Analysis
-
max time kernel
3s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
06-01-2024 01:11
Behavioral task
behavioral1
Sample
44e6a17304e6f70010f378b1ddb272c3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
44e6a17304e6f70010f378b1ddb272c3.exe
Resource
win10v2004-20231222-en
General
-
Target
44e6a17304e6f70010f378b1ddb272c3.exe
-
Size
858KB
-
MD5
44e6a17304e6f70010f378b1ddb272c3
-
SHA1
33b6b8a3bbcbe6f525c09a9c9b8fe677337eb021
-
SHA256
170b0b2f1444fc216b0d5e4905a0441053c41927eb85d91dc03ee5c8c1735279
-
SHA512
0d22af93710d7eabfb74c4c918178e2d14f68b4c0e3b96003640ec95e4c75e29ace14f38c08b24c11b4acf27c2accddf2f1b4efb9fffe26df75e4007edc8b3a1
-
SSDEEP
24576:SJsGL0ltYYo+hMrelc7TSDbGWMhuXImU2nK7:SJss8tRo2keSLmBI
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
44e6a17304e6f70010f378b1ddb272c3.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 44e6a17304e6f70010f378b1ddb272c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\Microsoft\\Pluguin.exe" 44e6a17304e6f70010f378b1ddb272c3.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 44e6a17304e6f70010f378b1ddb272c3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\Microsoft\\Pluguin.exe" 44e6a17304e6f70010f378b1ddb272c3.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
44e6a17304e6f70010f378b1ddb272c3.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{J117WMVM-32D1-5FCT-JK8F-E48807I25UR5} 44e6a17304e6f70010f378b1ddb272c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{J117WMVM-32D1-5FCT-JK8F-E48807I25UR5}\StubPath = "C:\\Windows\\Microsoft\\Pluguin.exe Restart" 44e6a17304e6f70010f378b1ddb272c3.exe -
Processes:
resource yara_rule behavioral2/memory/3812-63-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral2/memory/4804-68-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral2/memory/4804-67-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral2/memory/3812-3-0x0000000024010000-0x0000000024070000-memory.dmp upx behavioral2/memory/2184-134-0x00000000240D0000-0x0000000024130000-memory.dmp upx behavioral2/memory/4804-777-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral2/memory/2184-1458-0x00000000240D0000-0x0000000024130000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
44e6a17304e6f70010f378b1ddb272c3.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Avgnt = "C:\\Windows\\Microsoft\\Pluguin.exe" 44e6a17304e6f70010f378b1ddb272c3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Avirnt = "C:\\Windows\\Microsoft\\Pluguin.exe" 44e6a17304e6f70010f378b1ddb272c3.exe -
Drops file in Windows directory 2 IoCs
Processes:
44e6a17304e6f70010f378b1ddb272c3.exedescription ioc process File created C:\Windows\Microsoft\Pluguin.exe 44e6a17304e6f70010f378b1ddb272c3.exe File opened for modification C:\Windows\Microsoft\Pluguin.exe 44e6a17304e6f70010f378b1ddb272c3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3460 4492 WerFault.exe Pluguin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
44e6a17304e6f70010f378b1ddb272c3.exepid process 3812 44e6a17304e6f70010f378b1ddb272c3.exe 3812 44e6a17304e6f70010f378b1ddb272c3.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
44e6a17304e6f70010f378b1ddb272c3.exepid process 3812 44e6a17304e6f70010f378b1ddb272c3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
44e6a17304e6f70010f378b1ddb272c3.exedescription pid process target process PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3812 wrote to memory of 3392 3812 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\44e6a17304e6f70010f378b1ddb272c3.exe"C:\Users\Admin\AppData\Local\Temp\44e6a17304e6f70010f378b1ddb272c3.exe"1⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\44e6a17304e6f70010f378b1ddb272c3.exe"C:\Users\Admin\AppData\Local\Temp\44e6a17304e6f70010f378b1ddb272c3.exe"2⤵
-
C:\Windows\Microsoft\Pluguin.exe"C:\Windows\Microsoft\Pluguin.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 5604⤵
- Program crash
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4492 -ip 44921⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2184-134-0x00000000240D0000-0x0000000024130000-memory.dmpFilesize
384KB
-
memory/2184-1458-0x00000000240D0000-0x0000000024130000-memory.dmpFilesize
384KB
-
memory/3812-63-0x0000000024070000-0x00000000240D0000-memory.dmpFilesize
384KB
-
memory/3812-3-0x0000000024010000-0x0000000024070000-memory.dmpFilesize
384KB
-
memory/4804-8-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/4804-7-0x0000000000420000-0x0000000000421000-memory.dmpFilesize
4KB
-
memory/4804-68-0x0000000024070000-0x00000000240D0000-memory.dmpFilesize
384KB
-
memory/4804-67-0x0000000024070000-0x00000000240D0000-memory.dmpFilesize
384KB
-
memory/4804-66-0x0000000003410000-0x0000000003411000-memory.dmpFilesize
4KB
-
memory/4804-777-0x0000000024070000-0x00000000240D0000-memory.dmpFilesize
384KB