ae654731f8e85ec41a77edbfad7ec0064497421803fbc5105ca8a935af57fd6e

Analysis

max time kernel
127s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-03-2023 23:51

Target

parsec-windows.exe
Size

2.7MB
MD5

b49af1859c41d9178c4af8b330d64741
SHA1

1272d1cd56010a813e05bcb32d8cf824e8a5e725
SHA256

ae654731f8e85ec41a77edbfad7ec0064497421803fbc5105ca8a935af57fd6e
SHA512

238add2b5db89886e31e281fa633ac4657580c853b5f6750a6e6816ffb85551466abbe7589fe60e19c0fe57989258c99a658331a4e039b48a991a5d2f8cc66cc
SSDEEP

49152:MmRtVNwyndBmOrH+e/xsQjhtmZZcoANnuR+pAfkdE2WX8zPmK:3vhQ1st7oMpA92fmK

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
948	parsec-windows.exe

C:\Users\Admin\AppData\Local\Temp\parsec-windows.exe
"C:\Users\Admin\AppData\Local\Temp\parsec-windows.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:948

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact