c54bd2fc21cf8d23a83459c61dd11c20c3fd9f8249a43043f632324708b12259 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
04-08-2022 19:06

Sharing

Report Analysis Logs

General

Target

Plasma.exe
Size

187KB
MD5

4d52a9b6c7929f699c0b331e9cbe7acc
SHA1

9ef3fe56b739ad6ddeb1e3dba83eb70593d1cfde
SHA256

c54bd2fc21cf8d23a83459c61dd11c20c3fd9f8249a43043f632324708b12259
SHA512

69c9c3a52e4d736c19352db2a3233df9ae3a11b879b5075e4a5173b4b36e3533f40a1d72173638a9f997bbf89f7a1637e86afaf49a2894677b0e986f66f64031

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/828-54-0x0000000000C80000-0x0000000000CC4000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1476 828 WerFault.exe Plasma.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Plasma.exe

pid process

828 Plasma.exe
828 Plasma.exe
828 Plasma.exe
828 Plasma.exe
828 Plasma.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Plasma.exe

description pid process

Token: SeDebugPrivilege 828 Plasma.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Plasma.exe

description	pid	process	target process
PID 828 wrote to memory of 1476	828	Plasma.exe	WerFault.exe
PID 828 wrote to memory of 1476	828	Plasma.exe	WerFault.exe
PID 828 wrote to memory of 1476	828	Plasma.exe	WerFault.exe
PID 828 wrote to memory of 1476	828	Plasma.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Plasma.exe
"C:\Users\Admin\AppData\Local\Temp\Plasma.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 1148
2⤵
- Program crash
PID:1476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-54-0x0000000000C80000-0x0000000000CC4000-memory.dmp

Filesize
272KB

Download
memory/828-56-0x0000000075761000-0x0000000075763000-memory.dmp

Filesize
8KB

Download
memory/828-57-0x0000000009215000-0x0000000009226000-memory.dmp

Filesize
68KB

Download
memory/828-59-0x0000000009215000-0x0000000009226000-memory.dmp

Filesize
68KB

Download
memory/1476-58-0x0000000000000000-mapping.dmp

Download