plugx | d64e5a258078f6655b3aa40e7bb897ff9856151b4adcdd1f5723a8b9e02bb88a

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29f0bc408d724050e92230285592be7f_JaffaCakes118.exe
Size

257KB
MD5

29f0bc408d724050e92230285592be7f
SHA1

d31fca6aea10ed571d2ffce375cfd27b6d0871f3
SHA256

d64e5a258078f6655b3aa40e7bb897ff9856151b4adcdd1f5723a8b9e02bb88a
SHA512

24b5ff00b7dc75e292ee104e1d9176e25c45df3907470ec2795754c026c2db02023249cffacc0757fdd10882d1ba26488350e0bbd29b4b6e5feebce5fafe9f89
SSDEEP

6144:S0L10u6oC8DyzBcniBdBuGoEim9N1vXp:S0Z0jV8DacnchJ

Score

10^/10

plugx discovery trojan

Malware Config

Signatures

Detects PlugX payload 25 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2576-1-0x0000000002E50000-0x0000000002E8C000-memory.dmp	family_plugx
behavioral2/memory/4020-20-0x0000000000930000-0x000000000096C000-memory.dmp	family_plugx
behavioral2/memory/4020-19-0x0000000000930000-0x000000000096C000-memory.dmp	family_plugx
behavioral2/memory/2260-25-0x0000000001460000-0x000000000149C000-memory.dmp	family_plugx
behavioral2/memory/2260-24-0x0000000001460000-0x000000000149C000-memory.dmp	family_plugx
behavioral2/memory/4316-29-0x0000000001500000-0x000000000153C000-memory.dmp	family_plugx
behavioral2/memory/2576-28-0x0000000002E50000-0x0000000002E8C000-memory.dmp	family_plugx
behavioral2/memory/4316-27-0x0000000001500000-0x000000000153C000-memory.dmp	family_plugx
behavioral2/memory/2260-33-0x0000000001460000-0x000000000149C000-memory.dmp	family_plugx
behavioral2/memory/4316-45-0x0000000001500000-0x000000000153C000-memory.dmp	family_plugx
behavioral2/memory/4316-46-0x0000000001500000-0x000000000153C000-memory.dmp	family_plugx
behavioral2/memory/4316-52-0x0000000001500000-0x000000000153C000-memory.dmp	family_plugx
behavioral2/memory/4316-53-0x0000000001500000-0x000000000153C000-memory.dmp	family_plugx
behavioral2/memory/4316-48-0x0000000001500000-0x000000000153C000-memory.dmp	family_plugx
behavioral2/memory/4316-31-0x0000000001500000-0x000000000153C000-memory.dmp	family_plugx
behavioral2/memory/4020-57-0x0000000000930000-0x000000000096C000-memory.dmp	family_plugx
behavioral2/memory/4020-58-0x0000000000930000-0x000000000096C000-memory.dmp	family_plugx
behavioral2/memory/4316-59-0x0000000001500000-0x000000000153C000-memory.dmp	family_plugx
behavioral2/memory/1260-62-0x00000000028C0000-0x00000000028FC000-memory.dmp	family_plugx
behavioral2/memory/1260-61-0x00000000028C0000-0x00000000028FC000-memory.dmp	family_plugx
behavioral2/memory/4316-63-0x0000000001500000-0x000000000153C000-memory.dmp	family_plugx
behavioral2/memory/1260-65-0x00000000028C0000-0x00000000028FC000-memory.dmp	family_plugx
behavioral2/memory/1260-66-0x00000000028C0000-0x00000000028FC000-memory.dmp	family_plugx
behavioral2/memory/1260-67-0x00000000028C0000-0x00000000028FC000-memory.dmp	family_plugx
behavioral2/memory/4316-70-0x0000000001500000-0x000000000153C000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx

Deletes itself 1 IoCs

Processes:

rc.exe

pid	Process
4020	rc.exe

Executes dropped EXE 2 IoCs

Processes:

rc.exerc.exe

pid	Process
4020	rc.exe
2260	rc.exe

Loads dropped DLL 2 IoCs

Processes:

rc.exerc.exe

pid	Process
4020	rc.exe
2260	rc.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

29f0bc408d724050e92230285592be7f_JaffaCakes118.exerc.exerc.exesvchost.exemsiexec.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29f0bc408d724050e92230285592be7f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Modifies data under HKEY_USERS 17 IoCs

