Malware Analysis Report

2024-07-11 07:36

Sample ID 240607-jyx6paeb69
Target PS.zip
SHA256 0187a11496437b76b2401bc6136432547b6bcdaca30f2b7d16e4d39f47d5c3ee
Tags
plugx trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0187a11496437b76b2401bc6136432547b6bcdaca30f2b7d16e4d39f47d5c3ee

Threat Level: Known bad

The file PS.zip was found to be: Known bad.

Malicious Activity Summary

plugx trojan

PlugX

Detects PlugX payload

Loads dropped DLL

Executes dropped EXE

Deletes itself

Drops file in System32 directory

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Modifies data under HKEY_USERS

Modifies registry class

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-07 08:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-07 08:05

Reported

2024-06-07 08:24

Platform

win7-20240419-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PS\RsTray.exe"

Signatures

Detects PlugX payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

PlugX

trojan plugx

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\PS\RsTray.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\ProgramData\PS\RsTray.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{10A52142-7252-451C-97D7-325E0A5C3C76}\WpadDecisionReason = "1" C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{10A52142-7252-451C-97D7-325E0A5C3C76}\WpadDecisionTime = 00c846f8b3b8da01 C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{10A52142-7252-451C-97D7-325E0A5C3C76}\WpadDecision = "0" C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{10A52142-7252-451C-97D7-325E0A5C3C76}\WpadNetworkName = "Network 3" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-8f-56-e4-0d-35 C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{10A52142-7252-451C-97D7-325E0A5C3C76}\86-8f-56-e4-0d-35 C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-8f-56-e4-0d-35\WpadDecisionTime = 00c846f8b3b8da01 C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-8f-56-e4-0d-35\WpadDetectedUrl C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-8f-56-e4-0d-35\WpadDecisionReason = "1" C:\Windows\SysWOW64\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-8f-56-e4-0d-35\WpadDecision = "0" C:\Windows\SysWOW64\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{10A52142-7252-451C-97D7-325E0A5C3C76} C:\Windows\SysWOW64\svchost.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\CLASSES\FAST C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 34003800360043003800370044004200370043003300390037004400370030000000 C:\Windows\SysWOW64\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PS\RsTray.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PS\RsTray.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\PS\RsTray.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\PS\RsTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2596 wrote to memory of 2668 N/A C:\ProgramData\PS\RsTray.exe C:\Windows\SysWOW64\svchost.exe
PID 2596 wrote to memory of 2668 N/A C:\ProgramData\PS\RsTray.exe C:\Windows\SysWOW64\svchost.exe
PID 2596 wrote to memory of 2668 N/A C:\ProgramData\PS\RsTray.exe C:\Windows\SysWOW64\svchost.exe
PID 2596 wrote to memory of 2668 N/A C:\ProgramData\PS\RsTray.exe C:\Windows\SysWOW64\svchost.exe
PID 2596 wrote to memory of 2668 N/A C:\ProgramData\PS\RsTray.exe C:\Windows\SysWOW64\svchost.exe
PID 2596 wrote to memory of 2668 N/A C:\ProgramData\PS\RsTray.exe C:\Windows\SysWOW64\svchost.exe
PID 2596 wrote to memory of 2668 N/A C:\ProgramData\PS\RsTray.exe C:\Windows\SysWOW64\svchost.exe
PID 2596 wrote to memory of 2668 N/A C:\ProgramData\PS\RsTray.exe C:\Windows\SysWOW64\svchost.exe
PID 2596 wrote to memory of 2668 N/A C:\ProgramData\PS\RsTray.exe C:\Windows\SysWOW64\svchost.exe
PID 2668 wrote to memory of 2968 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2668 wrote to memory of 2968 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2668 wrote to memory of 2968 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2668 wrote to memory of 2968 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2668 wrote to memory of 2968 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2668 wrote to memory of 2968 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2668 wrote to memory of 2968 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2668 wrote to memory of 2968 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2668 wrote to memory of 2968 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2668 wrote to memory of 2968 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2668 wrote to memory of 2968 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 2668 wrote to memory of 2968 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PS\RsTray.exe

"C:\Users\Admin\AppData\Local\Temp\PS\RsTray.exe"

C:\ProgramData\PS\RsTray.exe

C:\ProgramData\PS\RsTray.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\system32\svchost.exe 201 0

