Analysis
- max time kernel
149s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
30/11/2022, 10:36
Static task
static1
Behavioral task
behavioral1
Sample
291976ba47cec4b3c0e31cbc50ab1923.exe
Resource
win7-20221111-en
windows7-x64
10 signatures
150 seconds
General
- Target 291976ba47cec4b3c0e31cbc50ab1923.exe
- Size 236KB
- Sample221130-mnpy4scf25
- SHA256 a78dbafaca4813307529cafbed554b53a622a639941f2e66520bbb92769ee960
- MD5 291976ba47cec4b3c0e31cbc50ab1923
- SHA1 38273b08bd046fc29bd777c9dc4a177ae162b5f8
- SHA512 0b44f02c9d37ba25b9988146bf9a516b65625ed7184c4188689eb4056945cd56e86180e21d7b157faff6acdf4991eec51b18c8d83f084652ef574b0d7ec4158b
- SSDEEP 3072:1H5VhrQrb6DvbqJMikwRz2Og2QTAxQ4Vt6r+CtbmMjxm8qyCz/xwDSpa:1ZkFkw1vgfCVt6r+l18qjp6Sp
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects PlugX payload 8 IoCs
resource yara_rule behavioral2/memory/4364-142-0x0000000002A60000-0x0000000002A98000-memory.dmp family_plugx behavioral2/memory/5080-144-0x0000000002190000-0x00000000021C8000-memory.dmp family_plugx behavioral2/memory/1756-145-0x0000000000E50000-0x0000000000E88000-memory.dmp family_plugx behavioral2/memory/4060-147-0x0000000001000000-0x0000000001038000-memory.dmp family_plugx behavioral2/memory/5080-148-0x0000000002190000-0x00000000021C8000-memory.dmp family_plugx behavioral2/memory/4060-149-0x0000000001000000-0x0000000001038000-memory.dmp family_plugx behavioral2/memory/3992-151-0x0000000002AC0000-0x0000000002AF8000-memory.dmp family_plugx behavioral2/memory/3992-152-0x0000000002AC0000-0x0000000002AF8000-memory.dmp family_plugx - Executes dropped EXE 2 IoCs
pid Process 5080 NvSmart.exe 1756 NvSmart.exe - Loads dropped DLL 2 IoCs
pid Process 5080 NvSmart.exe 1756 NvSmart.exe - Modifies data under HKEY_USERS 17 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform svchost.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 32003400330043004300320034004200360032003300380036003900410033000000 svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4060 svchost.exe 4060 svchost.exe 4060 svchost.exe 4060 svchost.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 4060 svchost.exe 4060 svchost.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 4060 svchost.exe 4060 svchost.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 4060 svchost.exe 4060 svchost.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 4060 svchost.exe 4060 svchost.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 3992 msiexec.exe 4060 svchost.exe 4060 svchost.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 4364 291976ba47cec4b3c0e31cbc50ab1923.exe Token: SeTcbPrivilege 4364 291976ba47cec4b3c0e31cbc50ab1923.exe Token: SeDebugPrivilege 5080 NvSmart.exe Token: SeTcbPrivilege 5080 NvSmart.exe Token: SeDebugPrivilege 1756 NvSmart.exe Token: SeTcbPrivilege 1756 NvSmart.exe Token: SeDebugPrivilege 4060 svchost.exe Token: SeTcbPrivilege 4060 svchost.exe Token: SeDebugPrivilege 3992 msiexec.exe Token: SeTcbPrivilege 3992 msiexec.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1756 wrote to memory of 4060 1756 NvSmart.exe 85 PID 1756 wrote to memory of 4060 1756 NvSmart.exe 85 PID 1756 wrote to memory of 4060 1756 NvSmart.exe 85 PID 1756 wrote to memory of 4060 1756 NvSmart.exe 85 PID 1756 wrote to memory of 4060 1756 NvSmart.exe 85 PID 1756 wrote to memory of 4060 1756 NvSmart.exe 85 PID 1756 wrote to memory of 4060 1756 NvSmart.exe 85 PID 1756 wrote to memory of 4060 1756 NvSmart.exe 85 PID 4060 wrote to memory of 3992 4060 svchost.exe 86 PID 4060 wrote to memory of 3992 4060 svchost.exe 86 PID 4060 wrote to memory of 3992 4060 svchost.exe 86 PID 4060 wrote to memory of 3992 4060 svchost.exe 86 PID 4060 wrote to memory of 3992 4060 svchost.exe 86 PID 4060 wrote to memory of 3992 4060 svchost.exe 86 PID 4060 wrote to memory of 3992 4060 svchost.exe 86 PID 4060 wrote to memory of 3992 4060 svchost.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\291976ba47cec4b3c0e31cbc50ab1923.exe"C:\Users\Admin\AppData\Local\Temp\291976ba47cec4b3c0e31cbc50ab1923.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
