Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 06:13
Static task
static1
Behavioral task
behavioral1
Sample
PlasmaPerm.exe
Resource
win7-20240903-en
General
-
Target
PlasmaPerm.exe
-
Size
2.0MB
-
MD5
53f60234d2f23b0a56a4c4d01c235281
-
SHA1
edcf730e5a6e9d251135217cab566fee8b2089ad
-
SHA256
157022d90bfb8809c6f371c36d54fb90650dda68241f85890983e2a0c0021dc7
-
SHA512
465290c68b38991ba454c2149704330557496cd63951ca80b6520dfe9c8121a8a99e8ead8125fbc7462f514ee4994fcd2c70d57c30e87be106a5d71f98105461
-
SSDEEP
49152:LyFS0D21lmt9V7dmKZ+I/AjVMm5MVHWlC0g/2sv:o5sl89V7D+I/aMm5MmC0gusv
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions PlasmaPerm.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools PlasmaPerm.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion PlasmaPerm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion PlasmaPerm.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 PlasmaPerm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum PlasmaPerm.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PlasmaPerm.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion PlasmaPerm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS PlasmaPerm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer PlasmaPerm.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 PlasmaPerm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 PlasmaPerm.exe -
Suspicious behavior: EnumeratesProcesses 53 IoCs
pid Process 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe 3036 PlasmaPerm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3036 PlasmaPerm.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3036 PlasmaPerm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PlasmaPerm.exe"C:\Users\Admin\AppData\Local\Temp\PlasmaPerm.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3036
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2