Analysis
-
max time kernel
42s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14-06-2022 11:44
Static task
static1
Behavioral task
behavioral1
Sample
PhotoPad.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
PhotoPad.exe
-
Size
8.7MB
-
MD5
8b3e138741dd81aab4073a6b2fa350b5
-
SHA1
d93c39a4861a899190d9e7fbea1f19c01d7b23f6
-
SHA256
4c19118800b3e0e5897312c9aa2196bd44e48b72ec4c486c3e71dc56178eb2a5
-
SHA512
de3a6a99982cd45b844f4bbcb2d4067187bea72eb1b57cb9b448dd2a4ad5aacb0a7c8a6b8dca024783ed9b8cad24301402eab7af212fdbaa19e577a6e28a461b
Malware Config
Signatures
-
ParallaxRat payload 1 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral1/memory/1288-61-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pstd.exe DllHost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 1960 PhotoPad.exe 1960 PhotoPad.exe 1960 PhotoPad.exe 1960 PhotoPad.exe 1960 PhotoPad.exe 1960 PhotoPad.exe 1960 PhotoPad.exe 1960 PhotoPad.exe 1960 PhotoPad.exe 1960 PhotoPad.exe 1960 PhotoPad.exe 1960 PhotoPad.exe 1960 PhotoPad.exe 1960 PhotoPad.exe 1960 PhotoPad.exe 1960 PhotoPad.exe 1960 PhotoPad.exe 1960 PhotoPad.exe 1960 PhotoPad.exe 1960 PhotoPad.exe 1960 PhotoPad.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1960 wrote to memory of 1288 1960 PhotoPad.exe 29 PID 1960 wrote to memory of 1288 1960 PhotoPad.exe 29 PID 1960 wrote to memory of 1288 1960 PhotoPad.exe 29 PID 1960 wrote to memory of 1288 1960 PhotoPad.exe 29 PID 1960 wrote to memory of 1288 1960 PhotoPad.exe 29 PID 1960 wrote to memory of 1288 1960 PhotoPad.exe 29 PID 1960 wrote to memory of 1288 1960 PhotoPad.exe 29 PID 1960 wrote to memory of 1288 1960 PhotoPad.exe 29 PID 1960 wrote to memory of 1288 1960 PhotoPad.exe 29 PID 1960 wrote to memory of 1288 1960 PhotoPad.exe 29 PID 1960 wrote to memory of 1288 1960 PhotoPad.exe 29 PID 1960 wrote to memory of 1288 1960 PhotoPad.exe 29 PID 1960 wrote to memory of 1288 1960 PhotoPad.exe 29 PID 1960 wrote to memory of 1288 1960 PhotoPad.exe 29 PID 1960 wrote to memory of 1288 1960 PhotoPad.exe 29 PID 1960 wrote to memory of 1288 1960 PhotoPad.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\PhotoPad.exe"C:\Users\Admin\AppData\Local\Temp\PhotoPad.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe"C:\Users\Admin\AppData\Local\Temp\PhotoPad.exe"2⤵PID:1288
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
PID:1312