Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
23/11/2023, 13:13
Static task
static1
Behavioral task
behavioral1
Sample
plugmanzx.exe
Resource
win7-20231023-en
General
-
Target
plugmanzx.exe
-
Size
706KB
-
MD5
980746bbc209911ddbaaff46d856a78f
-
SHA1
283b8da4e00d54668ff2c98645a4f6f0853a0d35
-
SHA256
496bbeff36c20e17f2967fb96527b48ab329d1cac12347fdbd8692c46dd36786
-
SHA512
1a40fa8878e916442b7b3acb875cb80bbcb6e5810ad272d8fa8a5df4f757b392cb2ab86ec7b271df25f981914652913ccbded6c96834f84bab1eaafd07da3574
-
SSDEEP
12288:H1CFqELXGkJlaxoem1jMipixc06ycvpxHPi4ou0oTJOHBRAIMHEkjLzq:H1CFqQ2k7axoV1Ai4u069A4JdOHBRT2G
Malware Config
Extracted
nanocore
1.2.2.0
6coinc.zapto.org:6696
127.0.0.1:6696
dc5ce709-95b6-4a26-9175-16a1a8446828
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2023-09-03T02:07:11.731490736Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6696
-
default_group
6coinc
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
dc5ce709-95b6-4a26-9175-16a1a8446828
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
6coinc.zapto.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Subsystem = "C:\\Program Files (x86)\\DDP Subsystem\\ddpss.exe" plugmanzx.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA plugmanzx.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2256 set thread context of 3776 2256 plugmanzx.exe 92 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\DDP Subsystem\ddpss.exe plugmanzx.exe File opened for modification C:\Program Files (x86)\DDP Subsystem\ddpss.exe plugmanzx.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1884 schtasks.exe 992 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3776 plugmanzx.exe 3776 plugmanzx.exe 3776 plugmanzx.exe 3776 plugmanzx.exe 3776 plugmanzx.exe 3776 plugmanzx.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3776 plugmanzx.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3776 plugmanzx.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2256 wrote to memory of 3776 2256 plugmanzx.exe 92 PID 2256 wrote to memory of 3776 2256 plugmanzx.exe 92 PID 2256 wrote to memory of 3776 2256 plugmanzx.exe 92 PID 2256 wrote to memory of 3776 2256 plugmanzx.exe 92 PID 2256 wrote to memory of 3776 2256 plugmanzx.exe 92 PID 2256 wrote to memory of 3776 2256 plugmanzx.exe 92 PID 2256 wrote to memory of 3776 2256 plugmanzx.exe 92 PID 2256 wrote to memory of 3776 2256 plugmanzx.exe 92 PID 3776 wrote to memory of 1884 3776 plugmanzx.exe 93 PID 3776 wrote to memory of 1884 3776 plugmanzx.exe 93 PID 3776 wrote to memory of 1884 3776 plugmanzx.exe 93 PID 3776 wrote to memory of 992 3776 plugmanzx.exe 97 PID 3776 wrote to memory of 992 3776 plugmanzx.exe 97 PID 3776 wrote to memory of 992 3776 plugmanzx.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\plugmanzx.exe"C:\Users\Admin\AppData\Local\Temp\plugmanzx.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\plugmanzx.exe"C:\Users\Admin\AppData\Local\Temp\plugmanzx.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8901.tmp"3⤵
- Creates scheduled task(s)
PID:1884
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp89DD.tmp"3⤵
- Creates scheduled task(s)
PID:992
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
1KB
MD54c71cda0ae19c7af539c30611bbbdd02
SHA18729754de193c3cd41ed134d4abbd330d96efe46
SHA256557e831ec81c93c6e097b4700274935690bcdc3826dc4c72e6d0545f1efdd5fa
SHA512bc8988322d3859121c08a0f3339cc2464e716ee0c4113ea9e66f33f6f40b096e6defb4c0f48a10d43602d037bcdee2de5db0b0df7e41e17f3046d7cfe8358120
-
Filesize
1KB
MD58e2d5fba24ae8a54087d8e6cadc188c1
SHA1548555025543b4773b8f36301f5fa5003e1c85dc
SHA256f8a3739cca23897792b42a11a21adcce745201fa19f8d84ec66a6e0c5e519759
SHA5129246583d7b08152cd73dc40254013e1ae4b8c93603dbb1f4e6b82624e14b134c59de6c8039b588f14075602768a388121e985f886322ae5fb9ec2eee94d4ea3d