Processes:

svchost.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	svchost.exe

Modifies registry class 2 IoCs

Processes:

svchost.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 44003400410035003100420035003400350034004600440042003100420043000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exemsiexec.exe

pid	Process
4316	svchost.exe
4316	svchost.exe
4316	svchost.exe
4316	svchost.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
4316	svchost.exe
4316	svchost.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
4316	svchost.exe
4316	svchost.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
4316	svchost.exe
4316	svchost.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
4316	svchost.exe
4316	svchost.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
4316	svchost.exe
4316	svchost.exe
1260	msiexec.exe
1260	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

svchost.exemsiexec.exe

pid	Process
4316	svchost.exe
1260	msiexec.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

29f0bc408d724050e92230285592be7f_JaffaCakes118.exerc.exerc.exesvchost.exemsiexec.exe

description	pid	Process
Token: SeDebugPrivilege	2576	29f0bc408d724050e92230285592be7f_JaffaCakes118.exe
Token: SeTcbPrivilege	2576	29f0bc408d724050e92230285592be7f_JaffaCakes118.exe
Token: SeDebugPrivilege	4020	rc.exe
Token: SeTcbPrivilege	4020	rc.exe
Token: SeDebugPrivilege	2260	rc.exe
Token: SeTcbPrivilege	2260	rc.exe
Token: SeDebugPrivilege	4316	svchost.exe
Token: SeTcbPrivilege	4316	svchost.exe
Token: SeDebugPrivilege	1260	msiexec.exe
Token: SeTcbPrivilege	1260	msiexec.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

29f0bc408d724050e92230285592be7f_JaffaCakes118.exerc.exesvchost.exe

description	pid	Process	procid_target
PID 2576 wrote to memory of 4020	2576	29f0bc408d724050e92230285592be7f_JaffaCakes118.exe	84
PID 2576 wrote to memory of 4020	2576	29f0bc408d724050e92230285592be7f_JaffaCakes118.exe	84
PID 2576 wrote to memory of 4020	2576	29f0bc408d724050e92230285592be7f_JaffaCakes118.exe	84
PID 2260 wrote to memory of 4316	2260	rc.exe	89
PID 2260 wrote to memory of 4316	2260	rc.exe	89
PID 2260 wrote to memory of 4316	2260	rc.exe	89
PID 2260 wrote to memory of 4316	2260	rc.exe	89
PID 2260 wrote to memory of 4316	2260	rc.exe	89
PID 2260 wrote to memory of 4316	2260	rc.exe	89
PID 2260 wrote to memory of 4316	2260	rc.exe	89
PID 2260 wrote to memory of 4316	2260	rc.exe	89
PID 4316 wrote to memory of 1260	4316	svchost.exe	90
PID 4316 wrote to memory of 1260	4316	svchost.exe	90
PID 4316 wrote to memory of 1260	4316	svchost.exe	90
PID 4316 wrote to memory of 1260	4316	svchost.exe	90
PID 4316 wrote to memory of 1260	4316	svchost.exe	90
PID 4316 wrote to memory of 1260	4316	svchost.exe	90
PID 4316 wrote to memory of 1260	4316	svchost.exe	90
PID 4316 wrote to memory of 1260	4316	svchost.exe	90

C:\Users\Admin\AppData\Local\Temp\29f0bc408d724050e92230285592be7f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\29f0bc408d724050e92230285592be7f_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576
- C:\ProgramData\SxS\rc.exe
  "C:\ProgramData\SxS\rc.exe" 100 2576
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4020

C:\ProgramData\SxS\rc.exe
"C:\ProgramData\SxS\rc.exe" 200 0
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe 201 0
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\system32\msiexec.exe 209 4316
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SxS\RCDLL.dll

Filesize
4KB

MD5
950d81456a42e1c39a6660554501f91e

SHA1
bf673d59936c221736fdf55fc4f1816bff6e5dfd

SHA256
85ff99a6e80c0b86cca82ee28610411edcb8b703b4d8e3fd91bfd4938b7c3180

SHA512
90963d5b1c1072ce3e681d8a59fdd3e9547db53204ae1798e44afd3bf91907c26f9d3f793c566ee0dd2811fed9db7ffe0815e6edf11aa8da6b7ca52bd41a34ee

Download Submit
C:\ProgramData\SxS\bug.log

Filesize
622B

MD5
2375d0fbf27164012bb2d220e9c0fa3a

SHA1
8390d84e1a0f295babc12354e672b62bcc006bd7

SHA256
adcae69d9cdc5832c92d798455a6fd5388bf31bccba9fdc5d3d90c95b8800478

SHA512
f67bd807c4fb99adf3ec024c167b3d9894ed02e06fb86cba390afc378b7c7cb85a962f045f2cbf98a24fb3ab1636b1edfb44e4beec3073609625793821d18f25

