Analysis
- max time kernel
149s - max time network
141s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
09/02/2024, 03:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Nv.exe
Resource
win7-20231129-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
Nv.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
NvSmartMax.dll
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
NvSmartMax.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target Nv.exe
- Size 46KB
- Sample240209-egbtxafe51
- SHA256 523d28df917f9d265cd2c0d38df26277bc56a535145100ed82e6f5fdeaae7256
- MD5 09b8b54f78a10c435cd319070aa13c28
- SHA1 6474d0369f97e72e01e4971128d1062f5c2b3656
- SHA512 c1f2f5c4aa5eb55d255e22db032da954a38a0204fb4d9bc76042f140f1b1e171944aa09b0eb11159323a8b9f33974c73fd32a4f76d976aaa8a16cc9c60a34ca7
- SSDEEP 768:Ep+QDJgY/OTFStOWjmyPTc+6lye958TZLWMmSbC9X:Epj9IexPANL58TZaDaC9
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects PlugX payload 21 IoCs
resource yara_rule behavioral1/memory/2264-1-0x0000000000300000-0x0000000000330000-memory.dmp family_plugx behavioral1/memory/2552-21-0x0000000001C90000-0x0000000001CC0000-memory.dmp family_plugx behavioral1/memory/2552-22-0x0000000001C90000-0x0000000001CC0000-memory.dmp family_plugx behavioral1/memory/3064-26-0x0000000001C70000-0x0000000001CA0000-memory.dmp family_plugx behavioral1/memory/3064-27-0x0000000001C70000-0x0000000001CA0000-memory.dmp family_plugx behavioral1/memory/1244-33-0x0000000000210000-0x0000000000240000-memory.dmp family_plugx behavioral1/memory/1244-36-0x0000000000210000-0x0000000000240000-memory.dmp family_plugx behavioral1/memory/2264-47-0x0000000000300000-0x0000000000330000-memory.dmp family_plugx behavioral1/memory/1244-51-0x0000000000210000-0x0000000000240000-memory.dmp family_plugx behavioral1/memory/1244-52-0x0000000000210000-0x0000000000240000-memory.dmp family_plugx behavioral1/memory/1244-53-0x0000000000210000-0x0000000000240000-memory.dmp family_plugx behavioral1/memory/1244-57-0x0000000000210000-0x0000000000240000-memory.dmp family_plugx behavioral1/memory/1244-59-0x0000000000210000-0x0000000000240000-memory.dmp family_plugx behavioral1/memory/1244-58-0x0000000000210000-0x0000000000240000-memory.dmp family_plugx behavioral1/memory/2552-64-0x0000000001C90000-0x0000000001CC0000-memory.dmp family_plugx behavioral1/memory/1244-66-0x0000000000210000-0x0000000000240000-memory.dmp family_plugx behavioral1/memory/3036-77-0x0000000000420000-0x0000000000450000-memory.dmp family_plugx behavioral1/memory/3036-79-0x0000000000420000-0x0000000000450000-memory.dmp family_plugx behavioral1/memory/3036-80-0x0000000000420000-0x0000000000450000-memory.dmp family_plugx behavioral1/memory/1244-81-0x0000000000210000-0x0000000000240000-memory.dmp family_plugx behavioral1/memory/3036-83-0x0000000000420000-0x0000000000450000-memory.dmp family_plugx - Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Deletes itself 1 IoCs
pid Process 2552 Nv.exe - Executes dropped EXE 2 IoCs
pid Process 2552 Nv.exe 3064 Nv.exe - Loads dropped DLL 2 IoCs
