plugx | 9f94021d4e3b56b43a8be387f933db96d3f204601b9d3137559b3ae944650edb

Analysis

max time kernel
1201s
max time network
1202s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-03-2023 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.zip
Size

178KB
MD5

03f26e0d4c481b27eaf276963337311c
SHA1

854b995c2508960f93fdff419a955ac72844e78b
SHA256

9f94021d4e3b56b43a8be387f933db96d3f204601b9d3137559b3ae944650edb
SHA512

6effe344370843091a2d060b6b18d3024023249fea0cec017523d9430e06e067fbbef5ad9b7f1b9712236980ff4f73bc0322064eedbbb37cc3216aacc4956e97
SSDEEP

3072:ENOkf7P32G6nFAuWOfD3IDPcVXvp6xuTA+DQEALq+mYo7VQ0xBexnewAKHCfGID:ENOkfCxFAFyI4Fp4/+D69md7KTxnewfm

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects PlugX payload 30 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1932-69-0x00000000003C0000-0x00000000003FC000-memory.dmp	family_plugx
behavioral2/memory/1932-82-0x00000000003C0000-0x00000000003FC000-memory.dmp	family_plugx
behavioral2/memory/1092-88-0x00000000002C0000-0x00000000002FC000-memory.dmp	family_plugx
behavioral2/memory/2020-92-0x00000000002B0000-0x00000000002EC000-memory.dmp	family_plugx
behavioral2/memory/1696-97-0x0000000000230000-0x000000000026C000-memory.dmp	family_plugx
behavioral2/memory/1696-99-0x0000000000230000-0x000000000026C000-memory.dmp	family_plugx
behavioral2/memory/2020-98-0x00000000002B0000-0x00000000002EC000-memory.dmp	family_plugx
behavioral2/memory/1696-107-0x0000000000230000-0x000000000026C000-memory.dmp	family_plugx
behavioral2/memory/1696-108-0x0000000000230000-0x000000000026C000-memory.dmp	family_plugx
behavioral2/memory/1696-109-0x0000000000230000-0x000000000026C000-memory.dmp	family_plugx
behavioral2/memory/1696-110-0x0000000000230000-0x000000000026C000-memory.dmp	family_plugx
behavioral2/memory/1696-111-0x0000000000230000-0x000000000026C000-memory.dmp	family_plugx
behavioral2/memory/1696-112-0x0000000000230000-0x000000000026C000-memory.dmp	family_plugx
behavioral2/memory/1696-115-0x0000000000230000-0x000000000026C000-memory.dmp	family_plugx
behavioral2/memory/1092-116-0x00000000002C0000-0x00000000002FC000-memory.dmp	family_plugx
behavioral2/memory/1696-117-0x0000000000230000-0x000000000026C000-memory.dmp	family_plugx
behavioral2/memory/904-123-0x0000000000370000-0x00000000003AC000-memory.dmp	family_plugx
behavioral2/memory/904-125-0x0000000000370000-0x00000000003AC000-memory.dmp	family_plugx
behavioral2/memory/904-126-0x0000000000370000-0x00000000003AC000-memory.dmp	family_plugx
behavioral2/memory/904-127-0x0000000000370000-0x00000000003AC000-memory.dmp	family_plugx
behavioral2/memory/904-128-0x0000000000370000-0x00000000003AC000-memory.dmp	family_plugx
behavioral2/memory/1696-129-0x0000000000230000-0x000000000026C000-memory.dmp	family_plugx
behavioral2/memory/1696-132-0x0000000000230000-0x000000000026C000-memory.dmp	family_plugx
behavioral2/memory/1696-133-0x0000000000230000-0x000000000026C000-memory.dmp	family_plugx
behavioral2/memory/1696-134-0x0000000000230000-0x000000000026C000-memory.dmp	family_plugx
behavioral2/memory/1696-136-0x0000000000230000-0x000000000026C000-memory.dmp	family_plugx
behavioral2/memory/1696-138-0x0000000000230000-0x000000000026C000-memory.dmp	family_plugx
behavioral2/memory/1696-140-0x0000000000230000-0x000000000026C000-memory.dmp	family_plugx
behavioral2/memory/1696-142-0x0000000000230000-0x000000000026C000-memory.dmp	family_plugx
behavioral2/memory/1696-144-0x0000000000230000-0x000000000026C000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Executes dropped EXE 3 IoCs

Processes:

esetservice.exeesetservice.exeesetservice.exe

pid process

1932 esetservice.exe
1092 esetservice.exe
2020 esetservice.exe
Loads dropped DLL 3 IoCs