C:\ProgramData\SxS\NvSmart.exe"C:\ProgramData\SxS\NvSmart.exe" 100 43641⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5080
-
C:\ProgramData\SxS\NvSmart.exe"C:\ProgramData\SxS\NvSmart.exe" 200 01⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 201 02⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 40603⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3992
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SxS\NvSmart.exe
- Size 46KB
- SHA256 523d28df917f9d265cd2c0d38df26277bc56a535145100ed82e6f5fdeaae7256
- MD5 09b8b54f78a10c435cd319070aa13c28
- SHA1 6474d0369f97e72e01e4971128d1062f5c2b3656
- SHA512 c1f2f5c4aa5eb55d255e22db032da954a38a0204fb4d9bc76042f140f1b1e171944aa09b0eb11159323a8b9f33974c73fd32a4f76d976aaa8a16cc9c60a34ca7
- SSDEEP 768:Ep+QDJgY/OTFStOWjmyPTc+6lye958TZLWMmSbC9X:Epj9IexPANL58TZaDaC9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\SxS\NvSmart.exe
- Size 46KB
- SHA256 523d28df917f9d265cd2c0d38df26277bc56a535145100ed82e6f5fdeaae7256
- MD5 09b8b54f78a10c435cd319070aa13c28
- SHA1 6474d0369f97e72e01e4971128d1062f5c2b3656
- SHA512 c1f2f5c4aa5eb55d255e22db032da954a38a0204fb4d9bc76042f140f1b1e171944aa09b0eb11159323a8b9f33974c73fd32a4f76d976aaa8a16cc9c60a34ca7
- SSDEEP 768:Ep+QDJgY/OTFStOWjmyPTc+6lye958TZLWMmSbC9X:Epj9IexPANL58TZaDaC9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\SxS\NvSmart.exe
- Size 46KB
- SHA256 523d28df917f9d265cd2c0d38df26277bc56a535145100ed82e6f5fdeaae7256
- MD5 09b8b54f78a10c435cd319070aa13c28
- SHA1 6474d0369f97e72e01e4971128d1062f5c2b3656
- SHA512 c1f2f5c4aa5eb55d255e22db032da954a38a0204fb4d9bc76042f140f1b1e171944aa09b0eb11159323a8b9f33974c73fd32a4f76d976aaa8a16cc9c60a34ca7
- SSDEEP 768:Ep+QDJgY/OTFStOWjmyPTc+6lye958TZLWMmSbC9X:Epj9IexPANL58TZaDaC9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\SxS\NvSmartMax.dll
- Size 5KB
- SHA256 5304d00250196a8cd5e9a81e053a886d1a291e4615484e49ff537bebecc13976
- MD5 ff338690b8c399341981dcbcaf3af02c
- SHA1 5162c70b2ae0b434cab7d9871dbd9a1dac14ec45
- SHA512 4c4394b9675d0ab01d2fc8d4a765411fb83700ae58d86b4c71452563931cb50ff1ed60ac637099e89bf0d49f939b4c7eaa4e168c1c2baa1b04e8e80fff37e5a3
- SSDEEP 48:qLgpQySnQ339y/gKzMyGLc6CGb4IntYGCnS5zmLpBAEglfj73CSC:B2w39y/gKQy2fCG4m0LpGEglr73Ct
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\SxS\NvSmartMax.dll
- Size 5KB
- SHA256 5304d00250196a8cd5e9a81e053a886d1a291e4615484e49ff537bebecc13976
- MD5 ff338690b8c399341981dcbcaf3af02c
- SHA1 5162c70b2ae0b434cab7d9871dbd9a1dac14ec45
- SHA512 4c4394b9675d0ab01d2fc8d4a765411fb83700ae58d86b4c71452563931cb50ff1ed60ac637099e89bf0d49f939b4c7eaa4e168c1c2baa1b04e8e80fff37e5a3
- SSDEEP 48:qLgpQySnQ339y/gKzMyGLc6CGb4IntYGCnS5zmLpBAEglfj73CSC:B2w39y/gKQy2fCG4m0LpGEglr73Ct
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\SxS\NvSmartMax.dll
- Size 5KB
- SHA256 5304d00250196a8cd5e9a81e053a886d1a291e4615484e49ff537bebecc13976
- MD5 ff338690b8c399341981dcbcaf3af02c
- SHA1 5162c70b2ae0b434cab7d9871dbd9a1dac14ec45
- SHA512 4c4394b9675d0ab01d2fc8d4a765411fb83700ae58d86b4c71452563931cb50ff1ed60ac637099e89bf0d49f939b4c7eaa4e168c1c2baa1b04e8e80fff37e5a3
- SSDEEP 48:qLgpQySnQ339y/gKzMyGLc6CGb4IntYGCnS5zmLpBAEglfj73CSC:B2w39y/gKQy2fCG4m0LpGEglr73Ct
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\SxS\bug.log
- Size 460B
- SHA256 6a0605d7ea924ddfb401a3c94655213264d8bbc626b8b402535d920a1487b68d
- MD5 9677e7dd87965395d39fd8f549dcaf5c
- SHA1 17b461ca3dd2f160f9630bd8de9b23840e90279e
- SHA512 db13bf8dcc8516238e748e801a0a199d7dd53b40a5bf829a95e59561a8a2415bda5a85a2e45526ef060a089c0a307cfc5cd8d2c8e944ac174847982cc6c7e5d6
- MD5 SHA1 SHA512
- Path C:\ProgramData\SxS\xxx.xxx
- Size 155KB
- SHA256 3b3f5f30ec0ef0a061e322c55e3ab55f095b6bd346ebecf3ba6970180ccf2c93
- MD5 64dce06ff017f3613b3360f3fa2200b6
- SHA1 df7b71bbc1e40a8a3ef52ba8a744f2572608eb9c
- SHA512 f1924ed6f8c430422939c6c37fc1349ecbc81bef4dded66d71facb2246da9dc12dab0a3738d05df4c4cee3bba141eaa0d02fcd17505b2c5eb0fa2e49aec63410
- SSDEEP 3072:hrb6DvbqJMikwRz2Og2QTAxQ4Vt6r+CtbmMjxm8qyCz/xwD:pFkw1vgfCVt6r+l18qjp6
- MD5 SHA1 SHA512 SSDEEP