plugx | 677cbeea7c87e4e03da87d71137897b200e2b0170950ddc958a72c09674b1685

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe
Size

308KB
MD5

4a076785e9786324bb852dd5bc27f10b
SHA1

c6be8931dc7cdbea53c324f76e7f950996b3f26d
SHA256

677cbeea7c87e4e03da87d71137897b200e2b0170950ddc958a72c09674b1685
SHA512

30e543bebfc0a92fc4b8a946e1fb99abd2792951c91bd62911771e4db2a23eed4e598edb14fdc96abf7b6222b75320d98397b4923c808b98eed01212be0ed38f
SSDEEP

6144:J3fJkqmWbIu2Zj5BIqJRlBzJwAXBOGOM:JdbIuETZRvxBQ

Score

10^/10

plugx persistence trojan

Malware Config

Signatures

Detects PlugX payload 23 IoCs

resource	yara_rule
behavioral2/memory/4568-1-0x0000000002310000-0x000000000233E000-memory.dmp	family_plugx
behavioral2/memory/4568-4-0x00000000024C0000-0x00000000024EE000-memory.dmp	family_plugx
behavioral2/memory/4568-3-0x0000000002310000-0x000000000233E000-memory.dmp	family_plugx
behavioral2/memory/4568-2-0x00000000024C0000-0x00000000024EE000-memory.dmp	family_plugx
behavioral2/memory/2200-20-0x0000000000ED0000-0x0000000000EFE000-memory.dmp	family_plugx
behavioral2/memory/2200-26-0x0000000000ED0000-0x0000000000EFE000-memory.dmp	family_plugx
behavioral2/memory/4568-27-0x00000000024C0000-0x00000000024EE000-memory.dmp	family_plugx
behavioral2/memory/3868-25-0x0000000001380000-0x00000000013AE000-memory.dmp	family_plugx
behavioral2/memory/3868-23-0x0000000001380000-0x00000000013AE000-memory.dmp	family_plugx
behavioral2/memory/2200-21-0x0000000000ED0000-0x0000000000EFE000-memory.dmp	family_plugx
behavioral2/memory/2200-7-0x0000000000ED0000-0x0000000000EFE000-memory.dmp	family_plugx
behavioral2/memory/2200-19-0x0000000000ED0000-0x0000000000EFE000-memory.dmp	family_plugx
behavioral2/memory/3868-12-0x0000000001380000-0x00000000013AE000-memory.dmp	family_plugx
behavioral2/memory/2200-6-0x0000000000ED0000-0x0000000000EFE000-memory.dmp	family_plugx
behavioral2/memory/2200-31-0x0000000000ED0000-0x0000000000EFE000-memory.dmp	family_plugx
behavioral2/memory/2200-37-0x0000000000ED0000-0x0000000000EFE000-memory.dmp	family_plugx
behavioral2/memory/3020-39-0x0000000000760000-0x000000000078E000-memory.dmp	family_plugx
behavioral2/memory/3020-42-0x0000000000760000-0x000000000078E000-memory.dmp	family_plugx
behavioral2/memory/3020-43-0x0000000000760000-0x000000000078E000-memory.dmp	family_plugx
behavioral2/memory/3020-41-0x0000000000760000-0x000000000078E000-memory.dmp	family_plugx
behavioral2/memory/2200-44-0x0000000000ED0000-0x0000000000EFE000-memory.dmp	family_plugx
behavioral2/memory/2200-66-0x0000000000ED0000-0x0000000000EFE000-memory.dmp	family_plugx
behavioral2/memory/3020-73-0x0000000000760000-0x000000000078E000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WokKStation services = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe\""	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WokKStation services = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe\""	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\MJ	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\MJ\CLSID = 43004200300039004500360031004200340045004500310041004200340035000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2200	svchost.exe
2200	svchost.exe
2200	svchost.exe
2200	svchost.exe
2200	svchost.exe
2200	svchost.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
2200	svchost.exe
2200	svchost.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
2200	svchost.exe
2200	svchost.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
2200	svchost.exe
2200	svchost.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
2200	svchost.exe
2200	svchost.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
2200	svchost.exe
2200	svchost.exe
2200	svchost.exe
2200	svchost.exe
2200	svchost.exe
2200	svchost.exe
2200	svchost.exe
2200	svchost.exe
2200	svchost.exe
2200	svchost.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe
3020	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2200	svchost.exe
3020	msiexec.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe
Token: SeTcbPrivilege	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe
Token: SeDebugPrivilege	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe
Token: SeTcbPrivilege	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe
Token: SeDebugPrivilege	2200	svchost.exe
Token: SeTcbPrivilege	2200	svchost.exe
Token: SeDebugPrivilege	3868	svchost.exe
Token: SeTcbPrivilege	3868	svchost.exe
Token: SeDebugPrivilege	3020	msiexec.exe
Token: SeTcbPrivilege	3020	msiexec.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 2200	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe	85
PID 4568 wrote to memory of 2200	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe	85
PID 4568 wrote to memory of 2200	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe	85
PID 4568 wrote to memory of 2200	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe	85
PID 4568 wrote to memory of 2200	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe	85
PID 4568 wrote to memory of 2200	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe	85
PID 4568 wrote to memory of 2200	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe	85
PID 4568 wrote to memory of 2200	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe	85
PID 4568 wrote to memory of 3868	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe	86
PID 4568 wrote to memory of 3868	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe	86
PID 4568 wrote to memory of 3868	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe	86
PID 4568 wrote to memory of 3868	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe	86
PID 4568 wrote to memory of 3868	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe	86
PID 4568 wrote to memory of 3868	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe	86
PID 4568 wrote to memory of 3868	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe	86
PID 4568 wrote to memory of 3868	4568	4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe	86
PID 2200 wrote to memory of 3020	2200	svchost.exe	88
PID 2200 wrote to memory of 3020	2200	svchost.exe	88
PID 2200 wrote to memory of 3020	2200	svchost.exe	88
PID 2200 wrote to memory of 3020	2200	svchost.exe	88
PID 2200 wrote to memory of 3020	2200	svchost.exe	88
PID 2200 wrote to memory of 3020	2200	svchost.exe	88
PID 2200 wrote to memory of 3020	2200	svchost.exe	88
PID 2200 wrote to memory of 3020	2200	svchost.exe	88