Processes:

esetservice.exeesetservice.exeesetservice.exe

pid process

1932 esetservice.exe
1092 esetservice.exe
2020 esetservice.exe

pid	process
1932	esetservice.exe
1092	esetservice.exe
2020	esetservice.exe

pid	process
1932	esetservice.exe
1092	esetservice.exe
2020	esetservice.exe

Unexpected DNS network traffic destination 8 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	167.179.110.17
Destination IP	167.179.110.17
Destination IP	167.179.110.17
Destination IP	167.179.110.17
Destination IP	167.179.110.17
Destination IP	167.179.110.17
Destination IP	167.179.110.17
Destination IP	167.179.110.17

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

runonce.exe

description ioc process

Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad runonce.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	runonce.exe

Modifies registry class 64 IoCs

Processes:

explorer.exerunonce.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Rev = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupView = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c0031000000000054562b9910204c6f63616c00380008000400efbe5456d09654562b992a000000fc0100000000020000000000000000000000000000004c006f00630061006c00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "2"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\FFlags = "18874369"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByDirection = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\IconSize = "16"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c0031000000000054563d9c100041646d696e00380008000400efbe5456d09654563d9c2a0000002e000000000004000000000000000000000000000000410064006d0069006e00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\LogicalViewMode = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Mode = "4"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByKey:PID = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 4c003200c2c802005456849c2020312e7a697000380008000400efbe5456849c5456849c2a0000000b3a010000000700000000000000000000000000000031002e007a0069007000000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FASU\CLSID = 35003100430035004300330036003500450046004600340042004500390042000000	runonce.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a0031000000000068569cad102054656d700000360008000400efbe5456d09668569cad2a000000fd010000000002000000000000000000000000000000540065006d007000000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 74003100000000005456d0961100557365727300600008000400efbeee3a851a5456d0962a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\FASU	runonce.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 52003100000000005456d096122041707044617461003c0008000400efbe5456d0965456d0962a000000e90100000000020000000000000000000000000000004100700070004400610074006100000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

esetservice.exe

pid process

1932 esetservice.exe

pid	process
1932	esetservice.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

runonce.exemsiexec.exe

pid	process
1696	runonce.exe
1696	runonce.exe
1696	runonce.exe
1696	runonce.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
1696	runonce.exe
1696	runonce.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
1696	runonce.exe
1696	runonce.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
1696	runonce.exe
1696	runonce.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
1696	runonce.exe
904	msiexec.exe
904	msiexec.exe
1696	runonce.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
1696	runonce.exe
1696	runonce.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
1696	runonce.exe
1696	runonce.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe
904	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

explorer.exemsiexec.exerunonce.exe

pid process

876 explorer.exe
904 msiexec.exe
1696 runonce.exe

pid	process
876	explorer.exe
904	msiexec.exe
1696	runonce.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

7zG.exeAUDIODG.EXEesetservice.exeesetservice.exeesetservice.exerunonce.exemsiexec.exe

description	pid	process
Token: SeRestorePrivilege	608	7zG.exe
Token: 35	608	7zG.exe
Token: SeSecurityPrivilege	608	7zG.exe
Token: SeSecurityPrivilege	608	7zG.exe
Token: 33	1960	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1960	AUDIODG.EXE
Token: 33	1960	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1960	AUDIODG.EXE
Token: SeDebugPrivilege	1932	esetservice.exe
Token: SeTcbPrivilege	1932	esetservice.exe
Token: SeDebugPrivilege	1092	esetservice.exe
Token: SeTcbPrivilege	1092	esetservice.exe
Token: SeDebugPrivilege	2020	esetservice.exe
Token: SeTcbPrivilege	2020	esetservice.exe
Token: SeDebugPrivilege	1696	runonce.exe
Token: SeTcbPrivilege	1696	runonce.exe
Token: SeDebugPrivilege	904	msiexec.exe
Token: SeTcbPrivilege	904	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zG.exe

pid process

608 7zG.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

explorer.exe

pid process

876 explorer.exe
876 explorer.exe

pid	process
608	7zG.exe

pid	process
876	explorer.exe
876	explorer.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