Download Submit
C:\ProgramData\SxS\rc.exe

Filesize
67KB

MD5
3560bc05de9f7ef2df54495a4c6774f8

SHA1
7f64b41b320913ecc10bbe251fe1f169c5520d20

SHA256
83be17ad26522c9e0e6b28c8638c6548908baeb1e945db77b747ff85e74fea3c

SHA512
1ca4533b00800d0c68560983993dfccc600e1405583cb597fbb5c7248f81b6399d9976857a945453e5cf7e2778ae1e3f28c69c6af1d09bf8b7166c71d4b94740

Download Submit
C:\ProgramData\SxS\rc.hlp

Filesize
167KB

MD5
d63ded61435f458b8e22f8bca68393f0

SHA1
8a828124d6b66f35018954226194ad2048ca46e9

SHA256
1a865b1a682fba71276f0bfaf454846663dc7e18680271ebd346ccdef3b4b54c

SHA512
e19befc0cfbf8e3b2ebbf88fea76a83d5cb989775ce35600fc50084e3f932da9dc5b786e17ce8374fd68f21eaa9f8bef9a6e278a6a88f4261c63b934405f3707

Download Submit
memory/1260-61-0x00000000028C0000-0x00000000028FC000-memory.dmp

Filesize
240KB

Download
memory/1260-62-0x00000000028C0000-0x00000000028FC000-memory.dmp

Filesize
240KB

Download
memory/1260-67-0x00000000028C0000-0x00000000028FC000-memory.dmp

Filesize
240KB

Download
memory/1260-66-0x00000000028C0000-0x00000000028FC000-memory.dmp

Filesize
240KB

Download
memory/1260-64-0x0000000000A20000-0x0000000000A21000-memory.dmp

Filesize
4KB

Download
memory/1260-60-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download
memory/1260-65-0x00000000028C0000-0x00000000028FC000-memory.dmp

Filesize
240KB

Download
memory/2260-25-0x0000000001460000-0x000000000149C000-memory.dmp

Filesize
240KB

Download
memory/2260-24-0x0000000001460000-0x000000000149C000-memory.dmp

Filesize
240KB

Download
memory/2260-33-0x0000000001460000-0x000000000149C000-memory.dmp

Filesize
240KB

Download
memory/2576-28-0x0000000002E50000-0x0000000002E8C000-memory.dmp

Filesize
240KB

Download
memory/2576-1-0x0000000002E50000-0x0000000002E8C000-memory.dmp

Filesize
240KB

Download
memory/2576-0-0x00000000012F0000-0x000000000131A000-memory.dmp

Filesize
168KB

Download
memory/4020-58-0x0000000000930000-0x000000000096C000-memory.dmp

Filesize
240KB

Download
memory/4020-57-0x0000000000930000-0x000000000096C000-memory.dmp

Filesize
240KB

Download
memory/4020-18-0x0000000000AD0000-0x0000000000BD0000-memory.dmp

Filesize
1024KB

Download
memory/4020-20-0x0000000000930000-0x000000000096C000-memory.dmp

Filesize
240KB

Download
memory/4020-19-0x0000000000930000-0x000000000096C000-memory.dmp

Filesize
240KB

Download
memory/4316-45-0x0000000001500000-0x000000000153C000-memory.dmp

Filesize
240KB

Download
memory/4316-31-0x0000000001500000-0x000000000153C000-memory.dmp

Filesize
240KB

Download
memory/4316-46-0x0000000001500000-0x000000000153C000-memory.dmp

Filesize
240KB

Download
memory/4316-59-0x0000000001500000-0x000000000153C000-memory.dmp

Filesize
240KB

Download
memory/4316-53-0x0000000001500000-0x000000000153C000-memory.dmp

Filesize
240KB

Download
memory/4316-27-0x0000000001500000-0x000000000153C000-memory.dmp

Filesize
240KB

Download
memory/4316-29-0x0000000001500000-0x000000000153C000-memory.dmp

Filesize
240KB

Download
memory/4316-63-0x0000000001500000-0x000000000153C000-memory.dmp

Filesize
240KB

Download
memory/4316-26-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/4316-44-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/4316-48-0x0000000001500000-0x000000000153C000-memory.dmp

Filesize
240KB

Download
memory/4316-52-0x0000000001500000-0x000000000153C000-memory.dmp

Filesize
240KB

Download
memory/4316-70-0x0000000001500000-0x000000000153C000-memory.dmp

Filesize
240KB

Download