C:\Windows\SysWOW64\msiexec.exe

C:\Windows\system32\msiexec.exe 209 2668

Network

Country Destination Domain Proto
N/A 10.127.255.255:53 udp
US 192.225.226.217:80 tcp
US 192.225.226.217:80 udp
US 192.225.226.217:443 tcp
US 192.225.226.217:443 udp
US 8.8.8.8:53 safer.ddns.us udp
US 204.16.169.54:80 safer.ddns.us tcp
US 8.8.8.8:53 safer.ddns.us udp
US 204.16.169.54:80 safer.ddns.us tcp
US 8.8.8.8:53 safer.ddns.us udp
US 204.16.169.54:80 safer.ddns.us udp
US 192.225.226.217:80 tcp
US 192.225.226.217:80 udp
US 192.225.226.217:443 tcp

Files

memory/1860-0-0x0000000001BD0000-0x0000000001C01000-memory.dmp

memory/1860-1-0x0000000001DA0000-0x0000000001EA0000-memory.dmp

memory/1860-2-0x0000000001BD0000-0x0000000001C01000-memory.dmp

C:\ProgramData\PS\RsTray.exe

MD5 d65adc7ad95e88fab486707b8c228f17
SHA1 dfa0589b58a469e34695a22313d184e5352a3282
SHA256 a3674fef407c354e911a8a6c7d4b991802c47cf6409d6dc32dc84be6312159e2
SHA512 3c9114610dfc107adec6a6220356607c737499866eba965985bb1f6b9aedbfae529a5432abb8307ce0653580fab9c2580c66d96ef4cdb4319a0fde5ad3c3ac01

memory/2596-19-0x00000000002D0000-0x0000000000301000-memory.dmp

C:\ProgramData\SxS\bug.log

MD5 48e717b992505b897b10a6493d488a67
SHA1 dbaa8b7d7f1b86f207d00c094da1d106bc5749b4
SHA256 4313500e273b5af1e38019be9a4b695e82b16a4379306d941031d16ade7da78b
SHA512 272517067aa83cc3707a9652b4608b44c33f6a7ec1d0fc79b57ecdf1ff241e99d83cb8282234798040f8c10889bbb4a7578a43bef94d1a4a560334b23d7a0b1b

memory/2668-53-0x0000000000170000-0x00000000001A1000-memory.dmp

memory/2668-49-0x0000000000170000-0x00000000001A1000-memory.dmp

memory/2668-47-0x0000000000170000-0x00000000001A1000-memory.dmp

memory/2668-48-0x0000000000170000-0x00000000001A1000-memory.dmp

memory/2668-46-0x0000000000020000-0x0000000000021000-memory.dmp

memory/2668-36-0x0000000000170000-0x00000000001A1000-memory.dmp

memory/2668-28-0x0000000000170000-0x00000000001A1000-memory.dmp

memory/2668-27-0x0000000000080000-0x0000000000081000-memory.dmp

memory/2668-25-0x0000000000170000-0x00000000001A1000-memory.dmp

memory/2668-24-0x00000000000C0000-0x00000000000C2000-memory.dmp

memory/2668-23-0x00000000000A0000-0x00000000000BD000-memory.dmp

memory/2668-21-0x0000000000080000-0x0000000000081000-memory.dmp

memory/2596-20-0x00000000002D0000-0x0000000000301000-memory.dmp

C:\ProgramData\PS\comserv.dll.url

MD5 fe14ef97d52c1c4f4764c36b76f18340
SHA1 60a931c6607ffe7dabdce33151f7d217b7581175
SHA256 d8c68c81908ca0b31a773cf78bc59b9d886ba72177b2b4f5a1d9ea46b95ce05e
SHA512 390366a82817d8e841084744cd879bd7be6ce1dff85e26e9fe4739b709c17718c4e836f2f543c1d84f47096230e2d9dbc6dab6c597acc8ae802c43b1d4ae7f0d