cmd.exeexplorer.exeesetservice.exerunonce.exe

description	pid	process	target process
PID 1288 wrote to memory of 1852	1288	cmd.exe	explorer.exe
PID 1288 wrote to memory of 1852	1288	cmd.exe	explorer.exe
PID 1288 wrote to memory of 1852	1288	cmd.exe	explorer.exe
PID 876 wrote to memory of 608	876	explorer.exe	7zG.exe
PID 876 wrote to memory of 608	876	explorer.exe	7zG.exe
PID 876 wrote to memory of 608	876	explorer.exe	7zG.exe
PID 1288 wrote to memory of 1932	1288	cmd.exe	esetservice.exe
PID 1288 wrote to memory of 1932	1288	cmd.exe	esetservice.exe
PID 1288 wrote to memory of 1932	1288	cmd.exe	esetservice.exe
PID 1288 wrote to memory of 1932	1288	cmd.exe	esetservice.exe
PID 2020 wrote to memory of 1696	2020	esetservice.exe	runonce.exe
PID 2020 wrote to memory of 1696	2020	esetservice.exe	runonce.exe
PID 2020 wrote to memory of 1696	2020	esetservice.exe	runonce.exe
PID 2020 wrote to memory of 1696	2020	esetservice.exe	runonce.exe
PID 2020 wrote to memory of 1696	2020	esetservice.exe	runonce.exe
PID 2020 wrote to memory of 1696	2020	esetservice.exe	runonce.exe
PID 2020 wrote to memory of 1696	2020	esetservice.exe	runonce.exe
PID 2020 wrote to memory of 1696	2020	esetservice.exe	runonce.exe
PID 2020 wrote to memory of 1696	2020	esetservice.exe	runonce.exe
PID 1696 wrote to memory of 904	1696	runonce.exe	msiexec.exe
PID 1696 wrote to memory of 904	1696	runonce.exe	msiexec.exe
PID 1696 wrote to memory of 904	1696	runonce.exe	msiexec.exe
PID 1696 wrote to memory of 904	1696	runonce.exe	msiexec.exe
PID 1696 wrote to memory of 904	1696	runonce.exe	msiexec.exe
PID 1696 wrote to memory of 904	1696	runonce.exe	msiexec.exe
PID 1696 wrote to memory of 904	1696	runonce.exe	msiexec.exe
PID 1696 wrote to memory of 904	1696	runonce.exe	msiexec.exe
PID 1696 wrote to memory of 904	1696	runonce.exe	msiexec.exe
PID 1696 wrote to memory of 904	1696	runonce.exe	msiexec.exe
PID 1696 wrote to memory of 904	1696	runonce.exe	msiexec.exe
PID 1696 wrote to memory of 904	1696	runonce.exe	msiexec.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\1.zip
1⤵
PID:1692

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\explorer.exe
explorer .
2⤵
PID:1852

C:\Users\Admin\AppData\Local\Temp\esetservice.exe
esetservice.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
PID:1932

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:876

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\" -an -ai#7zMap24648:82:7zEvent31784
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:608

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xc8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\ProgramData\Windows NT\Windows eset service\esetservice.exe
"C:\ProgramData\\Windows NT\\Windows eset service\esetservice.exe" 100 1932
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\ProgramData\Windows NT\Windows eset service\esetservice.exe
"C:\ProgramData\Windows NT\Windows eset service\esetservice.exe" 200 0
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\runonce.exe
C:\Windows\system32\runonce.exe 201 0
2⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\msiexec.exe
C:\Windows\system32\msiexec.exe 209 1696
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:904

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Windows NT\Windows eset service\esetservice.exe
Filesize
32KB

MD5
68d91a34ce51cf15c45dd68f7f1257e8

SHA1
5d076537f56ee7389410698d700cc4fd7d736453

SHA256
81698c9d6e69506637208ca564b14b7febbfe4efbc574c490332a985adcbb12d

SHA512
e4cec6a713537d51451752c06e69e98b8053c3d50a5628e30adc770a883e946573757b4e10689a3e40023a19f5ed2f9d4890d07ced71726d1c984bf9130bcb65

Download Submit
C:\ProgramData\Windows NT\Windows eset service\esetservice.exe
Filesize
32KB

MD5
68d91a34ce51cf15c45dd68f7f1257e8

SHA1
5d076537f56ee7389410698d700cc4fd7d736453

SHA256
81698c9d6e69506637208ca564b14b7febbfe4efbc574c490332a985adcbb12d

SHA512
e4cec6a713537d51451752c06e69e98b8053c3d50a5628e30adc770a883e946573757b4e10689a3e40023a19f5ed2f9d4890d07ced71726d1c984bf9130bcb65

Download Submit
C:\ProgramData\Windows NT\Windows eset service\esetservice.exe
Filesize
32KB

