plugx | 4f7590d4268af785ccd289d634ff6074815e0835c9e6e45756d7b9f3c526b159

Analysis

max time kernel
149s
max time network
141s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cd11a2596c130a0428b7360d2be2f64_JaffaCakes118.exe
Size

320KB
MD5

4cd11a2596c130a0428b7360d2be2f64
SHA1

d0001afaf54b3a94f0f4bd1e2a80db56ee187d63
SHA256

4f7590d4268af785ccd289d634ff6074815e0835c9e6e45756d7b9f3c526b159
SHA512

799ddf76568e9d241070b94ca16fc2f50f872be48c50f4f97fef40b00fafba818a236664b7b68dda493ce214f35bb6592d459db14192376be085f10e67a3c962
SSDEEP

6144:7LsqHaNHt1Dw2KAQtluFrZVmPPK7B5072SwkqUGp:7gbVetlSZj5072SwkZ

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects PlugX payload 22 IoCs

resource	yara_rule
behavioral1/memory/1624-13-0x0000000000560000-0x000000000058D000-memory.dmp	family_plugx
behavioral1/memory/2608-32-0x00000000005F0000-0x000000000061D000-memory.dmp	family_plugx
behavioral1/memory/2620-35-0x0000000001C80000-0x0000000001CAD000-memory.dmp	family_plugx
behavioral1/memory/2620-42-0x0000000001C80000-0x0000000001CAD000-memory.dmp	family_plugx
behavioral1/memory/2764-45-0x0000000000200000-0x000000000022D000-memory.dmp	family_plugx
behavioral1/memory/2764-59-0x0000000000200000-0x000000000022D000-memory.dmp	family_plugx
behavioral1/memory/2764-58-0x0000000000200000-0x000000000022D000-memory.dmp	family_plugx
behavioral1/memory/2764-57-0x0000000000200000-0x000000000022D000-memory.dmp	family_plugx
behavioral1/memory/2764-56-0x0000000000200000-0x000000000022D000-memory.dmp	family_plugx
behavioral1/memory/2764-60-0x0000000000200000-0x000000000022D000-memory.dmp	family_plugx
behavioral1/memory/2764-44-0x0000000000200000-0x000000000022D000-memory.dmp	family_plugx
behavioral1/memory/1624-43-0x0000000000560000-0x000000000058D000-memory.dmp	family_plugx
behavioral1/memory/2764-61-0x0000000000200000-0x000000000022D000-memory.dmp	family_plugx
behavioral1/memory/2764-40-0x0000000000200000-0x000000000022D000-memory.dmp	family_plugx
behavioral1/memory/2764-62-0x0000000000200000-0x000000000022D000-memory.dmp	family_plugx
behavioral1/memory/2764-65-0x0000000000200000-0x000000000022D000-memory.dmp	family_plugx
behavioral1/memory/2608-66-0x00000000005F0000-0x000000000061D000-memory.dmp	family_plugx
behavioral1/memory/2972-75-0x0000000000360000-0x000000000038D000-memory.dmp	family_plugx
behavioral1/memory/2972-78-0x0000000000360000-0x000000000038D000-memory.dmp	family_plugx
behavioral1/memory/2972-77-0x0000000000360000-0x000000000038D000-memory.dmp	family_plugx
behavioral1/memory/2764-79-0x0000000000200000-0x000000000022D000-memory.dmp	family_plugx
behavioral1/memory/2764-85-0x0000000000200000-0x000000000022D000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx

Deletes itself 1 IoCs

pid	Process
1624	hc.exe

Executes dropped EXE 3 IoCs

pid	Process
1624	hc.exe
2608	hc.exe
2620	hc.exe

Loads dropped DLL 4 IoCs

pid	Process
1936	4cd11a2596c130a0428b7360d2be2f64_JaffaCakes118.exe
1624	hc.exe
2608	hc.exe
2620	hc.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-99-13-52-c7-4d\WpadDecisionReason = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-99-13-52-c7-4d\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E87A428-798C-4E5F-B890-657F5DAF008D}	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E87A428-798C-4E5F-B890-657F5DAF008D}\WpadDecisionTime = 60caa3c2cca7da01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-99-13-52-c7-4d	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E87A428-798C-4E5F-B890-657F5DAF008D}\fe-99-13-52-c7-4d	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-99-13-52-c7-4d\WpadDecisionTime = 60caa3c2cca7da01	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-99-13-52-c7-4d\WpadDetectedUrl	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E87A428-798C-4E5F-B890-657F5DAF008D}\WpadDecisionReason = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E87A428-798C-4E5F-B890-657F5DAF008D}\WpadDecision = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E87A428-798C-4E5F-B890-657F5DAF008D}\WpadNetworkName = "Network 3"	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 45004600430032003400420030003200380036003300360044003200380036000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1624	hc.exe
2764	svchost.exe
2764	svchost.exe
2764	svchost.exe
2764	svchost.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2764	svchost.exe
2764	svchost.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2764	svchost.exe
2764	svchost.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2764	svchost.exe
2764	svchost.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2764	svchost.exe
2764	svchost.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2972	msiexec.exe
2764	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2764	svchost.exe
2972	msiexec.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1624	hc.exe
Token: SeTcbPrivilege	1624	hc.exe
Token: SeDebugPrivilege	2608	hc.exe
Token: SeTcbPrivilege	2608	hc.exe
Token: SeDebugPrivilege	2620	hc.exe
Token: SeTcbPrivilege	2620	hc.exe
Token: SeDebugPrivilege	2764	svchost.exe
Token: SeTcbPrivilege	2764	svchost.exe
Token: SeDebugPrivilege	2972	msiexec.exe
Token: SeTcbPrivilege	2972	msiexec.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1624	1936	4cd11a2596c130a0428b7360d2be2f64_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1624	1936	4cd11a2596c130a0428b7360d2be2f64_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1624	1936	4cd11a2596c130a0428b7360d2be2f64_JaffaCakes118.exe	28
PID 1936 wrote to memory of 1624	1936	4cd11a2596c130a0428b7360d2be2f64_JaffaCakes118.exe	28
PID 2620 wrote to memory of 2764	2620	hc.exe	32
PID 2620 wrote to memory of 2764	2620	hc.exe	32
PID 2620 wrote to memory of 2764	2620	hc.exe	32
PID 2620 wrote to memory of 2764	2620	hc.exe	32
PID 2620 wrote to memory of 2764	2620	hc.exe	32
PID 2620 wrote to memory of 2764	2620	hc.exe	32
PID 2620 wrote to memory of 2764	2620	hc.exe	32
PID 2620 wrote to memory of 2764	2620	hc.exe	32
PID 2620 wrote to memory of 2764	2620	hc.exe	32
PID 2764 wrote to memory of 2972	2764	svchost.exe	34
PID 2764 wrote to memory of 2972	2764	svchost.exe	34
PID 2764 wrote to memory of 2972	2764	svchost.exe	34
PID 2764 wrote to memory of 2972	2764	svchost.exe	34
PID 2764 wrote to memory of 2972	2764	svchost.exe	34
PID 2764 wrote to memory of 2972	2764	svchost.exe	34
PID 2764 wrote to memory of 2972	2764	svchost.exe	34
PID 2764 wrote to memory of 2972	2764	svchost.exe	34
PID 2764 wrote to memory of 2972	2764	svchost.exe	34
PID 2764 wrote to memory of 2972	2764	svchost.exe	34
PID 2764 wrote to memory of 2972	2764	svchost.exe	34
PID 2764 wrote to memory of 2972	2764	svchost.exe	34

C:\Users\Admin\AppData\Local\Temp\4cd11a2596c130a0428b7360d2be2f64_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4cd11a2596c130a0428b7360d2be2f64_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\hc.exe
  C:\Users\Admin\AppData\Local\Temp\hc.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1624

C:\ProgramData\hkcmd\hc.exe
"C:\ProgramData\hkcmd\hc.exe" 100 1624
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\ProgramData\hkcmd\hc.exe
"C:\ProgramData\hkcmd\hc.exe" 200 0
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe 201 0
  2⤵
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\system32\msiexec.exe 209 2764
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hc.exe

Filesize
169KB

MD5
23f2c3dbdb65c898a11e7f4ddc598a10

SHA1
cd3cc620c55dba7eaeb77a4fde5833b4ca115e9c

SHA256
a67de1db8d5b8134e4ba468cbb38274d1b36d7ade8f80c58e680650c68149677

SHA512
0e854e276c146cf90cea6db254e9741650336f77c31290502073f5c78fb9c8f6d1afdc67b913cd736e2330556440534e7422bdc072b482a5cdc4a5addee10c3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\hccutils.DLL.res

