plugx | 4f7590d4268af785ccd289d634ff6074815e0835c9e6e45756d7b9f3c526b159

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cd11a2596c130a0428b7360d2be2f64_JaffaCakes118.exe
Size

320KB
MD5

4cd11a2596c130a0428b7360d2be2f64
SHA1

d0001afaf54b3a94f0f4bd1e2a80db56ee187d63
SHA256

4f7590d4268af785ccd289d634ff6074815e0835c9e6e45756d7b9f3c526b159
SHA512

799ddf76568e9d241070b94ca16fc2f50f872be48c50f4f97fef40b00fafba818a236664b7b68dda493ce214f35bb6592d459db14192376be085f10e67a3c962
SSDEEP

6144:7LsqHaNHt1Dw2KAQtluFrZVmPPK7B5072SwkqUGp:7gbVetlSZj5072SwkZ

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects PlugX payload 22 IoCs

resource	yara_rule
behavioral2/memory/60-12-0x0000000001F60000-0x0000000001F8D000-memory.dmp	family_plugx
behavioral2/memory/4116-30-0x0000000002190000-0x00000000021BD000-memory.dmp	family_plugx
behavioral2/memory/1340-35-0x0000000000C60000-0x0000000000C8D000-memory.dmp	family_plugx
behavioral2/memory/1340-37-0x0000000000C60000-0x0000000000C8D000-memory.dmp	family_plugx
behavioral2/memory/228-36-0x0000000000EB0000-0x0000000000EDD000-memory.dmp	family_plugx
behavioral2/memory/228-50-0x0000000000EB0000-0x0000000000EDD000-memory.dmp	family_plugx
behavioral2/memory/228-53-0x0000000000EB0000-0x0000000000EDD000-memory.dmp	family_plugx
behavioral2/memory/60-54-0x0000000001F60000-0x0000000001F8D000-memory.dmp	family_plugx
behavioral2/memory/228-58-0x0000000000EB0000-0x0000000000EDD000-memory.dmp	family_plugx
behavioral2/memory/228-57-0x0000000000EB0000-0x0000000000EDD000-memory.dmp	family_plugx
behavioral2/memory/228-56-0x0000000000EB0000-0x0000000000EDD000-memory.dmp	family_plugx
behavioral2/memory/228-55-0x0000000000EB0000-0x0000000000EDD000-memory.dmp	family_plugx
behavioral2/memory/228-52-0x0000000000EB0000-0x0000000000EDD000-memory.dmp	family_plugx
behavioral2/memory/228-49-0x0000000000EB0000-0x0000000000EDD000-memory.dmp	family_plugx
behavioral2/memory/228-38-0x0000000000EB0000-0x0000000000EDD000-memory.dmp	family_plugx
behavioral2/memory/228-61-0x0000000000EB0000-0x0000000000EDD000-memory.dmp	family_plugx
behavioral2/memory/4116-62-0x0000000002190000-0x00000000021BD000-memory.dmp	family_plugx
behavioral2/memory/4604-63-0x00000000025D0000-0x00000000025FD000-memory.dmp	family_plugx
behavioral2/memory/4604-66-0x00000000025D0000-0x00000000025FD000-memory.dmp	family_plugx
behavioral2/memory/4604-65-0x00000000025D0000-0x00000000025FD000-memory.dmp	family_plugx
behavioral2/memory/228-67-0x0000000000EB0000-0x0000000000EDD000-memory.dmp	family_plugx
behavioral2/memory/228-74-0x0000000000EB0000-0x0000000000EDD000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx

Deletes itself 1 IoCs

pid	Process
60	hc.exe

Executes dropped EXE 3 IoCs

pid	Process
60	hc.exe
4116	hc.exe
1340	hc.exe

Loads dropped DLL 3 IoCs

pid	Process
60	hc.exe
4116	hc.exe
1340	hc.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 34003200320038004600340042004300360039003200360032004500460034000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
60	hc.exe
60	hc.exe
228	svchost.exe
228	svchost.exe
228	svchost.exe
228	svchost.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
228	svchost.exe
228	svchost.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
228	svchost.exe
228	svchost.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
228	svchost.exe
228	svchost.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
228	svchost.exe
228	svchost.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe
4604	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
228	svchost.exe
4604	msiexec.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	60	hc.exe
Token: SeTcbPrivilege	60	hc.exe
Token: SeDebugPrivilege	4116	hc.exe
Token: SeTcbPrivilege	4116	hc.exe
Token: SeDebugPrivilege	1340	hc.exe
Token: SeTcbPrivilege	1340	hc.exe
Token: SeDebugPrivilege	228	svchost.exe
Token: SeTcbPrivilege	228	svchost.exe
Token: SeDebugPrivilege	4604	msiexec.exe
Token: SeTcbPrivilege	4604	msiexec.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 60	852	4cd11a2596c130a0428b7360d2be2f64_JaffaCakes118.exe	83
PID 852 wrote to memory of 60	852	4cd11a2596c130a0428b7360d2be2f64_JaffaCakes118.exe	83
PID 852 wrote to memory of 60	852	4cd11a2596c130a0428b7360d2be2f64_JaffaCakes118.exe	83
PID 1340 wrote to memory of 228	1340	hc.exe	90
PID 1340 wrote to memory of 228	1340	hc.exe	90
PID 1340 wrote to memory of 228	1340	hc.exe	90
PID 1340 wrote to memory of 228	1340	hc.exe	90
PID 1340 wrote to memory of 228	1340	hc.exe	90
PID 1340 wrote to memory of 228	1340	hc.exe	90
PID 1340 wrote to memory of 228	1340	hc.exe	90
PID 1340 wrote to memory of 228	1340	hc.exe	90
PID 228 wrote to memory of 4604	228	svchost.exe	98
PID 228 wrote to memory of 4604	228	svchost.exe	98
PID 228 wrote to memory of 4604	228	svchost.exe	98
PID 228 wrote to memory of 4604	228	svchost.exe	98
PID 228 wrote to memory of 4604	228	svchost.exe	98
PID 228 wrote to memory of 4604	228	svchost.exe	98
PID 228 wrote to memory of 4604	228	svchost.exe	98
PID 228 wrote to memory of 4604	228	svchost.exe	98

