Resubmissions
19-02-2023 20:42
230219-zg1s9age98 10Analysis
-
max time kernel
143s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
19-02-2023 20:42
Static task
static1
Behavioral task
behavioral1
Sample
angle.exe
Resource
win7-20221111-en
windows7-x64
9 signatures
150 seconds
General
-
Target
angle.exe
-
Size
3.9MB
-
MD5
40256ea622aa1d0678f5bde48b9aa0fb
-
SHA1
ba9dc2820ff412f06ca986dd03af1880d5a60f41
-
SHA256
c3a3c6015ffc1bc98b5a21f89e78049900e5796e67e098bead011a20a99e7b0d
-
SHA512
04f9be55aeb88ff4f11b786f10e1bbcfa5cc1cf0b54f56d2d68fe067b0ada592f6aac93148cfbfe23916bbbe581669befebc4e95630f8c3e76303bc8e69ff450
-
SSDEEP
6144:DYh6ApoWrujS9yeoh6VVK7xvYTMxgUHgufnKiXybpsb:0h6ApVruja5oh2K755KUH5nNXylS
Malware Config
Signatures
-
ParallaxRat payload 1 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral1/memory/268-60-0x0000000000400000-0x0000000000426000-memory.dmp parallax_rat -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Milk.exe DllHost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1728 angle.exe 1728 angle.exe 1728 angle.exe 1728 angle.exe 1728 angle.exe 1728 angle.exe 1728 angle.exe 1728 angle.exe 1728 angle.exe 1728 angle.exe 1728 angle.exe 1728 angle.exe 1728 angle.exe 1728 angle.exe 1728 angle.exe 1728 angle.exe 1728 angle.exe 1728 angle.exe 1728 angle.exe 1728 angle.exe 1728 angle.exe 1728 angle.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1312 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1312 Explorer.EXE 1312 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1312 Explorer.EXE 1312 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1728 wrote to memory of 268 1728 angle.exe 29 PID 1728 wrote to memory of 268 1728 angle.exe 29 PID 1728 wrote to memory of 268 1728 angle.exe 29 PID 1728 wrote to memory of 268 1728 angle.exe 29 PID 1728 wrote to memory of 268 1728 angle.exe 29 PID 1728 wrote to memory of 268 1728 angle.exe 29 PID 1728 wrote to memory of 268 1728 angle.exe 29 PID 1728 wrote to memory of 268 1728 angle.exe 29 PID 1728 wrote to memory of 268 1728 angle.exe 29 PID 1728 wrote to memory of 268 1728 angle.exe 29 PID 1728 wrote to memory of 268 1728 angle.exe 29 PID 1728 wrote to memory of 268 1728 angle.exe 29 PID 1728 wrote to memory of 268 1728 angle.exe 29 PID 1728 wrote to memory of 268 1728 angle.exe 29 PID 1728 wrote to memory of 268 1728 angle.exe 29 PID 1728 wrote to memory of 268 1728 angle.exe 29 PID 1728 wrote to memory of 1312 1728 angle.exe 17
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\angle.exe"C:\Users\Admin\AppData\Local\Temp\angle.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe"C:\Users\Admin\AppData\Local\Temp\angle.exe"3⤵PID:268
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
PID:952