plugx | f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104

Analysis

max time kernel
149s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe
Size

312KB
MD5

d9f87e744dbc898212a9eaa4594301b0
SHA1

6db6a193617ad688847fab965a12a9183eeda241
SHA256

f5e444469407a3e894d368b79878a149696015ed2f666dddb49bd484f144d104
SHA512

817e4326e71795982b3b637c6236a31162af0c31e38842c4d3701aed8927d944be285d448f6308818f5a5845052bc4f7baadaeb58fceab989e38f5505018b215
SSDEEP

3072:i7xf5kQoAp3Rr3zei1tmDZ5e7H5VVTt0BTnNZfsDZYanqn+S8WTul+5OMojoc:oF5kQo01Q95kzuN2DZYa2+S8YuuOM

Score

10^/10

plugx discovery persistence trojan

Malware Config

Signatures

Detects PlugX payload 21 IoCs

resource	yara_rule
behavioral1/memory/2728-1-0x0000000001D90000-0x0000000001DBE000-memory.dmp	family_plugx
behavioral1/memory/2728-4-0x0000000001E90000-0x0000000001EBE000-memory.dmp	family_plugx
behavioral1/memory/2728-3-0x0000000001E90000-0x0000000001EBE000-memory.dmp	family_plugx
behavioral1/memory/2828-14-0x00000000001D0000-0x00000000001FE000-memory.dmp	family_plugx
behavioral1/memory/2828-19-0x00000000001D0000-0x00000000001FE000-memory.dmp	family_plugx
behavioral1/memory/2828-35-0x00000000001D0000-0x00000000001FE000-memory.dmp	family_plugx
behavioral1/memory/2728-28-0x0000000001E90000-0x0000000001EBE000-memory.dmp	family_plugx
behavioral1/memory/2828-34-0x00000000001D0000-0x00000000001FE000-memory.dmp	family_plugx
behavioral1/memory/2824-36-0x00000000001F0000-0x000000000021E000-memory.dmp	family_plugx
behavioral1/memory/2828-38-0x00000000001D0000-0x00000000001FE000-memory.dmp	family_plugx
behavioral1/memory/2824-41-0x00000000001F0000-0x000000000021E000-memory.dmp	family_plugx
behavioral1/memory/2828-32-0x00000000001D0000-0x00000000001FE000-memory.dmp	family_plugx
behavioral1/memory/2728-23-0x0000000001D90000-0x0000000001DBE000-memory.dmp	family_plugx
behavioral1/memory/2828-42-0x00000000001D0000-0x00000000001FE000-memory.dmp	family_plugx
behavioral1/memory/2180-60-0x0000000000310000-0x000000000033E000-memory.dmp	family_plugx
behavioral1/memory/2180-59-0x0000000000310000-0x000000000033E000-memory.dmp	family_plugx
behavioral1/memory/2180-57-0x0000000000310000-0x000000000033E000-memory.dmp	family_plugx
behavioral1/memory/2828-62-0x00000000001D0000-0x00000000001FE000-memory.dmp	family_plugx
behavioral1/memory/2828-63-0x00000000001D0000-0x00000000001FE000-memory.dmp	family_plugx
behavioral1/memory/2180-64-0x0000000000310000-0x000000000033E000-memory.dmp	family_plugx
behavioral1/memory/2828-93-0x00000000001D0000-0x00000000001FE000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\GmailBar LiveList = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe\""	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GmailBar LiveList = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe\""	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\MJ	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\MJ\CLSID = 44003400430037004400390044003700300041004100430034003500390039000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2828	svchost.exe
2828	svchost.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2828	svchost.exe
2828	svchost.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2828	svchost.exe
2828	svchost.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe
2180	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2828	svchost.exe
2180	msiexec.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe
Token: SeTcbPrivilege	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe
Token: SeDebugPrivilege	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe
Token: SeTcbPrivilege	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe
Token: SeDebugPrivilege	2828	svchost.exe
Token: SeTcbPrivilege	2828	svchost.exe
Token: SeDebugPrivilege	2824	svchost.exe
Token: SeTcbPrivilege	2824	svchost.exe
Token: SeDebugPrivilege	2180	msiexec.exe
Token: SeTcbPrivilege	2180	msiexec.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2824	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe	31
PID 2728 wrote to memory of 2828	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe	30
PID 2728 wrote to memory of 2824	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe	31
PID 2728 wrote to memory of 2824	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe	31
PID 2728 wrote to memory of 2828	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe	30
PID 2728 wrote to memory of 2824	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe	31
PID 2728 wrote to memory of 2828	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe	30
PID 2728 wrote to memory of 2828	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe	30
PID 2728 wrote to memory of 2828	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe	30
PID 2728 wrote to memory of 2828	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe	30
PID 2728 wrote to memory of 2824	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe	31
PID 2728 wrote to memory of 2824	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe	31
PID 2728 wrote to memory of 2828	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe	30
PID 2728 wrote to memory of 2824	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe	31
PID 2728 wrote to memory of 2824	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe	31
PID 2728 wrote to memory of 2824	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe	31
PID 2728 wrote to memory of 2828	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe	30
PID 2728 wrote to memory of 2828	2728	d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe	30
PID 2828 wrote to memory of 2180	2828	svchost.exe	32
PID 2828 wrote to memory of 2180	2828	svchost.exe	32
PID 2828 wrote to memory of 2180	2828	svchost.exe	32
PID 2828 wrote to memory of 2180	2828	svchost.exe	32
PID 2828 wrote to memory of 2180	2828	svchost.exe	32
PID 2828 wrote to memory of 2180	2828	svchost.exe	32
PID 2828 wrote to memory of 2180	2828	svchost.exe	32
PID 2828 wrote to memory of 2180	2828	svchost.exe	32
PID 2828 wrote to memory of 2180	2828	svchost.exe	32
PID 2828 wrote to memory of 2180	2828	svchost.exe	32
PID 2828 wrote to memory of 2180	2828	svchost.exe	32
PID 2828 wrote to memory of 2180	2828	svchost.exe	32