\ProgramData\PS\comserv.dll

MD5 6d54b4f07a1b92bd6fafe7160b2c887c
SHA1 6bf4a36e729a2c4156b1280db97252ba8ea7d9b4
SHA256 653fe0ab7b634e50ba09f962c6357bcf76ce633768aa41dd01d1a93ef83a0a54
SHA512 32c57ca7ce437fc7712948a6f30733112830ff570d89ca903e5a5bdec43277a19a453df8c027e0835ad1dff2f7927cf973e33efa1847ed608cb6eb534d8163a3

memory/2968-65-0x0000000000280000-0x00000000002B1000-memory.dmp

memory/2968-69-0x0000000000090000-0x0000000000091000-memory.dmp

memory/2968-70-0x0000000000280000-0x00000000002B1000-memory.dmp

C:\ProgramData\SxS\bug.log

MD5 99ed45c2dedcc034e8093db5f4562987
SHA1 42c4d48f9121137f65dec2619ac989e9c422c8d7
SHA256 b20534160b5ac3d35f869db10b353cc080d72f62f9ab16ae9c2872a508c45990
SHA512 06f80cf625f0c7abf06ef6f2ad1d57208a02b228ea5d40afdecd462ae994c7bf3d2f8bb580a7364307e5cec841984b4efc69474db29297e9b50a2c9a0866174d

memory/2968-72-0x0000000000280000-0x00000000002B1000-memory.dmp

memory/2968-71-0x0000000000280000-0x00000000002B1000-memory.dmp

memory/2668-73-0x0000000000170000-0x00000000001A1000-memory.dmp

memory/2968-74-0x0000000000280000-0x00000000002B1000-memory.dmp

C:\ProgramData\SxS\bug.log

MD5 0fd31cef7732e6d7c37a01967b763664
SHA1 f521103585ad1e0ed32e7c6fb4366dd26eb14db3
SHA256 3b5b603f3d4ce5b588599063dc259b2d3e35fb6dd08593a77d8787f0d61a9c99
SHA512 34dab61adcfbcdfe87ae924e260327e369bbaea5def715e69f722b8351816eaa82f100d945a0b2faba24ee0b23abf372dec8f42764a47ae127c4e5709f4917d9

memory/2668-77-0x0000000000170000-0x00000000001A1000-memory.dmp

memory/2668-78-0x0000000000170000-0x00000000001A1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-07 08:05

Reported

2024-06-07 08:24

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PS\RsTray.exe"

Signatures

Detects PlugX payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

PlugX

trojan plugx

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\PS\RsTray.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\ProgramData\PS\RsTray.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies C:\Windows\SysWOW64\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 C:\Windows\SysWOW64\svchost.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\CLASSES\FAST C:\Windows\SysWOW64\svchost.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 41004200460030004200340031003700390038003000310039004200360044000000 C:\Windows\SysWOW64\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PS\RsTray.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PS\RsTray.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\PS\RsTray.exe N/A
Token: SeTcbPrivilege N/A C:\ProgramData\PS\RsTray.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4608 wrote to memory of 1384 N/A C:\ProgramData\PS\RsTray.exe C:\Windows\SysWOW64\svchost.exe
PID 4608 wrote to memory of 1384 N/A C:\ProgramData\PS\RsTray.exe C:\Windows\SysWOW64\svchost.exe
PID 4608 wrote to memory of 1384 N/A C:\ProgramData\PS\RsTray.exe C:\Windows\SysWOW64\svchost.exe
PID 4608 wrote to memory of 1384 N/A C:\ProgramData\PS\RsTray.exe C:\Windows\SysWOW64\svchost.exe
PID 4608 wrote to memory of 1384 N/A C:\ProgramData\PS\RsTray.exe C:\Windows\SysWOW64\svchost.exe
PID 4608 wrote to memory of 1384 N/A C:\ProgramData\PS\RsTray.exe C:\Windows\SysWOW64\svchost.exe
PID 4608 wrote to memory of 1384 N/A C:\ProgramData\PS\RsTray.exe C:\Windows\SysWOW64\svchost.exe
PID 4608 wrote to memory of 1384 N/A C:\ProgramData\PS\RsTray.exe C:\Windows\SysWOW64\svchost.exe
PID 1384 wrote to memory of 3596 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 1384 wrote to memory of 3596 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 1384 wrote to memory of 3596 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 1384 wrote to memory of 3596 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 1384 wrote to memory of 3596 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 1384 wrote to memory of 3596 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 1384 wrote to memory of 3596 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe
PID 1384 wrote to memory of 3596 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\msiexec.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PS\RsTray.exe

"C:\Users\Admin\AppData\Local\Temp\PS\RsTray.exe"