C:\Users\Admin\AppData\Local\Temp\4cd11a2596c130a0428b7360d2be2f64_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4cd11a2596c130a0428b7360d2be2f64_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Users\Admin\AppData\Local\Temp\hc.exe
  C:\Users\Admin\AppData\Local\Temp\hc.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:60

C:\ProgramData\hkcmd\hc.exe
"C:\ProgramData\hkcmd\hc.exe" 100 60
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4116

C:\ProgramData\hkcmd\hc.exe
"C:\ProgramData\hkcmd\hc.exe" 200 0
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe 201 0
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\system32\msiexec.exe 209 228
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:4604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hc.exe

Filesize
169KB

MD5
23f2c3dbdb65c898a11e7f4ddc598a10

SHA1
cd3cc620c55dba7eaeb77a4fde5833b4ca115e9c

SHA256
a67de1db8d5b8134e4ba468cbb38274d1b36d7ade8f80c58e680650c68149677

SHA512
0e854e276c146cf90cea6db254e9741650336f77c31290502073f5c78fb9c8f6d1afdc67b913cd736e2330556440534e7422bdc072b482a5cdc4a5addee10c3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\hccutils.DLL.res

Filesize
111KB

MD5
81693011cb717a15ad364a7344f8ffcf

SHA1
0e26b1b58c3a8f978874fd86762af11208999fb3

SHA256
01d5786b31dbb6855f089ae4569c40d5b99b4aed9462053358572898d797b6aa

SHA512
10ff4a7af7c8bd30b696ca1d2c9d3f7d29ed9a79f45264a0442d64cbc81a6e0945842c24d44e97a96a8db3686d9e00f9d0f73799e90620a74ed6ba7b58dded53

Download Submit
C:\Users\Admin\AppData\Local\Temp\hccutils.dll

Filesize
2KB

MD5
1dd363b3564929d0bc336571dec74cf0

SHA1
21c953538bba7749bcc3ce049b2df9df396bc2b7

SHA256
88ab31fb0d56ffe438f21fcce81a1df35554236ef2152c34b91bf5247ab35b7e

SHA512
0ba2583a5ea404cd4f6d5fb9b62ce590eb6244435d3a14586423e9ee7c116047fbb68d588f3e1ecee76d9dd7285805676f5f023baabe4bbdec34a5e754d9a70a

Download Submit
memory/60-54-0x0000000001F60000-0x0000000001F8D000-memory.dmp

Filesize
180KB

Download
memory/60-11-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/60-10-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/60-12-0x0000000001F60000-0x0000000001F8D000-memory.dmp

Filesize
180KB

Download
memory/228-61-0x0000000000EB0000-0x0000000000EDD000-memory.dmp

Filesize
180KB

Download
memory/228-52-0x0000000000EB0000-0x0000000000EDD000-memory.dmp

Filesize
180KB

Download
memory/228-74-0x0000000000EB0000-0x0000000000EDD000-memory.dmp

Filesize
180KB

Download
memory/228-67-0x0000000000EB0000-0x0000000000EDD000-memory.dmp

Filesize
180KB

Download
memory/228-51-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/228-36-0x0000000000EB0000-0x0000000000EDD000-memory.dmp

Filesize
180KB

Download
memory/228-50-0x0000000000EB0000-0x0000000000EDD000-memory.dmp

Filesize
180KB

Download
memory/228-53-0x0000000000EB0000-0x0000000000EDD000-memory.dmp

Filesize
180KB

Download
memory/228-38-0x0000000000EB0000-0x0000000000EDD000-memory.dmp

Filesize
180KB

Download
memory/228-58-0x0000000000EB0000-0x0000000000EDD000-memory.dmp

Filesize
180KB

Download
memory/228-57-0x0000000000EB0000-0x0000000000EDD000-memory.dmp

Filesize
180KB

Download
memory/228-56-0x0000000000EB0000-0x0000000000EDD000-memory.dmp

Filesize
180KB

Download
memory/228-55-0x0000000000EB0000-0x0000000000EDD000-memory.dmp

Filesize
180KB

Download
memory/228-49-0x0000000000EB0000-0x0000000000EDD000-memory.dmp

Filesize
180KB

Download
memory/852-4-0x0000000000FB0000-0x0000000000FEA000-memory.dmp

Filesize
232KB

Download
memory/1340-37-0x0000000000C60000-0x0000000000C8D000-memory.dmp

Filesize
180KB

Download
memory/1340-34-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1340-35-0x0000000000C60000-0x0000000000C8D000-memory.dmp

Filesize
180KB

Download
memory/4116-31-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/4116-30-0x0000000002190000-0x00000000021BD000-memory.dmp

Filesize
180KB

Download
memory/4116-62-0x0000000002190000-0x00000000021BD000-memory.dmp

Filesize
180KB

Download
memory/4604-63-0x00000000025D0000-0x00000000025FD000-memory.dmp

Filesize
180KB

Download
memory/4604-66-0x00000000025D0000-0x00000000025FD000-memory.dmp

Filesize
180KB

Download
memory/4604-65-0x00000000025D0000-0x00000000025FD000-memory.dmp

Filesize
180KB

Download
memory/4604-64-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/4604-69-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download