Analysis
-
max time kernel
36s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 14:36
Static task
static1
Behavioral task
behavioral1
Sample
f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe
Resource
win10v2004-20220812-en
General
-
Target
f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe
-
Size
312KB
-
MD5
d9f87e744dbc898212a9eaa4594301b0
-
SHA1
6db6a193617ad688847fab965a12a9183eeda241
-
SHA256
f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104
-
SHA512
817e4326e71795982b3b637c6236a31162af0c31e38842c4d3701aed8927d944be285d448f6308818f5a5845052bc4f7baadaeb58fceab989e38f5505018b215
-
SSDEEP
3072:i7xf5kQoAp3Rr3zei1tmDZ5e7H5VVTt0BTnNZfsDZYanqn+S8WTul+5OMojoc:oF5kQo01Q95kzuN2DZYa2+S8YuuOM
Malware Config
Signatures
-
Detects PlugX payload 7 IoCs
resource yara_rule behavioral1/memory/1556-66-0x0000000001E00000-0x0000000001E2E000-memory.dmp family_plugx behavioral1/memory/1556-65-0x0000000001D50000-0x0000000001D7E000-memory.dmp family_plugx behavioral1/memory/1316-67-0x00000000001F0000-0x000000000021E000-memory.dmp family_plugx behavioral1/memory/616-68-0x0000000000170000-0x000000000019E000-memory.dmp family_plugx behavioral1/memory/616-74-0x0000000000170000-0x000000000019E000-memory.dmp family_plugx behavioral1/memory/1064-75-0x00000000006D0000-0x00000000006FE000-memory.dmp family_plugx behavioral1/memory/1064-76-0x00000000006D0000-0x00000000006FE000-memory.dmp family_plugx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GmailBar LiveList = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe\"" f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\GmailBar LiveList = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe\"" f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\MJ svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\MJ\CLSID = 30003000380031004600460039003200330043003100440044003000420037000000 svchost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 616 svchost.exe 616 svchost.exe 616 svchost.exe 1064 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe Token: SeTcbPrivilege 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe Token: SeDebugPrivilege 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe Token: SeTcbPrivilege 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe Token: SeDebugPrivilege 616 svchost.exe Token: SeTcbPrivilege 616 svchost.exe Token: SeDebugPrivilege 1316 svchost.exe Token: SeTcbPrivilege 1316 svchost.exe Token: SeDebugPrivilege 1064 msiexec.exe Token: SeTcbPrivilege 1064 msiexec.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1556 wrote to memory of 1316 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe 28 PID 1556 wrote to memory of 1316 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe 28 PID 1556 wrote to memory of 1316 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe 28 PID 1556 wrote to memory of 1316 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe 28 PID 1556 wrote to memory of 616 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe 27 PID 1556 wrote to memory of 616 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe 27 PID 1556 wrote to memory of 616 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe 27 PID 1556 wrote to memory of 1316 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe 28 PID 1556 wrote to memory of 616 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe 27 PID 1556 wrote to memory of 1316 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe 28 PID 1556 wrote to memory of 616 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe 27 PID 1556 wrote to memory of 616 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe 27 PID 1556 wrote to memory of 1316 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe 28 PID 1556 wrote to memory of 1316 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe 28 PID 1556 wrote to memory of 1316 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe 28 PID 1556 wrote to memory of 616 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe 27 PID 1556 wrote to memory of 616 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe 27 PID 1556 wrote to memory of 616 1556 f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe 27 PID 616 wrote to memory of 1064 616 svchost.exe 29 PID 616 wrote to memory of 1064 616 svchost.exe 29 PID 616 wrote to memory of 1064 616 svchost.exe 29 PID 616 wrote to memory of 1064 616 svchost.exe 29 PID 616 wrote to memory of 1064 616 svchost.exe 29 PID 616 wrote to memory of 1064 616 svchost.exe 29 PID 616 wrote to memory of 1064 616 svchost.exe 29 PID 616 wrote to memory of 1064 616 svchost.exe 29 PID 616 wrote to memory of 1064 616 svchost.exe 29 PID 616 wrote to memory of 1064 616 svchost.exe 29 PID 616 wrote to memory of 1064 616 svchost.exe 29 PID 616 wrote to memory of 1064 616 svchost.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe"C:\Users\Admin\AppData\Local\Temp\f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1064
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1316
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
904B
MD519515a2060e1da76b0f9cfb379333df7
SHA1a101ca59355c81b4cc35a5da6187c7eed55e2946
SHA25601d70cc332af9706e4d5c5d9a24aea841c6dceeac094e8b5f41339e4b9e9d41f
SHA512a71bffc8fbd48ee5d4327918ceebfde2a31250c5699b93b1317535578143d1551093567b3920485280e6ffbfa15a53b5426940eb839abbf7483fffac716371b5