c54bd2fc21cf8d23a83459c61dd11c20c3fd9f8249a43043f632324708b12259 | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
04-08-2022 19:06

Sharing

Report Analysis Logs

General

Target

Plasma.exe
Size

187KB
MD5

4d52a9b6c7929f699c0b331e9cbe7acc
SHA1

9ef3fe56b739ad6ddeb1e3dba83eb70593d1cfde
SHA256

c54bd2fc21cf8d23a83459c61dd11c20c3fd9f8249a43043f632324708b12259
SHA512

69c9c3a52e4d736c19352db2a3233df9ae3a11b879b5075e4a5173b4b36e3533f40a1d72173638a9f997bbf89f7a1637e86afaf49a2894677b0e986f66f64031

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1736-54-0x0000000000D50000-0x0000000000D94000-memory.dmp	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

848 1736 WerFault.exe Plasma.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Plasma.exe

pid process

1736 Plasma.exe
1736 Plasma.exe
1736 Plasma.exe
1736 Plasma.exe
1736 Plasma.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Plasma.exe

description pid process

Token: SeDebugPrivilege 1736 Plasma.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Plasma.exe

description	pid	process	target process
PID 1736 wrote to memory of 848	1736	Plasma.exe	WerFault.exe
PID 1736 wrote to memory of 848	1736	Plasma.exe	WerFault.exe
PID 1736 wrote to memory of 848	1736	Plasma.exe	WerFault.exe
PID 1736 wrote to memory of 848	1736	Plasma.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Plasma.exe
"C:\Users\Admin\AppData\Local\Temp\Plasma.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 1152
2⤵
- Program crash
PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-58-0x0000000000000000-mapping.dmp

Download
memory/1736-54-0x0000000000D50000-0x0000000000D94000-memory.dmp

Filesize
272KB

Download
memory/1736-56-0x0000000075D21000-0x0000000075D23000-memory.dmp

Filesize
8KB

Download
memory/1736-57-0x0000000009305000-0x0000000009316000-memory.dmp

Filesize
68KB

Download
memory/1736-59-0x0000000009305000-0x0000000009316000-memory.dmp

Filesize
68KB

Download