plugx | da01734bacb716ac303f3018d3c4cf7fdc0784d157bb99976bd3d5a51381d34e

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/09/2024, 10:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e696b38ac71b23f50ee68da06a004af3_JaffaCakes118.exe
Size 675KB
Sample240917-l77slaxerm
SHA256 da01734bacb716ac303f3018d3c4cf7fdc0784d157bb99976bd3d5a51381d34e
MD5 e696b38ac71b23f50ee68da06a004af3
SHA1 480e3fe49e3acb71e1a466e8ba2d02997eaf278e
SHA512 7373f4ae19a732058e923172482d2b15fb8bed784431b734bfd3822c29b4369bc67a94804d00d0004f9ff7781f0db5eab4c4bf0f7cdf6f97d38f44a238bd709f
SSDEEP 12288:jat0EAH49n8Bm1zXC9YWP1W/zkObvcparNFzgnfFuQvJWzcI7On1hIRlhnXqyZx:2t24V1zgYbL1fFzgfF7Wr7O1e5Tx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

plugx discovery trojan

Malware Config

Signatures

Detects PlugX payload 15 IoCs

resource	yara_rule
behavioral2/memory/1628-20-0x00000000012C0000-0x00000000012EE000-memory.dmp	family_plugx
behavioral2/memory/1628-22-0x00000000012C0000-0x00000000012EE000-memory.dmp	family_plugx
behavioral2/memory/4572-27-0x0000000000B10000-0x0000000000B3E000-memory.dmp	family_plugx
behavioral2/memory/4572-39-0x0000000000B10000-0x0000000000B3E000-memory.dmp	family_plugx
behavioral2/memory/4572-38-0x0000000000B10000-0x0000000000B3E000-memory.dmp	family_plugx
behavioral2/memory/4572-40-0x0000000000B10000-0x0000000000B3E000-memory.dmp	family_plugx
behavioral2/memory/1628-26-0x00000000012C0000-0x00000000012EE000-memory.dmp	family_plugx
behavioral2/memory/4572-25-0x0000000000B10000-0x0000000000B3E000-memory.dmp	family_plugx
behavioral2/memory/2280-45-0x0000000000DD0000-0x0000000000DFE000-memory.dmp	family_plugx
behavioral2/memory/2280-46-0x0000000000DD0000-0x0000000000DFE000-memory.dmp	family_plugx
behavioral2/memory/2280-43-0x0000000000DD0000-0x0000000000DFE000-memory.dmp	family_plugx
behavioral2/memory/4572-47-0x0000000000B10000-0x0000000000B3E000-memory.dmp	family_plugx
behavioral2/memory/4572-48-0x0000000000B10000-0x0000000000B3E000-memory.dmp	family_plugx
behavioral2/memory/4572-49-0x0000000000B10000-0x0000000000B3E000-memory.dmp	family_plugx
behavioral2/memory/4572-50-0x0000000000B10000-0x0000000000B3E000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	e696b38ac71b23f50ee68da06a004af3_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1628	msseces.exe

Loads dropped DLL 1 IoCs

pid	Process
1628	msseces.exe

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	153.248.10.165
Destination IP	153.248.10.165
Destination IP	153.248.10.165

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e696b38ac71b23f50ee68da06a004af3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msseces.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\MJ	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\MJ\CLSID = 32004400460036003700380039003700370034004400430035003700300045000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4572	svchost.exe
4572	svchost.exe
4572	svchost.exe
4572	svchost.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
4572	svchost.exe
4572	svchost.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
4572	svchost.exe
4572	svchost.exe
2280	msiexec.exe
2280	msiexec.exe
4572	svchost.exe
4572	svchost.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
4572	svchost.exe
4572	svchost.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
4572	svchost.exe
4572	svchost.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe
2280	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4572	svchost.exe
2280	msiexec.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	msseces.exe
Token: SeTcbPrivilege	1628	msseces.exe
Token: SeDebugPrivilege	4572	svchost.exe
Token: SeTcbPrivilege	4572	svchost.exe
Token: SeDebugPrivilege	2280	msiexec.exe
Token: SeTcbPrivilege	2280	msiexec.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 1628	4704	e696b38ac71b23f50ee68da06a004af3_JaffaCakes118.exe	82
PID 4704 wrote to memory of 1628	4704	e696b38ac71b23f50ee68da06a004af3_JaffaCakes118.exe	82
PID 4704 wrote to memory of 1628	4704	e696b38ac71b23f50ee68da06a004af3_JaffaCakes118.exe	82
PID 1628 wrote to memory of 4572	1628	msseces.exe	84
PID 1628 wrote to memory of 4572	1628	msseces.exe	84
PID 1628 wrote to memory of 4572	1628	msseces.exe	84
PID 1628 wrote to memory of 4572	1628	msseces.exe	84
PID 1628 wrote to memory of 4572	1628	msseces.exe	84
PID 1628 wrote to memory of 4572	1628	msseces.exe	84
PID 1628 wrote to memory of 4572	1628	msseces.exe	84
PID 1628 wrote to memory of 4572	1628	msseces.exe	84
PID 4572 wrote to memory of 2280	4572	svchost.exe	89
PID 4572 wrote to memory of 2280	4572	svchost.exe	89
PID 4572 wrote to memory of 2280	4572	svchost.exe	89
PID 4572 wrote to memory of 2280	4572	svchost.exe	89
PID 4572 wrote to memory of 2280	4572	svchost.exe	89
PID 4572 wrote to memory of 2280	4572	svchost.exe	89
PID 4572 wrote to memory of 2280	4572	svchost.exe	89
PID 4572 wrote to memory of 2280	4572	svchost.exe	89

