Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
16-11-2022 10:40
Static task
static1
Behavioral task
behavioral1
Sample
291976ba47cec4b3c0e31cbc50ab1923.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
General
-
Target
291976ba47cec4b3c0e31cbc50ab1923.exe
-
Size
236KB
-
MD5
291976ba47cec4b3c0e31cbc50ab1923
-
SHA1
38273b08bd046fc29bd777c9dc4a177ae162b5f8
-
SHA256
a78dbafaca4813307529cafbed554b53a622a639941f2e66520bbb92769ee960
-
SHA512
0b44f02c9d37ba25b9988146bf9a516b65625ed7184c4188689eb4056945cd56e86180e21d7b157faff6acdf4991eec51b18c8d83f084652ef574b0d7ec4158b
-
SSDEEP
3072:1H5VhrQrb6DvbqJMikwRz2Og2QTAxQ4Vt6r+CtbmMjxm8qyCz/xwDSpa:1ZkFkw1vgfCVt6r+l18qjp6Sp
Malware Config
Signatures
-
Detects PlugX payload 7 IoCs
resource yara_rule behavioral1/memory/1532-70-0x0000000000450000-0x0000000000488000-memory.dmp family_plugx behavioral1/memory/1668-72-0x00000000003D0000-0x0000000000408000-memory.dmp family_plugx behavioral1/memory/1284-73-0x0000000000340000-0x0000000000378000-memory.dmp family_plugx behavioral1/memory/908-74-0x0000000000240000-0x0000000000278000-memory.dmp family_plugx behavioral1/memory/568-79-0x0000000000310000-0x0000000000348000-memory.dmp family_plugx behavioral1/memory/908-80-0x0000000000240000-0x0000000000278000-memory.dmp family_plugx behavioral1/memory/568-81-0x0000000000310000-0x0000000000348000-memory.dmp family_plugx -
Executes dropped EXE 2 IoCs
pid Process 1284 NvSmart.exe 1532 NvSmart.exe -
Deletes itself 1 IoCs
pid Process 1284 NvSmart.exe -
Loads dropped DLL 2 IoCs
pid Process 1284 NvSmart.exe 1532 NvSmart.exe -
Modifies data under HKEY_USERS 37 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-d8-6c-5b-31-86\WpadDecisionTime = 206d27a3b0f9d801 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F804C3-6D10-431D-B2B5-224412D7FA27}\06-d8-6c-5b-31-86 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F804C3-6D10-431D-B2B5-224412D7FA27}\WpadDecisionTime = c0744367b0f9d801 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-d8-6c-5b-31-86\WpadDecisionTime = 40403485b0f9d801 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F804C3-6D10-431D-B2B5-224412D7FA27}\WpadDecisionTime = a01f7163b0f9d801 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F804C3-6D10-431D-B2B5-224412D7FA27}\WpadDecisionTime = 40403485b0f9d801 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F804C3-6D10-431D-B2B5-224412D7FA27}\WpadDecisionTime = 206d27a3b0f9d801 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F804C3-6D10-431D-B2B5-224412D7FA27}\WpadDecision = "0" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-d8-6c-5b-31-86\WpadDecision = "0" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-d8-6c-5b-31-86\WpadDecisionTime = 80b90276b0f9d801 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F804C3-6D10-431D-B2B5-224412D7FA27}\WpadNetworkName = "Network 2" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-d8-6c-5b-31-86\WpadDetectedUrl svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F804C3-6D10-431D-B2B5-224412D7FA27}\WpadDecisionTime = 80b90276b0f9d801 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-d8-6c-5b-31-86\WpadDecisionTime = a01f7163b0f9d801 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-d8-6c-5b-31-86\WpadDecisionTime = c0744367b0f9d801 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F804C3-6D10-431D-B2B5-224412D7FA27}\WpadDecisionTime = 60072f94b0f9d801 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-d8-6c-5b-31-86\WpadDecisionTime = 60072f94b0f9d801 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-d8-6c-5b-31-86\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F804C3-6D10-431D-B2B5-224412D7FA27}\WpadDecisionTime = c051eb87b0f9d801 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F804C3-6D10-431D-B2B5-224412D7FA27}\WpadDecisionReason = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-d8-6c-5b-31-86 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-d8-6c-5b-31-86\WpadDecisionTime = c051eb87b0f9d801 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{21F804C3-6D10-431D-B2B5-224412D7FA27} svchost.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 38003300440046003900390030003700360043003000410046003800360044000000 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 908 svchost.exe 908 svchost.exe 908 svchost.exe 908 svchost.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 908 svchost.exe 908 svchost.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 908 svchost.exe 908 svchost.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 908 svchost.exe 908 svchost.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 908 svchost.exe 908 svchost.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 908 svchost.exe 908 svchost.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 908 svchost.exe 908 svchost.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 568 msiexec.exe 908 svchost.exe 908 svchost.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 1668 291976ba47cec4b3c0e31cbc50ab1923.exe Token: SeTcbPrivilege 1668 291976ba47cec4b3c0e31cbc50ab1923.exe Token: SeDebugPrivilege 1284 NvSmart.exe Token: SeTcbPrivilege 1284 NvSmart.exe Token: SeDebugPrivilege 1532 NvSmart.exe Token: SeTcbPrivilege 1532 NvSmart.exe Token: SeDebugPrivilege 908 svchost.exe Token: SeTcbPrivilege 908 svchost.exe Token: SeDebugPrivilege 568 msiexec.exe Token: SeTcbPrivilege 568 msiexec.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1532 wrote to memory of 908 1532 NvSmart.exe 30 PID 1532 wrote to memory of 908 1532 NvSmart.exe 30 PID 1532 wrote to memory of 908 1532 NvSmart.exe 30 PID 1532 wrote to memory of 908 1532 NvSmart.exe 30 PID 1532 wrote to memory of 908 1532 NvSmart.exe 30 PID 1532 wrote to memory of 908 1532 NvSmart.exe 30 PID 1532 wrote to memory of 908 1532 NvSmart.exe 30 PID 1532 wrote to memory of 908 1532 NvSmart.exe 30 PID 1532 wrote to memory of 908 1532 NvSmart.exe 30 PID 908 wrote to memory of 568 908 svchost.exe 31 PID 908 wrote to memory of 568 908 svchost.exe 31 PID 908 wrote to memory of 568 908 svchost.exe 31 PID 908 wrote to memory of 568 908 svchost.exe 31 PID 908 wrote to memory of 568 908 svchost.exe 31 PID 908 wrote to memory of 568 908 svchost.exe 31 PID 908 wrote to memory of 568 908 svchost.exe 31 PID 908 wrote to memory of 568 908 svchost.exe 31 PID 908 wrote to memory of 568 908 svchost.exe 31 PID 908 wrote to memory of 568 908 svchost.exe 31 PID 908 wrote to memory of 568 908 svchost.exe 31 PID 908 wrote to memory of 568 908 svchost.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\291976ba47cec4b3c0e31cbc50ab1923.exe"C:\Users\Admin\AppData\Local\Temp\291976ba47cec4b3c0e31cbc50ab1923.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1668
-
C:\ProgramData\SxS\NvSmart.exe"C:\ProgramData\SxS\NvSmart.exe" 100 16681⤵
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1284
-
C:\ProgramData\SxS\NvSmart.exe"C:\ProgramData\SxS\NvSmart.exe" 200 01⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 201 02⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 9083⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:568
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD509b8b54f78a10c435cd319070aa13c28
SHA16474d0369f97e72e01e4971128d1062f5c2b3656
SHA256523d28df917f9d265cd2c0d38df26277bc56a535145100ed82e6f5fdeaae7256
SHA512c1f2f5c4aa5eb55d255e22db032da954a38a0204fb4d9bc76042f140f1b1e171944aa09b0eb11159323a8b9f33974c73fd32a4f76d976aaa8a16cc9c60a34ca7
-
Filesize
46KB
MD509b8b54f78a10c435cd319070aa13c28
SHA16474d0369f97e72e01e4971128d1062f5c2b3656
SHA256523d28df917f9d265cd2c0d38df26277bc56a535145100ed82e6f5fdeaae7256
SHA512c1f2f5c4aa5eb55d255e22db032da954a38a0204fb4d9bc76042f140f1b1e171944aa09b0eb11159323a8b9f33974c73fd32a4f76d976aaa8a16cc9c60a34ca7
-
Filesize
5KB
MD5ff338690b8c399341981dcbcaf3af02c
SHA15162c70b2ae0b434cab7d9871dbd9a1dac14ec45
SHA2565304d00250196a8cd5e9a81e053a886d1a291e4615484e49ff537bebecc13976
SHA5124c4394b9675d0ab01d2fc8d4a765411fb83700ae58d86b4c71452563931cb50ff1ed60ac637099e89bf0d49f939b4c7eaa4e168c1c2baa1b04e8e80fff37e5a3
-
Filesize
460B
MD5b178c48612f9e71e7c64ec57096385a4
SHA1b4dc6b898a245549e921b6b37c65a6c4d068179a
SHA2563a2dc2ca2ab21733b67b0c983d13618b62f82c03620a27ac918e2caf3ee21c94
SHA51263ef023227363429309c51855030b3d37fb97c52dc94422d50f7fe74beae39e038e3ba7e7576293fcf1359b1a73e90f56db5fa7221158eab8d6092fa98933051
-
Filesize
155KB
MD564dce06ff017f3613b3360f3fa2200b6
SHA1df7b71bbc1e40a8a3ef52ba8a744f2572608eb9c
SHA2563b3f5f30ec0ef0a061e322c55e3ab55f095b6bd346ebecf3ba6970180ccf2c93
SHA512f1924ed6f8c430422939c6c37fc1349ecbc81bef4dded66d71facb2246da9dc12dab0a3738d05df4c4cee3bba141eaa0d02fcd17505b2c5eb0fa2e49aec63410
-
Filesize
5KB
MD5ff338690b8c399341981dcbcaf3af02c
SHA15162c70b2ae0b434cab7d9871dbd9a1dac14ec45
SHA2565304d00250196a8cd5e9a81e053a886d1a291e4615484e49ff537bebecc13976
SHA5124c4394b9675d0ab01d2fc8d4a765411fb83700ae58d86b4c71452563931cb50ff1ed60ac637099e89bf0d49f939b4c7eaa4e168c1c2baa1b04e8e80fff37e5a3
-
Filesize
5KB
MD5ff338690b8c399341981dcbcaf3af02c
SHA15162c70b2ae0b434cab7d9871dbd9a1dac14ec45
SHA2565304d00250196a8cd5e9a81e053a886d1a291e4615484e49ff537bebecc13976
SHA5124c4394b9675d0ab01d2fc8d4a765411fb83700ae58d86b4c71452563931cb50ff1ed60ac637099e89bf0d49f939b4c7eaa4e168c1c2baa1b04e8e80fff37e5a3