Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2024 20:14
Static task
static1
Behavioral task
behavioral1
Sample
07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
150 seconds
General
-
Target
07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe
-
Size
290KB
-
MD5
e0ce4768c42e1f857b3a31016db2314b
-
SHA1
f8a08bca5b0e682db91c5ae90f48aedf30378de5
-
SHA256
07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9
-
SHA512
a7e60e65f723efdede2a593a15afbdb781924e5d92d8fe4d7ae6b3768ca5dde289efae064919765e28bb7464da50083668df9ab24c3d8851864ab57ba16bf5bd
-
SSDEEP
6144:I7m697rqzqqLEaGDqWoWrSuzidnKjrqnbqdn9:2t9krLEaGDqArXzidnHc
Malware Config
Signatures
-
Detects PlugX payload 23 IoCs
resource yara_rule behavioral2/memory/1360-0-0x00000000022F0000-0x000000000232D000-memory.dmp family_plugx behavioral2/memory/1360-1-0x00000000022F0000-0x000000000232D000-memory.dmp family_plugx behavioral2/memory/4072-3-0x00000000012F0000-0x000000000132D000-memory.dmp family_plugx behavioral2/memory/4072-4-0x00000000012F0000-0x000000000132D000-memory.dmp family_plugx behavioral2/memory/4928-8-0x0000000000E90000-0x0000000000ECD000-memory.dmp family_plugx behavioral2/memory/4928-9-0x0000000000E90000-0x0000000000ECD000-memory.dmp family_plugx behavioral2/memory/3288-11-0x00000000018F0000-0x000000000192D000-memory.dmp family_plugx behavioral2/memory/3288-10-0x00000000018F0000-0x000000000192D000-memory.dmp family_plugx behavioral2/memory/3288-24-0x00000000018F0000-0x000000000192D000-memory.dmp family_plugx behavioral2/memory/4928-28-0x0000000000E90000-0x0000000000ECD000-memory.dmp family_plugx behavioral2/memory/3288-29-0x00000000018F0000-0x000000000192D000-memory.dmp family_plugx behavioral2/memory/4072-30-0x00000000012F0000-0x000000000132D000-memory.dmp family_plugx behavioral2/memory/1360-31-0x00000000022F0000-0x000000000232D000-memory.dmp family_plugx behavioral2/memory/3288-27-0x00000000018F0000-0x000000000192D000-memory.dmp family_plugx behavioral2/memory/3288-23-0x00000000018F0000-0x000000000192D000-memory.dmp family_plugx behavioral2/memory/3288-12-0x00000000018F0000-0x000000000192D000-memory.dmp family_plugx behavioral2/memory/3288-25-0x00000000018F0000-0x000000000192D000-memory.dmp family_plugx behavioral2/memory/1948-33-0x0000000002BD0000-0x0000000002C0D000-memory.dmp family_plugx behavioral2/memory/1948-36-0x0000000002BD0000-0x0000000002C0D000-memory.dmp family_plugx behavioral2/memory/1948-35-0x0000000002BD0000-0x0000000002C0D000-memory.dmp family_plugx behavioral2/memory/1948-37-0x0000000002BD0000-0x0000000002C0D000-memory.dmp family_plugx behavioral2/memory/3288-38-0x00000000018F0000-0x000000000192D000-memory.dmp family_plugx behavioral2/memory/1948-39-0x0000000002BD0000-0x0000000002C0D000-memory.dmp family_plugx -
Executes dropped EXE 1 IoCs
pid Process 4928 SxS.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SxS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 46003900330036003800440045003700380043003800450039003700440031000000 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1360 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe 1360 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe 4072 svchost.exe 4072 svchost.exe 4928 SxS.exe 4928 SxS.exe 4928 SxS.exe 4928 SxS.exe 3288 svchost.exe 3288 svchost.exe 3288 svchost.exe 3288 svchost.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 3288 svchost.exe 3288 svchost.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 3288 svchost.exe 3288 svchost.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 3288 svchost.exe 3288 svchost.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 3288 svchost.exe 3288 svchost.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe 1948 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3288 svchost.exe 1948 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 1360 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe Token: SeTcbPrivilege 1360 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe Token: SeDebugPrivilege 4072 svchost.exe Token: SeTcbPrivilege 4072 svchost.exe Token: SeDebugPrivilege 4928 SxS.exe Token: SeTcbPrivilege 4928 SxS.exe Token: SeDebugPrivilege 3288 svchost.exe Token: SeTcbPrivilege 3288 svchost.exe Token: SeDebugPrivilege 1948 msiexec.exe Token: SeTcbPrivilege 1948 msiexec.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1360 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe 4928 SxS.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1360 wrote to memory of 4072 1360 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe 82 PID 1360 wrote to memory of 4072 1360 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe 82 PID 1360 wrote to memory of 4072 1360 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe 82 PID 1360 wrote to memory of 4072 1360 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe 82 PID 1360 wrote to memory of 4072 1360 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe 82 PID 1360 wrote to memory of 4072 1360 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe 82 PID 1360 wrote to memory of 4072 1360 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe 82 PID 1360 wrote to memory of 4072 1360 07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe 82 PID 4928 wrote to memory of 3288 4928 SxS.exe 84 PID 4928 wrote to memory of 3288 4928 SxS.exe 84 PID 4928 wrote to memory of 3288 4928 SxS.exe 84 PID 4928 wrote to memory of 3288 4928 SxS.exe 84 PID 4928 wrote to memory of 3288 4928 SxS.exe 84 PID 4928 wrote to memory of 3288 4928 SxS.exe 84 PID 4928 wrote to memory of 3288 4928 SxS.exe 84 PID 4928 wrote to memory of 3288 4928 SxS.exe 84 PID 3288 wrote to memory of 1948 3288 svchost.exe 85 PID 3288 wrote to memory of 1948 3288 svchost.exe 85 PID 3288 wrote to memory of 1948 3288 svchost.exe 85 PID 3288 wrote to memory of 1948 3288 svchost.exe 85 PID 3288 wrote to memory of 1948 3288 svchost.exe 85 PID 3288 wrote to memory of 1948 3288 svchost.exe 85 PID 3288 wrote to memory of 1948 3288 svchost.exe 85 PID 3288 wrote to memory of 1948 3288 svchost.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe"C:\Users\Admin\AppData\Local\Temp\07f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe 100 13602⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4072
-
-
C:\ProgramData\NVIDIASmart\SxS.exe"C:\ProgramData\NVIDIASmart\SxS.exe" 200 01⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe 201 02⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 32883⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
290KB
MD5e0ce4768c42e1f857b3a31016db2314b
SHA1f8a08bca5b0e682db91c5ae90f48aedf30378de5
SHA25607f68a6d0c1b1e97c5ec147b21c0a9646013b1c9e90789c51dd3d87469cdcfd9
SHA512a7e60e65f723efdede2a593a15afbdb781924e5d92d8fe4d7ae6b3768ca5dde289efae064919765e28bb7464da50083668df9ab24c3d8851864ab57ba16bf5bd