C:\Users\Admin\AppData\Local\Temp\e696b38ac71b23f50ee68da06a004af3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e696b38ac71b23f50ee68da06a004af3_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Users\Admin\AppData\Local\Temp\winsyslog\msseces.exe
  "C:\Users\Admin\AppData\Local\Temp\winsyslog\msseces.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\Windows\SysWOW64\msiexec.exe
      C:\Windows\SysWOW64\msiexec.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mpclient.dll

Path C:\Users\Admin\AppData\Local\Temp\winsyslog\mpclient.dll
Size 36KB
SHA256 7cf636ef15ffdfec2f4d5209880183d0c44103d6557eced172124fd993a6d967
MD5 184dd07bc91cc915aebf157a8b28066d
SHA1 fe906d8fa97b41df64344b688471f8489fff5ac0
SHA512 c35adc26ac6a8189dc641324f5a301c641c8bed42e420f1b344d4bd96142324cf2203c77f24cb16ba5ed534049cab956880d1c6f9f8e77920109b4a7950cb831
SSDEEP 768:Ey6Bro5m4Z00E5i9lD5BhP0ibvED0nEAEI0S5Z2ksuJuO:ExaB6J5ij9frhBWVuZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

msseces.asm

Path C:\Users\Admin\AppData\Local\Temp\winsyslog\msseces.asm
Size 116KB
SHA256 bf145d057e0b3cfd96da733c66344a0a07c86440d11bfc907b6bc740bb04dda7
MD5 200c06f1be562a09cafab07d22838767
SHA1 f724d592c8300ce88bf77ca13a55f74d175286ff
SHA512 4002e986d43e0e6956b6c184bba3a59c8d50c320a2ac928d3cade920f64c8deed1ef530ab7fdbed040c2af928a2596903ac20965f065f64a68266f54d10cc152
SSDEEP 3072:BucdvFabHG9tdCCRfkfYWNT2s19Jm/9zVkOxpIqcj:BucxFa+CakfYWhN13m/zkOxpIqcj
MD5 SHA1 SHA512 SSDEEP

Submit Download

msseces.exe

Path C:\Users\Admin\AppData\Local\Temp\winsyslog\msseces.exe
Size 951KB
SHA256 06c40af999881699dd9b73440d2ed48f404864c3fb8ff7b36560759892caaa12
MD5 e279e55c0d5f5da2e1fd268ebd12f268
SHA1 f98338fde49327cf1e357c6eb704ef55eaf48f8f
SHA512 701b6e637b70182caaf44f628cbfd116778ba70cf2668df210faae2f29cce85062127bc83e769fe7cf8050f180357b9405a62cf1cdab6f2094cfb493daae82da
SSDEEP 12288:At/ROcTGh00Pkxkb6bYCKrVndULbszm+Vyg99uD2YWoY9o/WD:8ch00OfKrVdU/svujv/WD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1628-26-0x00000000012C0000-0x00000000012EE000-memory.dmp

Download

memory/1628-20-0x00000000012C0000-0x00000000012EE000-memory.dmp

Download

memory/1628-22-0x00000000012C0000-0x00000000012EE000-memory.dmp

Download

memory/1628-21-0x0000000001300000-0x0000000001400000-memory.dmp

Download

memory/2280-45-0x0000000000DD0000-0x0000000000DFE000-memory.dmp

Download

memory/2280-44-0x0000000000C00000-0x0000000000C01000-memory.dmp

Download

memory/2280-43-0x0000000000DD0000-0x0000000000DFE000-memory.dmp

Download

memory/2280-46-0x0000000000DD0000-0x0000000000DFE000-memory.dmp

Download

memory/2280-42-0x00000000007E0000-0x00000000007E1000-memory.dmp

Download

memory/4572-25-0x0000000000B10000-0x0000000000B3E000-memory.dmp

Download

memory/4572-23-0x0000000000480000-0x0000000000481000-memory.dmp

Download

memory/4572-39-0x0000000000B10000-0x0000000000B3E000-memory.dmp

Download

memory/4572-27-0x0000000000B10000-0x0000000000B3E000-memory.dmp

Download

memory/4572-37-0x0000000000480000-0x0000000000481000-memory.dmp

Download

memory/4572-38-0x0000000000B10000-0x0000000000B3E000-memory.dmp

Download

memory/4572-40-0x0000000000B10000-0x0000000000B3E000-memory.dmp

Download

memory/4572-47-0x0000000000B10000-0x0000000000B3E000-memory.dmp

Download

memory/4572-48-0x0000000000B10000-0x0000000000B3E000-memory.dmp

Download

memory/4572-49-0x0000000000B10000-0x0000000000B3E000-memory.dmp

Download

memory/4572-50-0x0000000000B10000-0x0000000000B3E000-memory.dmp

Download