcs.execmd.exetaskeng.exe

description	pid	process	target process
PID 276 wrote to memory of 1508	276	msvvcs.exe	cmd.exe
PID 276 wrote to memory of 1508	276	msvvcs.exe	cmd.exe
PID 276 wrote to memory of 1508	276	msvvcs.exe	cmd.exe
PID 276 wrote to memory of 1508	276	msvvcs.exe	cmd.exe
PID 1508 wrote to memory of 1608	1508	cmd.exe	schtasks.exe
PID 1508 wrote to memory of 1608	1508	cmd.exe	schtasks.exe
PID 1508 wrote to memory of 1608	1508	cmd.exe	schtasks.exe
PID 1508 wrote to memory of 1608	1508	cmd.exe	schtasks.exe
PID 1804 wrote to memory of 1352	1804	taskeng.exe	msvvcs.exe
PID 1804 wrote to memory of 1352	1804	taskeng.exe	msvvcs.exe
PID 1804 wrote to memory of 1352	1804	taskeng.exe	msvvcs.exe
PID 1804 wrote to memory of 1352	1804	taskeng.exe	msvvcs.exe

C:\Users\Admin\AppData\Local\Temp\msvvcs\msvvcs.exe
"C:\Users\Admin\AppData\Local\Temp\msvvcs\msvvcs.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:276

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c schtasks /create /sc minute /mo 2 /tn "msvvcs" /tr "\"C:\ProgramData\msvvcs\msvvcs.exe\"" /ru "system"
2⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 2 /tn "msvvcs" /tr "\"C:\ProgramData\msvvcs\msvvcs.exe\"" /ru "system"
3⤵
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\taskeng.exe
taskeng.exe {22708FF8-7725-41A9-9AE6-88A875DD5C32} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1804

C:\ProgramData\msvvcs\msvvcs.exe
C:\ProgramData\msvvcs\msvvcs.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1352

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\msvvcs\msvvcs.dat
Filesize
205KB

MD5
95056f4bbd695d9b871799748b1da85d

SHA1
739e0a4d7e890f7a0e83aa7cd82fb35cf2f8a85c

SHA256
683cc375477485a47ceb6940b08b6844f58bd02eed03ad29ab89428bfb38884f

SHA512
37285f29cc97b63092e067d7c7b58031f1324c5ee2c57cff55a1345d9b923969d7257eaf2804dafd73c8c43799a16fc0b1dfafef017a637d2115da14572b0af8

Download Submit
C:\ProgramData\msvvcs\msvvcs.exe
Filesize
36KB

MD5
5ad9c956883633298c8e435d90d8394c

SHA1
d666343073acf7b97884bff37b2a902a78901b07

SHA256
b364c54bb671c0979964e13bf429ba4b128f0d3534d0b9c8de4958f2f37b93d4

SHA512
9def3c08808addcc232aabe6594297ddf25953e3002c44170387fcda942c26e83de87bda509d85dd4bdf6fc741172c0d27789a55efa5c41d171ab9205ba70882

Download Submit
C:\ProgramData\msvvcs\msvvcs.exe
Filesize
36KB

MD5
5ad9c956883633298c8e435d90d8394c

SHA1
d666343073acf7b97884bff37b2a902a78901b07

SHA256
b364c54bb671c0979964e13bf429ba4b128f0d3534d0b9c8de4958f2f37b93d4

SHA512
9def3c08808addcc232aabe6594297ddf25953e3002c44170387fcda942c26e83de87bda509d85dd4bdf6fc741172c0d27789a55efa5c41d171ab9205ba70882

Download Submit
memory/276-54-0x0000000010000000-0x0000000010038000-memory.dmp

Filesize
224KB

Download
memory/276-58-0x0000000075721000-0x0000000075723000-memory.dmp

Filesize
8KB

Download
memory/276-59-0x0000000000220000-0x0000000000254000-memory.dmp

Filesize
208KB

Download
memory/1352-63-0x0000000000000000-mapping.dmp

Download
memory/1508-60-0x0000000000000000-mapping.dmp

Download
memory/1608-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads