Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system - submitted
10/03/2025, 17:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_608abb0c39949775368837a6c068b113.exe
Resource
win7-20241023-en
windows7-x64
14 signatures
150 seconds
General
- Target JaffaCakes118_608abb0c39949775368837a6c068b113.exe
- Size 341KB
- Sample250310-wc8rhssrt7
- SHA256 bba7c47c1c2af0a0d54d2c44c3386f54b59874b9c878dfa8fdacf72937770a96
- MD5 608abb0c39949775368837a6c068b113
- SHA1 24de091315d67bf66d0a089524d5742c79b90400
- SHA512 89e843d7f7cb700c35c5bcbcdce6d800e9c6b4ccee3997ec0b38c09b452e3d6edbd638b9e9f520b7fdab4dea7c18a85ad23a94eb257b777e69e504e1dd20cb8f
- SSDEEP 6144:VKs+6SrgizF3ndvz9T6LmVgcHBsnsTyXS7xTvOtNbCN0bggi9teJkEzbr:XSXndvz9T6yVgchB7xCeNvtOkEzb
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects PlugX payload 22 IoCs
resource yara_rule behavioral2/memory/3428-1-0x0000000003090000-0x00000000030C8000-memory.dmp family_plugx behavioral2/memory/1616-43-0x0000000001440000-0x0000000001478000-memory.dmp family_plugx behavioral2/memory/1616-45-0x0000000001440000-0x0000000001478000-memory.dmp family_plugx behavioral2/memory/4256-48-0x0000000000E50000-0x0000000000E88000-memory.dmp family_plugx behavioral2/memory/1616-51-0x0000000001440000-0x0000000001478000-memory.dmp family_plugx behavioral2/memory/3428-50-0x0000000003090000-0x00000000030C8000-memory.dmp family_plugx behavioral2/memory/1616-44-0x0000000001440000-0x0000000001478000-memory.dmp family_plugx behavioral2/memory/1616-42-0x0000000001440000-0x0000000001478000-memory.dmp family_plugx behavioral2/memory/1616-41-0x0000000001440000-0x0000000001478000-memory.dmp family_plugx behavioral2/memory/1616-40-0x0000000001440000-0x0000000001478000-memory.dmp family_plugx behavioral2/memory/1616-28-0x0000000001440000-0x0000000001478000-memory.dmp family_plugx behavioral2/memory/1616-27-0x0000000001440000-0x0000000001478000-memory.dmp family_plugx behavioral2/memory/4256-24-0x0000000000E50000-0x0000000000E88000-memory.dmp family_plugx behavioral2/memory/1532-19-0x0000000002190000-0x00000000021C8000-memory.dmp family_plugx behavioral2/memory/1532-54-0x0000000002190000-0x00000000021C8000-memory.dmp family_plugx behavioral2/memory/1616-55-0x0000000001440000-0x0000000001478000-memory.dmp family_plugx behavioral2/memory/1868-60-0x0000000002AC0000-0x0000000002AF8000-memory.dmp family_plugx behavioral2/memory/1868-61-0x0000000002AC0000-0x0000000002AF8000-memory.dmp family_plugx behavioral2/memory/1868-58-0x0000000002AC0000-0x0000000002AF8000-memory.dmp family_plugx behavioral2/memory/1616-62-0x0000000001440000-0x0000000001478000-memory.dmp family_plugx behavioral2/memory/1868-63-0x0000000002AC0000-0x0000000002AF8000-memory.dmp family_plugx behavioral2/memory/1616-66-0x0000000001440000-0x0000000001478000-memory.dmp family_plugx - Plugx family
- Deletes itself 1 IoCs
pid Process 1532 NvSmart.exe - Executes dropped EXE 2 IoCs
pid Process 1532 NvSmart.exe 4256 NvSmart.exe - Loads dropped DLL 2 IoCs
pid Process 1532 NvSmart.exe 4256 NvSmart.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_608abb0c39949775368837a6c068b113.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NvSmart.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NvSmart.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe - Modifies data under HKEY_USERS 17 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" svchost.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 31004100440037003500380037004100390038004400380033003300350044000000 svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1616 svchost.exe 1616 svchost.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1616 svchost.exe 1616 svchost.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1616 svchost.exe 1616 svchost.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1616 svchost.exe 1616 svchost.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1616 svchost.exe 1616 svchost.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1868 msiexec.exe 1616 svchost.exe 1616 svchost.exe 1868 msiexec.exe 1868 msiexec.