pid Process 2552 Nv.exe 3064 Nv.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat svchost.exe - Modifies data under HKEY_USERS 33 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EBEE84DB-45DF-4703-AD8D-AB510DA632D1} svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-d9-22-a3-59-52\WpadDecisionReason = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EBEE84DB-45DF-4703-AD8D-AB510DA632D1}\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EBEE84DB-45DF-4703-AD8D-AB510DA632D1}\WpadDecisionTime = 300203b00b5bda01 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EBEE84DB-45DF-4703-AD8D-AB510DA632D1}\WpadDecision = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f004c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EBEE84DB-45DF-4703-AD8D-AB510DA632D1}\WpadNetworkName = "Network 3" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-d9-22-a3-59-52 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-d9-22-a3-59-52\WpadDecisionTime = 300203b00b5bda01 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EBEE84DB-45DF-4703-AD8D-AB510DA632D1}\96-d9-22-a3-59-52 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-d9-22-a3-59-52\WpadDecision = "0" svchost.exe - Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 35004400330039004300450036004300320044004200320034003000430045000000 svchost.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2264 Nv.exe 1244 svchost.exe 1244 svchost.exe 1244 svchost.exe 1244 svchost.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 1244 svchost.exe 1244 svchost.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 1244 svchost.exe 1244 svchost.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 1244 svchost.exe 1244 svchost.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 1244 svchost.exe 1244 svchost.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 3036 msiexec.exe 1244 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 1844 explorer.exe 1244 svchost.exe 3036 msiexec.exe - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 2264 Nv.exe Token: SeTcbPrivilege 2264 Nv.exe Token: SeShutdownPrivilege 1844 explorer.exe Token: SeShutdownPrivilege 1844 explorer.exe Token: SeShutdownPrivilege 1844 explorer.exe Token: SeShutdownPrivilege 1844 explorer.exe Token: SeShutdownPrivilege 1844 explorer.exe Token: SeShutdownPrivilege 1844 explorer.exe Token: SeShutdownPrivilege 1844 explorer.exe Token: SeShutdownPrivilege 1844 explorer.exe Token: SeShutdownPrivilege 1844 explorer.exe Token: SeShutdownPrivilege 1844 explorer.exe Token: SeDebugPrivilege 2552 Nv.exe Token: SeTcbPrivilege 2552 Nv.exe Token: SeDebugPrivilege 3064 Nv.exe Token: SeTcbPrivilege 3064 Nv.exe Token: SeDebugPrivilege 1244 svchost.exe Token: SeTcbPrivilege 1244 svchost.exe Token: SeShutdownPrivilege 1844 explorer.exe Token: SeShutdownPrivilege 1844 explorer.exe Token: SeDebugPrivilege 3036 msiexec.exe Token: SeTcbPrivilege 3036 msiexec.exe - Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe - Suspicious use of SendNotifyMessage 20 IoCs
pid Process 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe 1844 explorer.