MD5
68d91a34ce51cf15c45dd68f7f1257e8

SHA1
5d076537f56ee7389410698d700cc4fd7d736453

SHA256
81698c9d6e69506637208ca564b14b7febbfe4efbc574c490332a985adcbb12d

SHA512
e4cec6a713537d51451752c06e69e98b8053c3d50a5628e30adc770a883e946573757b4e10689a3e40023a19f5ed2f9d4890d07ced71726d1c984bf9130bcb65

Download Submit
C:\ProgramData\Windows NT\Windows eset service\http_dll.dll
Filesize
45KB

MD5
d1a06b95c1d7ceaa4dc4c8b85367d673

SHA1
766b56f2a91581a20d4e8c3b311007dac3c09177

SHA256
b700a48ba312c1b9deeac9fcf57ed426e79c8466327f1a4f5b1b057f2ca908e8

SHA512
6d7f1f3be71316afe7d10b1e474d3e599353411f70d79182f013f6e653fa9a1d7ff81070c639ff55486eaad4da9de8bc6005c80b31b29fbf3211047c163d14fa

Download Submit
C:\ProgramData\Windows NT\Windows eset service\http_dll.dll
Filesize
45KB

MD5
d1a06b95c1d7ceaa4dc4c8b85367d673

SHA1
766b56f2a91581a20d4e8c3b311007dac3c09177

SHA256
b700a48ba312c1b9deeac9fcf57ed426e79c8466327f1a4f5b1b057f2ca908e8

SHA512
6d7f1f3be71316afe7d10b1e474d3e599353411f70d79182f013f6e653fa9a1d7ff81070c639ff55486eaad4da9de8bc6005c80b31b29fbf3211047c163d14fa

Download Submit
C:\ProgramData\Windows NT\Windows eset service\lang.dat
Filesize
141KB

MD5
d973223b0329118de57055177d78817b

SHA1
953a3d81eaacf9cd3a4c0e2708ae33f12fb352ad

SHA256
edfb699cbf082db13c59fe2695c64287baa46e96721c8a82eba04d718778091e

SHA512
eead4c06792c825f21b5b0f99a95ed2c9be9e572e6f49ba00660bf756fb59beb96cc1cd5f3444b48b218bbf9e1f2fd549a36b9ab35e26c160b3675ac95db0bf5

Download Submit
C:\ProgramData\Windows NT\Windows eset service\lang.dat
Filesize
141KB

MD5
d973223b0329118de57055177d78817b

SHA1
953a3d81eaacf9cd3a4c0e2708ae33f12fb352ad

SHA256
edfb699cbf082db13c59fe2695c64287baa46e96721c8a82eba04d718778091e

SHA512
eead4c06792c825f21b5b0f99a95ed2c9be9e572e6f49ba00660bf756fb59beb96cc1cd5f3444b48b218bbf9e1f2fd549a36b9ab35e26c160b3675ac95db0bf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\esetservice.exe
Filesize
32KB

MD5
68d91a34ce51cf15c45dd68f7f1257e8

SHA1
5d076537f56ee7389410698d700cc4fd7d736453

SHA256
81698c9d6e69506637208ca564b14b7febbfe4efbc574c490332a985adcbb12d

SHA512
e4cec6a713537d51451752c06e69e98b8053c3d50a5628e30adc770a883e946573757b4e10689a3e40023a19f5ed2f9d4890d07ced71726d1c984bf9130bcb65

Download Submit
C:\Users\Admin\AppData\Local\Temp\esetservice.exe
Filesize
32KB

MD5
68d91a34ce51cf15c45dd68f7f1257e8

SHA1
5d076537f56ee7389410698d700cc4fd7d736453

SHA256
81698c9d6e69506637208ca564b14b7febbfe4efbc574c490332a985adcbb12d

SHA512
e4cec6a713537d51451752c06e69e98b8053c3d50a5628e30adc770a883e946573757b4e10689a3e40023a19f5ed2f9d4890d07ced71726d1c984bf9130bcb65

Download Submit
C:\Users\Admin\AppData\Local\Temp\http_dll.dll
Filesize
45KB

MD5
d1a06b95c1d7ceaa4dc4c8b85367d673

SHA1
766b56f2a91581a20d4e8c3b311007dac3c09177

SHA256
b700a48ba312c1b9deeac9fcf57ed426e79c8466327f1a4f5b1b057f2ca908e8

SHA512
6d7f1f3be71316afe7d10b1e474d3e599353411f70d79182f013f6e653fa9a1d7ff81070c639ff55486eaad4da9de8bc6005c80b31b29fbf3211047c163d14fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\lang.dat
Filesize
141KB

