Edit tour

Windows Analysis Report
PlasmaSetup@LR_2.exe

Overview

General Information

Sample name:	PlasmaSetup@LR_2.exe
Analysis ID:	1579303
MD5:	3443898e0b0bd2a27c1bcebfe41b702e
SHA1:	3d83edc844cb4c011e9a5a554fe99a6f128e21ca
SHA256:	de4c90695da23b3ed3a399bf5cdc2e5f85f3c074180480b19fb54dcb0ece007f
Infos:

Detection

Score:	25
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Signatures

Machine Learning detection for dropped file

Checks if the current process is being debugged

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Stores files to the Windows start menu directory

Uses 32bit PE files

Classification

Process Tree

System is w10x64_ra

PlasmaSetup@LR_2.exe (PID: 7028 cmdline: "C:\Users\user\Desktop\PlasmaSetup@LR_2.exe" MD5: 3443898E0B0BD2A27C1BCEBFE41B702E)

pbrowser.exe (PID: 6488 cmdline: "C:\Plasma\pbrowser.exe" MD5: 0FFB6543E6E60C895920EFD6BB947630)

pmanager.exe (PID: 4856 cmdline: "C:\Plasma\pmanager.exe" MD5: 577686D8E6EDA9E05504BDD0A2E12BE7)

WerFault.exe (PID: 5564 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 648 MD5: C31336C1EFC2CCB44B4326EA793040F2)

pmanager.exe (PID: 5076 cmdline: "C:\Plasma\pmanager.exe" MD5: 577686D8E6EDA9E05504BDD0A2E12BE7)

WerFault.exe (PID: 5552 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 624 MD5: C31336C1EFC2CCB44B4326EA793040F2)

pbrowser.exe (PID: 6004 cmdline: "C:\Plasma\pbrowser.exe" MD5: 0FFB6543E6E60C895920EFD6BB947630)

pmanager.exe (PID: 3916 cmdline: "C:\Plasma\pmanager.exe" MD5: 577686D8E6EDA9E05504BDD0A2E12BE7)

WerFault.exe (PID: 1820 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 620 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.1448474464.0000000000401000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000010.00000002.1655947520.0000000000401000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Machine Learning detection for dropped file

Source: C:\Plasma\Switcher.exe	Joe Sandbox ML: detected
Source: C:\Plasma\pmarquee.exe	Joe Sandbox ML: detected
Source: C:\Plasma\Switcher.exe	Joe Sandbox ML: detected
Source: C:\Plasma\pmarquee.exe	Joe Sandbox ML: detected
Source: C:\Plasma\Switcher.exe	Joe Sandbox ML: detected
Source: C:\Plasma\pmarquee.exe	Joe Sandbox ML: detected
Source: C:\Plasma\Switcher.exe	Joe Sandbox ML: detected
Source: C:\Plasma\pmarquee.exe	Joe Sandbox ML: detected

Source: PlasmaSetup@LR_2.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\PlasmaSetup@LR_2.exe	File opened: C:\Users\user\AppData\Local\Temp\nsc7F3F.tmp\
Source: C:\Users\user\Desktop\PlasmaSetup@LR_2.exe	File opened: C:\Users\user\AppData\Local\
Source: C:\Users\user\Desktop\PlasmaSetup@LR_2.exe	File opened: C:\Users\user\AppData\
Source: C:\Users\user\Desktop\PlasmaSetup@LR_2.exe	File opened: C:\Users\user\
Source: C:\Users\user\Desktop\PlasmaSetup@LR_2.exe	File opened: C:\Users\user\AppData\Local\Temp\nsc7F3F.tmp\LangDLL.dll
Source: C:\Users\user\Desktop\PlasmaSetup@LR_2.exe	File opened: C:\Users\user\AppData\Local\Temp\

Source: C:\Plasma\pmanager.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 648

Source: PlasmaSetup@LR_2.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: sus25.winEXE@9/46@0/11