C:\Users\Admin\AppData\Local\Temp\4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a076785e9786324bb852dd5bc27f10b_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\SysWOW64\msiexec.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:3020
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SxS\bug.log

Filesize
450B

MD5
05b86fa0ff0607701e8c9706413dc066

SHA1
9112fd182bb90dc11e62673ec65484ad5efe839f

SHA256
73a843b7c868535cec8707211a73f120c7778606d24d69ebd525d3d68002a022

SHA512
8d011be7482bd5d5959c078a7d61494917877d68d154332e19dfdfcc275ec58543465274e471aec937ad33f7e36ecb3843e5e1f0aa41fc67820310e0fce7d15b

Download Submit
C:\ProgramData\SxS\bug.log

Filesize
5KB

MD5
c5a345f8464682b0bce938f2b3b17bf6

SHA1
244f1fc02dea59adc085c7e1589199cbb988fcd0

SHA256
ae5249187297641762925b63cb37e74d83e9ad049103753b41a2d538ea5f04c0

SHA512
2b3445a0b4a79fc7503bd0a9ad0f0359c164a564d526ac37f970bd3205c0ae136b05ec11652c83d74e100f3ac71b968116844905cf3486413d837dcdfd7f8465

Download Submit
memory/2200-18-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/2200-7-0x0000000000ED0000-0x0000000000EFE000-memory.dmp

Filesize
184KB

Download
memory/2200-66-0x0000000000ED0000-0x0000000000EFE000-memory.dmp

Filesize
184KB

Download
memory/2200-5-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/2200-20-0x0000000000ED0000-0x0000000000EFE000-memory.dmp

Filesize
184KB

Download
memory/2200-44-0x0000000000ED0000-0x0000000000EFE000-memory.dmp

Filesize
184KB

Download
memory/2200-26-0x0000000000ED0000-0x0000000000EFE000-memory.dmp

Filesize
184KB

Download
memory/2200-6-0x0000000000ED0000-0x0000000000EFE000-memory.dmp

Filesize
184KB

Download
memory/2200-37-0x0000000000ED0000-0x0000000000EFE000-memory.dmp

Filesize
184KB

Download
memory/2200-31-0x0000000000ED0000-0x0000000000EFE000-memory.dmp

Filesize
184KB

Download
memory/2200-19-0x0000000000ED0000-0x0000000000EFE000-memory.dmp

Filesize
184KB

Download
memory/2200-21-0x0000000000ED0000-0x0000000000EFE000-memory.dmp

Filesize
184KB

Download
memory/3020-40-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/3020-41-0x0000000000760000-0x000000000078E000-memory.dmp

Filesize
184KB

Download
memory/3020-72-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/3020-73-0x0000000000760000-0x000000000078E000-memory.dmp

Filesize
184KB

Download
memory/3020-43-0x0000000000760000-0x000000000078E000-memory.dmp

Filesize
184KB

Download
memory/3020-42-0x0000000000760000-0x000000000078E000-memory.dmp

Filesize
184KB

Download
memory/3020-39-0x0000000000760000-0x000000000078E000-memory.dmp

Filesize
184KB

Download
memory/3020-38-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/3868-25-0x0000000001380000-0x00000000013AE000-memory.dmp

Filesize
184KB

Download
memory/3868-23-0x0000000001380000-0x00000000013AE000-memory.dmp

Filesize
184KB

Download
memory/3868-22-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/3868-12-0x0000000001380000-0x00000000013AE000-memory.dmp

Filesize
184KB

Download
memory/4568-27-0x00000000024C0000-0x00000000024EE000-memory.dmp

Filesize
184KB

Download
memory/4568-4-0x00000000024C0000-0x00000000024EE000-memory.dmp

Filesize
184KB

Download
memory/4568-30-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4568-3-0x0000000002310000-0x000000000233E000-memory.dmp

Filesize
184KB

Download
memory/4568-1-0x0000000002310000-0x000000000233E000-memory.dmp

Filesize
184KB

Download
memory/4568-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4568-2-0x00000000024C0000-0x00000000024EE000-memory.dmp

Filesize
184KB

Download