MD5
d973223b0329118de57055177d78817b

SHA1
953a3d81eaacf9cd3a4c0e2708ae33f12fb352ad

SHA256
edfb699cbf082db13c59fe2695c64287baa46e96721c8a82eba04d718778091e

SHA512
eead4c06792c825f21b5b0f99a95ed2c9be9e572e6f49ba00660bf756fb59beb96cc1cd5f3444b48b218bbf9e1f2fd549a36b9ab35e26c160b3675ac95db0bf5

Download Submit
\ProgramData\Windows NT\Windows eset service\http_dll.dll
Filesize
45KB

MD5
d1a06b95c1d7ceaa4dc4c8b85367d673

SHA1
766b56f2a91581a20d4e8c3b311007dac3c09177

SHA256
b700a48ba312c1b9deeac9fcf57ed426e79c8466327f1a4f5b1b057f2ca908e8

SHA512
6d7f1f3be71316afe7d10b1e474d3e599353411f70d79182f013f6e653fa9a1d7ff81070c639ff55486eaad4da9de8bc6005c80b31b29fbf3211047c163d14fa

Download Submit
\ProgramData\Windows NT\Windows eset service\http_dll.dll
Filesize
45KB

MD5
d1a06b95c1d7ceaa4dc4c8b85367d673

SHA1
766b56f2a91581a20d4e8c3b311007dac3c09177

SHA256
b700a48ba312c1b9deeac9fcf57ed426e79c8466327f1a4f5b1b057f2ca908e8

SHA512
6d7f1f3be71316afe7d10b1e474d3e599353411f70d79182f013f6e653fa9a1d7ff81070c639ff55486eaad4da9de8bc6005c80b31b29fbf3211047c163d14fa

Download Submit
\Users\Admin\AppData\Local\Temp\http_dll.dll
Filesize
45KB

MD5
d1a06b95c1d7ceaa4dc4c8b85367d673

SHA1
766b56f2a91581a20d4e8c3b311007dac3c09177

SHA256
b700a48ba312c1b9deeac9fcf57ed426e79c8466327f1a4f5b1b057f2ca908e8

SHA512
6d7f1f3be71316afe7d10b1e474d3e599353411f70d79182f013f6e653fa9a1d7ff81070c639ff55486eaad4da9de8bc6005c80b31b29fbf3211047c163d14fa

Download Submit
memory/876-54-0x0000000003740000-0x0000000003750000-memory.dmp

Filesize
64KB

Download
memory/876-56-0x0000000003730000-0x0000000003731000-memory.dmp

Filesize
4KB

Download
memory/876-55-0x0000000003730000-0x0000000003731000-memory.dmp

Filesize
4KB

Download
memory/904-124-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/904-128-0x0000000000370000-0x00000000003AC000-memory.dmp

Filesize
240KB

Download
memory/904-127-0x0000000000370000-0x00000000003AC000-memory.dmp

Filesize
240KB

Download
memory/904-126-0x0000000000370000-0x00000000003AC000-memory.dmp

Filesize
240KB

Download
memory/904-125-0x0000000000370000-0x00000000003AC000-memory.dmp

Filesize
240KB

Download
memory/904-123-0x0000000000370000-0x00000000003AC000-memory.dmp

Filesize
240KB

Download
memory/1092-88-0x00000000002C0000-0x00000000002FC000-memory.dmp

Filesize
240KB

Download
memory/1092-116-0x00000000002C0000-0x00000000002FC000-memory.dmp

Filesize
240KB

Download
memory/1696-99-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/1696-95-0x00000000000A0000-0x00000000000C2000-memory.dmp

Filesize
136KB

Download
memory/1696-144-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/1696-106-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1696-107-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/1696-108-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/1696-109-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/1696-110-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/1696-111-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/1696-112-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/1696-115-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/1696-96-0x00000000000D0000-0x00000000000D2000-memory.dmp

Filesize
8KB

Download
memory/1696-117-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/1696-97-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/1696-142-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/1696-93-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1696-140-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/1696-138-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/1696-136-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/1696-129-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/1696-132-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/1696-133-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/1696-134-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/1932-82-0x00000000003C0000-0x00000000003FC000-memory.dmp

Filesize
240KB

Download
memory/1932-69-0x00000000003C0000-0x00000000003FC000-memory.dmp

Filesize
240KB

Download
memory/1932-68-0x0000000001D00000-0x0000000001E00000-memory.dmp

Filesize
1024KB

Download
memory/2020-92-0x00000000002B0000-0x00000000002EC000-memory.dmp

Filesize
240KB

Download
memory/2020-98-0x00000000002B0000-0x00000000002EC000-memory.dmp

Filesize
240KB

Download