Analysis
- max time kernel
150s - max time network
136s - platform
windows10_x64 - resource
win10 - submitted
07/07/2020, 06:27
Static task
static1
Behavioral task
behavioral1
Sample
Parpack S.A.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Parpack S.A.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target Parpack S.A.exe
- Size 611KB
- Sample200707-pd3hyye3ma
- SHA256 b73caeffe98a9035eefe1465bf9c883f306372f8b4ca2d18973fc18277781363
- MD5 ed04b51ebb84647385acfcb066ff8ce1
- SHA1 fe2b40b2bfe4e92a8658895e9c571e02d0b90b2a
- SHA512 d6ded25b3e61f0b34fad695cc719d44168f3b3d0a0b82ca3e5ef2ee14f393c2fa0117239a51886e006ffc064609c0021cb10064de520b8a1ca03b719011bedb9
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 4072 Parpack S.A.exe 4072 Parpack S.A.exe 4072 Parpack S.A.exe 4072 Parpack S.A.exe 4072 Parpack S.A.exe 4072 Parpack S.A.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 4072 Parpack S.A.exe 4072 Parpack S.A.exe 4072 Parpack S.A.exe 4072 Parpack S.A.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe 3868 netsh.exe - Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run netsh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\R0XL6TP0641 = "C:\\Program Files (x86)\\Gtz-t4zix\\IconCacherbc.exe" netsh.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Gtz-t4zix\IconCacherbc.exe netsh.exe - System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer netsh.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3888 wrote to memory of 4072 3888 Parpack S.A.exe 67 PID 3888 wrote to memory of 4072 3888 Parpack S.A.exe 67 PID 3888 wrote to memory of 4072 3888 Parpack S.A.exe 67 PID 3888 wrote to memory of 4072 3888 Parpack S.A.exe 67 PID 3888 wrote to memory of 4072 3888 Parpack S.A.exe 67 PID 3888 wrote to memory of 4072 3888 Parpack S.A.exe 67 PID 2976 wrote to memory of 3868 2976 Explorer.EXE 68 PID 2976 wrote to memory of 3868 2976 Explorer.EXE 68 PID 2976 wrote to memory of 3868 2976 Explorer.EXE 68 PID 3868 wrote to memory of 3264 3868 netsh.exe 69 PID 3868 wrote to memory of 3264 3868 netsh.exe 69 PID 3868 wrote to memory of 3264 3868 netsh.exe 69 PID 3868 wrote to memory of 64 3868 netsh.exe 77 PID 3868 wrote to memory of 64 3868 netsh.exe 77 PID 3868 wrote to memory of 64 3868 netsh.exe 77 PID 3868 wrote to memory of 1224 3868 netsh.exe 79 PID 3868 wrote to memory of 1224 3868 netsh.exe 79 PID 3868 wrote to memory of 1224 3868 netsh.exe 79 - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3888 set thread context of 4072 3888 Parpack S.A.exe 67 PID 4072 set thread context of 2976 4072 Parpack S.A.exe 56 PID 4072 set thread context of 2976 4072 Parpack S.A.exe 56 PID 3868 set thread context of 2976 3868 netsh.exe 56 - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 4072 Parpack S.A.exe Token: SeDebugPrivilege 3868 netsh.exe Token: SeShutdownPrivilege 2976 Explorer.EXE Token: SeCreatePagefilePrivilege 2976 Explorer.EXE Token: SeShutdownPrivilege 2976 Explorer.EXE Token: SeCreatePagefilePrivilege 2976 Explorer.EXE Token: SeShutdownPrivilege 2976 Explorer.EXE Token: SeCreatePagefilePrivilege 2976 Explorer.EXE Token: SeShutdownPrivilege 2976 Explorer.EXE Token: SeCreatePagefilePrivilege 2976 Explorer.EXE -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 netsh.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\Parpack S.A.exe"C:\Users\Admin\AppData\Local\Temp\Parpack S.A.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\Parpack S.A.exe"C:\Users\Admin\AppData\Local\Temp\Parpack S.A.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4072
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Adds Run entry to policy start application
- Drops file in Program Files directory
- System policy modification
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Modifies Internet Explorer settings
PID:3868 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Parpack S.A.exe"3⤵PID:3264
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:64
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1224
-
-