Filesize
111KB

MD5
81693011cb717a15ad364a7344f8ffcf

SHA1
0e26b1b58c3a8f978874fd86762af11208999fb3

SHA256
01d5786b31dbb6855f089ae4569c40d5b99b4aed9462053358572898d797b6aa

SHA512
10ff4a7af7c8bd30b696ca1d2c9d3f7d29ed9a79f45264a0442d64cbc81a6e0945842c24d44e97a96a8db3686d9e00f9d0f73799e90620a74ed6ba7b58dded53

Download Submit
\Users\Admin\AppData\Local\Temp\hccutils.dll

Filesize
2KB

MD5
1dd363b3564929d0bc336571dec74cf0

SHA1
21c953538bba7749bcc3ce049b2df9df396bc2b7

SHA256
88ab31fb0d56ffe438f21fcce81a1df35554236ef2152c34b91bf5247ab35b7e

SHA512
0ba2583a5ea404cd4f6d5fb9b62ce590eb6244435d3a14586423e9ee7c116047fbb68d588f3e1ecee76d9dd7285805676f5f023baabe4bbdec34a5e754d9a70a

Download Submit
memory/1624-13-0x0000000000560000-0x000000000058D000-memory.dmp

Filesize
180KB

Download
memory/1624-12-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1624-11-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/1624-43-0x0000000000560000-0x000000000058D000-memory.dmp

Filesize
180KB

Download
memory/1936-0-0x0000000000080000-0x00000000000BA000-memory.dmp

Filesize
232KB

Download
memory/2608-31-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2608-32-0x00000000005F0000-0x000000000061D000-memory.dmp

Filesize
180KB

Download
memory/2608-66-0x00000000005F0000-0x000000000061D000-memory.dmp

Filesize
180KB

Download
memory/2620-42-0x0000000001C80000-0x0000000001CAD000-memory.dmp

Filesize
180KB

Download
memory/2620-35-0x0000000001C80000-0x0000000001CAD000-memory.dmp

Filesize
180KB

Download
memory/2764-58-0x0000000000200000-0x000000000022D000-memory.dmp

Filesize
180KB

Download
memory/2764-40-0x0000000000200000-0x000000000022D000-memory.dmp

Filesize
180KB

Download
memory/2764-59-0x0000000000200000-0x000000000022D000-memory.dmp

Filesize
180KB

Download
memory/2764-36-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2764-57-0x0000000000200000-0x000000000022D000-memory.dmp

Filesize
180KB

Download
memory/2764-56-0x0000000000200000-0x000000000022D000-memory.dmp

Filesize
180KB

Download
memory/2764-60-0x0000000000200000-0x000000000022D000-memory.dmp

Filesize
180KB

Download
memory/2764-55-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2764-44-0x0000000000200000-0x000000000022D000-memory.dmp

Filesize
180KB

Download
memory/2764-38-0x00000000000A0000-0x00000000000BB000-memory.dmp

Filesize
108KB

Download
memory/2764-61-0x0000000000200000-0x000000000022D000-memory.dmp

Filesize
180KB

Download
memory/2764-45-0x0000000000200000-0x000000000022D000-memory.dmp

Filesize
180KB

Download
memory/2764-41-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2764-62-0x0000000000200000-0x000000000022D000-memory.dmp

Filesize
180KB

Download
memory/2764-65-0x0000000000200000-0x000000000022D000-memory.dmp

Filesize
180KB

Download
memory/2764-39-0x00000000000C0000-0x00000000000C2000-memory.dmp

Filesize
8KB

Download
memory/2764-85-0x0000000000200000-0x000000000022D000-memory.dmp

Filesize
180KB

Download
memory/2764-79-0x0000000000200000-0x000000000022D000-memory.dmp

Filesize
180KB

Download
memory/2972-77-0x0000000000360000-0x000000000038D000-memory.dmp

Filesize
180KB

Download
memory/2972-76-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2972-78-0x0000000000360000-0x000000000038D000-memory.dmp

Filesize
180KB

Download
memory/2972-75-0x0000000000360000-0x000000000038D000-memory.dmp

Filesize
180KB

Download