C:\Users\Admin\AppData\Local\Temp\d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d9f87e744dbc898212a9eaa4594301b0_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\SysWOW64\msiexec.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2180
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SxS\bug.log

Filesize
904B

MD5
c9d8e3c065ef60d63ced43ef365e9371

SHA1
352eb3fa4b9c16b5a89ba9dc5460283430248764

SHA256
50255d9632b2baa56ae48280422d72292effad9c8d1e11c1dff7b113976d24a7

SHA512
7bf9a27abaeb21a1a993262f598e0ee3d963a001b9412b239141a9fb8af92710d2e8a4f9a36f9a804cb5a0c525dc4fcada5f60c5c3769a4fcc5d65390418cb30

Download Submit
C:\ProgramData\SxS\bug.log

Filesize
6KB

MD5
b8305e689163597233a289acbd6bd2e6

SHA1
97728c90e8faf1e292d32dddd21d56f6f3ba8a97

SHA256
698baf42d84e7a9fe107ccd3e66fc4a1a4e0b869cd6e8e9dc806fd0099176f1a

SHA512
0a60d71a1ab45ffd7ba4472d028d2c5855827e84f06014fb56b241f8f198988b1baa452958869f7d54717d2fbfbd0caf4b3a9d03166eee2bb5ac093221d4c303

Download Submit
memory/2180-60-0x0000000000310000-0x000000000033E000-memory.dmp

Filesize
184KB

Download
memory/2180-64-0x0000000000310000-0x000000000033E000-memory.dmp

Filesize
184KB

Download
memory/2180-57-0x0000000000310000-0x000000000033E000-memory.dmp

Filesize
184KB

Download
memory/2180-58-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2180-59-0x0000000000310000-0x000000000033E000-memory.dmp

Filesize
184KB

Download
memory/2180-55-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2728-3-0x0000000001E90000-0x0000000001EBE000-memory.dmp

Filesize
184KB

Download
memory/2728-4-0x0000000001E90000-0x0000000001EBE000-memory.dmp

Filesize
184KB

Download
memory/2728-0-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2728-1-0x0000000001D90000-0x0000000001DBE000-memory.dmp

Filesize
184KB

Download
memory/2728-28-0x0000000001E90000-0x0000000001EBE000-memory.dmp

Filesize
184KB

Download
memory/2728-23-0x0000000001D90000-0x0000000001DBE000-memory.dmp

Filesize
184KB

Download
memory/2728-33-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2824-41-0x00000000001F0000-0x000000000021E000-memory.dmp

Filesize
184KB

Download
memory/2824-15-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2824-36-0x00000000001F0000-0x000000000021E000-memory.dmp

Filesize
184KB

Download
memory/2824-11-0x0000000000140000-0x0000000000142000-memory.dmp

Filesize
8KB

Download
memory/2828-13-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2828-31-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2828-42-0x00000000001D0000-0x00000000001FE000-memory.dmp

Filesize
184KB

Download
memory/2828-35-0x00000000001D0000-0x00000000001FE000-memory.dmp

Filesize
184KB

Download
memory/2828-19-0x00000000001D0000-0x00000000001FE000-memory.dmp

Filesize
184KB

Download
memory/2828-38-0x00000000001D0000-0x00000000001FE000-memory.dmp

Filesize
184KB

Download
memory/2828-14-0x00000000001D0000-0x00000000001FE000-memory.dmp

Filesize
184KB

Download
memory/2828-34-0x00000000001D0000-0x00000000001FE000-memory.dmp

Filesize
184KB

Download
memory/2828-8-0x00000000000A0000-0x00000000000BB000-memory.dmp

Filesize
108KB

Download
memory/2828-62-0x00000000001D0000-0x00000000001FE000-memory.dmp

Filesize
184KB

Download
memory/2828-63-0x00000000001D0000-0x00000000001FE000-memory.dmp

Filesize
184KB

Download
memory/2828-5-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2828-32-0x00000000001D0000-0x00000000001FE000-memory.dmp

Filesize
184KB

Download
memory/2828-93-0x00000000001D0000-0x00000000001FE000-memory.dmp

Filesize
184KB

Download