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1616 svchost.exe 1868 msiexec.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3428 JaffaCakes118_608abb0c39949775368837a6c068b113.exe Token: SeTcbPrivilege 3428 JaffaCakes118_608abb0c39949775368837a6c068b113.exe Token: SeDebugPrivilege 1532 NvSmart.exe Token: SeTcbPrivilege 1532 NvSmart.exe Token: SeDebugPrivilege 4256 NvSmart.exe Token: SeTcbPrivilege 4256 NvSmart.exe Token: SeDebugPrivilege 1616 svchost.exe Token: SeTcbPrivilege 1616 svchost.exe Token: SeDebugPrivilege 1868 msiexec.exe Token: SeTcbPrivilege 1868 msiexec.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3428 JaffaCakes118_608abb0c39949775368837a6c068b113.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4256 wrote to memory of 1616 4256 NvSmart.exe 92 PID 4256 wrote to memory of 1616 4256 NvSmart.exe 92 PID 4256 wrote to memory of 1616 4256 NvSmart.exe 92 PID 4256 wrote to memory of 1616 4256 NvSmart.exe 92 PID 4256 wrote to memory of 1616 4256 NvSmart.exe 92 PID 4256 wrote to memory of 1616 4256 NvSmart.exe 92 PID 4256 wrote to memory of 1616 4256 NvSmart.exe 92 PID 4256 wrote to memory of 1616 4256 NvSmart.exe 92 PID 1616 wrote to memory of 1868 1616 svchost.exe 96 PID 1616 wrote to memory of 1868 1616 svchost.exe 96 PID 1616 wrote to memory of 1868 1616 svchost.exe 96 PID 1616 wrote to memory of 1868 1616 svchost.exe 96 PID 1616 wrote to memory of 1868 1616 svchost.exe 96 PID 1616 wrote to memory of 1868 1616 svchost.exe 96 PID 1616 wrote to memory of 1868 1616 svchost.exe 96 PID 1616 wrote to memory of 1868 1616 svchost.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_608abb0c39949775368837a6c068b113.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_608abb0c39949775368837a6c068b113.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3428
-
C:\ProgramData\Wins\NvSmart.exe"C:\ProgramData\Wins\NvSmart.exe" 100 34281⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1532
-
C:\ProgramData\Wins\NvSmart.exe"C:\ProgramData\Wins\NvSmart.exe" 200 01⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 201 02⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 16163⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1868
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SxS\bug.log
- Size 500B
- SHA256 fc95dc827e4c0a6fcc67ced895b71a1e173cb90132d18d43f5dd8f73abe7acf2
- MD5 d504bdb060c3a6f5d138b00a727d8660
- SHA1 ec0ea760c4bd8b94f3fa1556314b4dc277397899
- SHA512 d84f3715da352d442e0200d781deb67f99ec41ff6f22abb1b19ba69e31dda5a0121ee161fbecddebc44534e7b67509bb9646ce933d02f16c1bc0737327bff9bd
- MD5 SHA1 SHA512
- Path C:\ProgramData\Wins\NvSmart.chm
- Size 155KB
- SHA256 7ba3e66a633e04feac7167e19621e43b7eb0499f38e818c6dedad21f5f6b39be
- MD5 c7814f4a0c42065005e82bda45e4d849
- SHA1 735e60ab5b0d52344851510c2b1e5f7136d65301
- SHA512 ae327466612592b4439dedfa288a54e46102f46d9afd47ad6f236964c016eefc162beffc56394cfca7db92f043f4ff4d02bbdacf70daae9463ed85ce6207dd77
- SSDEEP 3072:pyEqlSTXxTvOtvNbCGGezbcOl4gi939EdO0CYREqRuFFBOzDdnR:pyXS7xTvOtNbCN0bggi9teJkEz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Wins\NvSmart.exe
- Size 46KB
- SHA256 523d28df917f9d265cd2c0d38df26277bc56a535145100ed82e6f5fdeaae7256
- MD5 09b8b54f78a10c435cd319070aa13c28
- SHA1 6474d0369f97e72e01e4971128d1062f5c2b3656
- SHA512 c1f2f5c4aa5eb55d255e22db032da954a38a0204fb4d9bc76042f140f1b1e171944aa09b0eb11159323a8b9f33974c73fd32a4f76d976aaa8a16cc9c60a34ca7
- SSDEEP 768:Ep+QDJgY/OTFStOWjmyPTc+6lye958TZLWMmSbC9X:Epj9IexPANL58TZaDaC9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Wins\NvSmartMax.dll
- Size 4KB
- SHA256 fb1c1de76504a35b5c9cf4a60c4a7497064917e0ac96b5389b5ef56c4a02bc17
- MD5 0674a0929aec3db11383523b40fa36d1
- SHA1 9f50aa213232690e06aa49b7e7b1640127429117
- SHA512 ce1a5007499232d6730bf97745bd5e931d6a26d658d3c47a4200a2e225c78e947dbca2487bae77adb65399c2985dce5cbc95f2672ca7e309b3a9f9ba4501d10b
- SSDEEP 48:ap2dvbxNvcfDQ9mZpzm+pcG6mfjjCSCe:3hvGQQZE+N6mrjCt
- MD5 SHA1 SHA512 SSDEEP