Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2024 23:01
Static task
static1
Behavioral task
behavioral1
Sample
07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe
Resource
win7-20240903-en
General
-
Target
07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe
-
Size
290KB
-
MD5
e0ce4768c42e1f857b3a31016db2314b
-
SHA1
f8a08bca5b0e682db91c5ae90f48aedf30378de5
-
SHA256
07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9
-
SHA512
a7e60e65f723efdede2a593a15afbdb781924e5d92d8fe4d7ae6b3768ca5dde289efae064919765e28bb7464da50083668df9ab24c3d8851864ab57ba16bf5bd
-
SSDEEP
6144:I7m697rqzqqLEaGDqWoWrSuzidnKjrqnbqdn9:2t9krLEaGDqArXzidnHc
Malware Config
Signatures
-
Detects PlugX payload 21 IoCs
Processes:
resource yara_rule behavioral2/memory/1612-0-0x0000000002310000-0x000000000234D000-memory.dmp family_plugx behavioral2/memory/1612-1-0x0000000002310000-0x000000000234D000-memory.dmp family_plugx behavioral2/memory/4112-4-0x0000000001240000-0x000000000127D000-memory.dmp family_plugx behavioral2/memory/3644-8-0x0000000000E90000-0x0000000000ECD000-memory.dmp family_plugx behavioral2/memory/3768-9-0x0000000001400000-0x000000000143D000-memory.dmp family_plugx behavioral2/memory/3768-10-0x0000000001400000-0x000000000143D000-memory.dmp family_plugx behavioral2/memory/3768-22-0x0000000001400000-0x000000000143D000-memory.dmp family_plugx behavioral2/memory/3768-23-0x0000000001400000-0x000000000143D000-memory.dmp family_plugx behavioral2/memory/3768-25-0x0000000001400000-0x000000000143D000-memory.dmp family_plugx behavioral2/memory/3768-11-0x0000000001400000-0x000000000143D000-memory.dmp family_plugx behavioral2/memory/3768-24-0x0000000001400000-0x000000000143D000-memory.dmp family_plugx behavioral2/memory/3644-27-0x0000000000E90000-0x0000000000ECD000-memory.dmp family_plugx behavioral2/memory/1612-31-0x0000000002310000-0x000000000234D000-memory.dmp family_plugx behavioral2/memory/4112-30-0x0000000001240000-0x000000000127D000-memory.dmp family_plugx behavioral2/memory/1292-32-0x00000000008A0000-0x00000000008DD000-memory.dmp family_plugx behavioral2/memory/1292-33-0x00000000008A0000-0x00000000008DD000-memory.dmp family_plugx behavioral2/memory/1292-37-0x00000000008A0000-0x00000000008DD000-memory.dmp family_plugx behavioral2/memory/1292-36-0x00000000008A0000-0x00000000008DD000-memory.dmp family_plugx behavioral2/memory/1292-35-0x00000000008A0000-0x00000000008DD000-memory.dmp family_plugx behavioral2/memory/3768-38-0x0000000001400000-0x000000000143D000-memory.dmp family_plugx behavioral2/memory/1292-39-0x00000000008A0000-0x00000000008DD000-memory.dmp family_plugx -
Executes dropped EXE 1 IoCs
Processes:
SxS.exepid process 3644 SxS.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
svchost.exeSxS.exesvchost.exemsiexec.exe07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SxS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe -
Modifies registry class 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 45003100450038004600380033004500310045003200430036003800310030000000 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exesvchost.exeSxS.exesvchost.exemsiexec.exepid process 1612 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe 1612 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe 4112 svchost.exe 4112 svchost.exe 3644 SxS.exe 3644 SxS.exe 3644 SxS.exe 3644 SxS.exe 3768 svchost.exe 3768 svchost.exe 3768 svchost.exe 3768 svchost.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 3768 svchost.exe 3768 svchost.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 3768 svchost.exe 3768 svchost.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 3768 svchost.exe 3768 svchost.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 3768 svchost.exe 3768 svchost.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe 1292 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
svchost.exemsiexec.exepid process 3768 svchost.exe 1292 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exesvchost.exeSxS.exesvchost.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1612 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe Token: SeTcbPrivilege 1612 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe Token: SeDebugPrivilege 4112 svchost.exe Token: SeTcbPrivilege 4112 svchost.exe Token: SeDebugPrivilege 3644 SxS.exe Token: SeTcbPrivilege 3644 SxS.exe Token: SeDebugPrivilege 3768 svchost.exe Token: SeTcbPrivilege 3768 svchost.exe Token: SeDebugPrivilege 1292 msiexec.exe Token: SeTcbPrivilege 1292 msiexec.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exeSxS.exepid process 1612 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe 3644 SxS.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exeSxS.exesvchost.exedescription pid process target process PID 1612 wrote to memory of 4112 1612 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe svchost.exe PID 1612 wrote to memory of 4112 1612 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe svchost.exe PID 1612 wrote to memory of 4112 1612 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe svchost.exe PID 1612 wrote to memory of 4112 1612 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe svchost.exe PID 1612 wrote to memory of 4112 1612 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe svchost.exe PID 1612 wrote to memory of 4112 1612 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe svchost.exe PID 1612 wrote to memory of 4112 1612 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe svchost.exe PID 1612 wrote to memory of 4112 1612 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe svchost.exe PID 3644 wrote to memory of 3768 3644 SxS.exe svchost.exe PID 3644 wrote to memory of 3768 3644 SxS.exe svchost.exe PID 3644 wrote to memory of 3768 3644 SxS.exe svchost.exe PID 3644 wrote to memory of 3768 3644 SxS.exe svchost.exe PID 3644 wrote to memory of 3768 3644 SxS.exe svchost.exe PID 3644 wrote to memory of 3768 3644 SxS.exe svchost.exe PID 3644 wrote to memory of 3768 3644 SxS.exe svchost.exe PID 3644 wrote to memory of 3768 3644 SxS.exe svchost.exe PID 3768 wrote to memory of 1292 3768 svchost.exe msiexec.exe PID 3768 wrote to memory of 1292 3768 svchost.exe msiexec.exe PID 3768 wrote to memory of 1292 3768 svchost.exe msiexec.exe PID 3768 wrote to memory of 1292 3768 svchost.exe msiexec.exe PID 3768 wrote to memory of 1292 3768 svchost.exe msiexec.exe PID 3768 wrote to memory of 1292 3768 svchost.exe msiexec.exe PID 3768 wrote to memory of 1292 3768 svchost.exe msiexec.exe PID 3768 wrote to memory of 1292 3768 svchost.exe msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe"C:\Users\Admin\AppData\Local\Temp\07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe 100 16122⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
-
C:\ProgramData\NVIDIASmart\SxS.exe"C:\ProgramData\NVIDIASmart\SxS.exe" 200 01⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe 201 02⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 37683⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1292
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
290KB
MD5e0ce4768c42e1f857b3a31016db2314b
SHA1f8a08bca5b0e682db91c5ae90f48aedf30378de5
SHA25607f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9
SHA512a7e60e65f723efdede2a593a15afbdb781924e5d92d8fe4d7ae6b3768ca5dde289efae064919765e28bb7464da50083668df9ab24c3d8851864ab57ba16bf5bd