C:\ProgramData\PS\RsTray.exe

C:\ProgramData\PS\RsTray.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\system32\svchost.exe 201 0

C:\Windows\SysWOW64\msiexec.exe

C:\Windows\system32\msiexec.exe 209 1384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4444 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 192.225.226.217:80 tcp
N/A 10.127.255.255:53 udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 192.225.226.217:80 udp
US 8.8.8.8:53 217.226.225.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 192.225.226.217:443 tcp
US 192.225.226.217:443 udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
N/A 255.255.255.255:53 safer.ddns.us udp
US 8.8.8.8:53 safer.ddns.us udp
US 204.16.169.54:80 safer.ddns.us tcp
US 8.8.8.8:53 54.169.16.204.in-addr.arpa udp
US 8.8.8.8:53 safer.ddns.us udp
US 204.16.169.54:80 safer.ddns.us tcp
N/A 255.255.255.255:53 safer.ddns.us udp
US 204.16.169.54:80 safer.ddns.us udp
US 192.225.226.217:80 tcp
US 8.8.8.8:53 3.17.178.52.in-addr.arpa udp

Files

memory/4544-0-0x00000000023D0000-0x00000000024D0000-memory.dmp

memory/4544-1-0x0000000002370000-0x00000000023A1000-memory.dmp

C:\ProgramData\PS\RsTray.exe

MD5 d65adc7ad95e88fab486707b8c228f17
SHA1 dfa0589b58a469e34695a22313d184e5352a3282
SHA256 a3674fef407c354e911a8a6c7d4b991802c47cf6409d6dc32dc84be6312159e2
SHA512 3c9114610dfc107adec6a6220356607c737499866eba965985bb1f6b9aedbfae529a5432abb8307ce0653580fab9c2580c66d96ef4cdb4319a0fde5ad3c3ac01

memory/4608-20-0x0000000000EC0000-0x0000000000EF1000-memory.dmp

memory/4608-21-0x0000000000EC0000-0x0000000000EF1000-memory.dmp

memory/1384-22-0x00000000012B0000-0x00000000012B1000-memory.dmp

C:\ProgramData\SxS\bug.log

MD5 cab1030b85f438b749d33334e1624a03
SHA1 31f1a8876c89a2f48816484d09ba4960bc765e75
SHA256 2d8550569f70e7e0ffdd4ba8812ccd25679c61982ddcc2c2c03bb0bd97f8ac3f
SHA512 91aa0ddf8d5608c3ed053b5be4a6acaa22ea84fbfd0fbd402368c95eef599fda59c76044ddca2109e882ca4cfca95e97921c88aae6502c0fc3bdd5d4e9434cac

C:\ProgramData\SxS\bug.log

MD5 dfdd5077a93daf1cfd379fda3f3e86ea
SHA1 47c50616142294c15c09af1a0d46c5228efe9b42
SHA256 ef4b98828942947c0ad2fbc3f0805fc617d20323acd8a3f5ec391e4b94e70b0c
SHA512 7b9d7a0073e170bc8a441de14dafa3cc62e5a313752602ce3451e80a0688d415c5cdd08131dbc50870e4a0232edb8ee9e575120048672ac0e98c9d4c70402720

memory/4544-29-0x0000000002370000-0x00000000023A1000-memory.dmp

memory/1384-25-0x0000000001950000-0x0000000001981000-memory.dmp

memory/1384-23-0x0000000001950000-0x0000000001981000-memory.dmp

C:\ProgramData\PS\comserv.dll.url

MD5 fe14ef97d52c1c4f4764c36b76f18340
SHA1 60a931c6607ffe7dabdce33151f7d217b7581175
SHA256 d8c68c81908ca0b31a773cf78bc59b9d886ba72177b2b4f5a1d9ea46b95ce05e
SHA512 390366a82817d8e841084744cd879bd7be6ce1dff85e26e9fe4739b709c17718c4e836f2f543c1d84f47096230e2d9dbc6dab6c597acc8ae802c43b1d4ae7f0d