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3064 wrote to memory of 1244 3064 Nv.exe 33 PID 3064 wrote to memory of 1244 3064 Nv.exe 33 PID 3064 wrote to memory of 1244 3064 Nv.exe 33 PID 3064 wrote to memory of 1244 3064 Nv.exe 33 PID 3064 wrote to memory of 1244 3064 Nv.exe 33 PID 3064 wrote to memory of 1244 3064 Nv.exe 33 PID 3064 wrote to memory of 1244 3064 Nv.exe 33 PID 3064 wrote to memory of 1244 3064 Nv.exe 33 PID 3064 wrote to memory of 1244 3064 Nv.exe 33 PID 1244 wrote to memory of 3036 1244 svchost.exe 34 PID 1244 wrote to memory of 3036 1244 svchost.exe 34 PID 1244 wrote to memory of 3036 1244 svchost.exe 34 PID 1244 wrote to memory of 3036 1244 svchost.exe 34 PID 1244 wrote to memory of 3036 1244 svchost.exe 34 PID 1244 wrote to memory of 3036 1244 svchost.exe 34 PID 1244 wrote to memory of 3036 1244 svchost.exe 34 PID 1244 wrote to memory of 3036 1244 svchost.exe 34 PID 1244 wrote to memory of 3036 1244 svchost.exe 34 PID 1244 wrote to memory of 3036 1244 svchost.exe 34 PID 1244 wrote to memory of 3036 1244 svchost.exe 34 PID 1244 wrote to memory of 3036 1244 svchost.exe 34 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nv.exe"C:\Users\Admin\AppData\Local\Temp\Nv.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2264
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1844
-
C:\ProgramData\SxS\Nv.exe"C:\ProgramData\SxS\Nv.exe" 100 22641⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2552
-
C:\ProgramData\SxS\Nv.exe"C:\ProgramData\SxS\Nv.exe" 200 01⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 201 02⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 12443⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SxS\Nv.exe
- Size 46KB
- SHA256 523d28df917f9d265cd2c0d38df26277bc56a535145100ed82e6f5fdeaae7256
- MD5 09b8b54f78a10c435cd319070aa13c28
- SHA1 6474d0369f97e72e01e4971128d1062f5c2b3656
- SHA512 c1f2f5c4aa5eb55d255e22db032da954a38a0204fb4d9bc76042f140f1b1e171944aa09b0eb11159323a8b9f33974c73fd32a4f76d976aaa8a16cc9c60a34ca7
- SSDEEP 768:Ep+QDJgY/OTFStOWjmyPTc+6lye958TZLWMmSbC9X:Epj9IexPANL58TZaDaC9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\SxS\Nv.mp3
- Size 120KB
- SHA256 3d64e638f961b922398e2efaf75504da007e41ea979f213f8eb4f83e00efeebb
- MD5 5ef7c3bcbc11cd02c95e509b226eebe9
- SHA1 794a90212d226628c8ce4441c3418c1ecca0e3b8
- SHA512 c86f464f736125d8fb499efe2555cae1aea5d67fbf15be816883e058ad9107eb399d3ade6c5afe811a2eb59ebdc1d52c992124359fa26085a650eb940fe2eae4
- SSDEEP 3072:5QyNl7bAT+JbjClf00YM8SzR1hv0iuzFWC9FnbfztQ:XXAT6jClkao5WCrbC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\SxS\NvSmartMax.dll
- Size 20KB
- SHA256 eaaa7899b37a3b04dcd02ad6d51e83e035be535f129773621ef0f399a2a98ee3
- MD5 0b21678ed8e2b117344cfceba8f097dd
- SHA1 db53bb022cb6de016713f1570f2ae501f20f9c76
- SHA512 182268649b360f44f021570ddc9290f5051a8be556ffd66355bc325027ba48c5fe824e1bea925411bdaef4c17e0f3d81a1d3c710b59c4462540d567da625a41a
- SSDEEP 24:eFGSE+O1B+ibXvS1vFNFPitSa25Jyj3xrqhx4/:ief+BFCtSa25JySx4/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\SxS\bug.log
- Size 580B
- SHA256 0e2a70b42cf8cb93f65e8f27752aabd2d0658e0dd455162e491209a17be1cc93
- MD5 9230e75a18ecbce1fadb4ce5c1c2e3e8
- SHA1 9980064864d643359d0b07c20de2654012457bc9
- SHA512 93929484f474ca87eb52eeaad8a9f804476c95a474bc6133d8bbc1ad8ede72cd270c075d38d83f32e0b21dbda1cf1434007b502ca9f68f45bd609efda4adff58
- MD5 SHA1 SHA512
- Path C:\ProgramData\SxS\bug.log
- Size 742B
- SHA256 c800f04dc36438405633b0d31e9436112ab91259257ab2dafde5972df32eb9cc
- MD5 21c634af1bf3d773350db71d731ada18
- SHA1 945e75591427b27e196e1f861d0bf2550a889cab
- SHA512 62b6091be10c938af606e1221de9faad4769194ac133055079612b673e1ba119be8ea04069230dd8f06233519eb67da50fe9062e93bae111362c83c8ded33e70
- MD5 SHA1 SHA512