C:\ProgramData\PS\comserv.dll

MD5 6d54b4f07a1b92bd6fafe7160b2c887c
SHA1 6bf4a36e729a2c4156b1280db97252ba8ea7d9b4
SHA256 653fe0ab7b634e50ba09f962c6357bcf76ce633768aa41dd01d1a93ef83a0a54
SHA512 32c57ca7ce437fc7712948a6f30733112830ff570d89ca903e5a5bdec43277a19a453df8c027e0835ad1dff2f7927cf973e33efa1847ed608cb6eb534d8163a3

memory/1384-32-0x0000000001950000-0x0000000001981000-memory.dmp

memory/1384-42-0x00000000012B0000-0x00000000012B1000-memory.dmp

memory/1384-45-0x0000000001950000-0x0000000001981000-memory.dmp

memory/1384-44-0x0000000001950000-0x0000000001981000-memory.dmp

memory/1384-43-0x0000000001950000-0x0000000001981000-memory.dmp

memory/1384-48-0x0000000001950000-0x0000000001981000-memory.dmp

memory/1384-49-0x0000000001950000-0x0000000001981000-memory.dmp

memory/1384-50-0x0000000001950000-0x0000000001981000-memory.dmp

memory/3596-53-0x00000000008D0000-0x00000000008D1000-memory.dmp

memory/3596-54-0x0000000000CF0000-0x0000000000D21000-memory.dmp

memory/3596-60-0x0000000000CF0000-0x0000000000D21000-memory.dmp

memory/3596-59-0x0000000000CF0000-0x0000000000D21000-memory.dmp

memory/3596-61-0x0000000000CF0000-0x0000000000D21000-memory.dmp

memory/3596-58-0x0000000000C50000-0x0000000000C51000-memory.dmp

C:\ProgramData\SxS\bug.log

MD5 0e6e4d8a8d7ed00222fd3deeab9ae21b
SHA1 ce707d0721d176105ced1b08514bb843e6abefe4
SHA256 bbaf761291721b487931e952be62783ba173ec0e89ccfaa5d843b45a566c326b
SHA512 e3570722da09145c9bc992c93a89014b5fbe5e6508f544fb00f8fc03ed12f22f79b1b14cd03ffdaf6fe54436a4e0f89f32c9867b0706cb1f4269ddc755e5eba3

memory/1384-62-0x0000000001950000-0x0000000001981000-memory.dmp

memory/3596-63-0x0000000000CF0000-0x0000000000D21000-memory.dmp

C:\ProgramData\SxS\bug.log

MD5 23b004f3a2c80a0d70e4b5a24e30f11e
SHA1 8711482e55be263c514a87dd3b2032004dc91103
SHA256 d55c46b2ea7a968188e4af3600d51edb4be781d4658383a3aba01e8e2f09353b
SHA512 dea718c9e3cd63552dfba826a3fe614083c51a87006e25ea71ebd61e507e1e1a5321ed7f059669d7a6e277f8dd268477ba632a676cfd4d463610f63b38dd3166

memory/1384-66-0x0000000001950000-0x0000000001981000-memory.dmp

memory/1384-67-0x0000000001950000-0x0000000001981000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-07 08:05

Reported

2024-06-07 08:24

Platform

win7-20240220-en

Max time kernel

119s

Max time network

121s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\PS\comserv.dll

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2240 wrote to memory of 2252 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2240 wrote to memory of 2252 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2240 wrote to memory of 2252 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2240 wrote to memory of 2252 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2240 wrote to memory of 2252 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2240 wrote to memory of 2252 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2240 wrote to memory of 2252 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\PS\comserv.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\PS\comserv.dll

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-07 08:05

Reported

2024-06-07 08:24

Platform

win10v2004-20240426-en

Max time kernel

90s

Max time network

138s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\PS\comserv.dll

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1576 wrote to memory of 3040 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1576 wrote to memory of 3040 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1576 wrote to memory of 3040 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\PS\comserv.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\PS\comserv.dll

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-07 08:05

Reported

2024-06-07 08:24

Platform

win7-20240221-en

Max time kernel

120s

Max time network

120s

Command Line

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\PS\comserv.dll.url

Signatures

N/A

Processes

C:\Windows\System32\rundll32.exe

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\PS\comserv.dll.url

Network

N/A

Files

memory/2028-0-0x00000000001E0000-0x00000000001E1000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-07 08:05

Reported

2024-06-07 08:24

Platform

win10v2004-20240508-en

Max time kernel

94s

Max time network

95s

Command Line

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\PS\comserv.dll.url

Signatures

N/A

Processes

C:\Windows\System32\rundll32.exe

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\PS\comserv.dll.url

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

N/A