e17c059a2ec3153241f4cddf8081f19e83af890cb9126f3e1528474c29610786

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13/07/2023, 19:35

Target

parsec-windows.exe
Size

2.7MB
MD5

86c3e34147f64ca7b0bcfe4564317706
SHA1

dffbf6d25bcfe675fc314968a4413ba9757b6c25
SHA256

e17c059a2ec3153241f4cddf8081f19e83af890cb9126f3e1528474c29610786
SHA512

8d5f2efa99de7c6275162927b77dc3b5d640fbd18d771cff71ee7bd3cb8009d87fa23b8f29113d15aaca17b7aaa33a440434ba1ac2db7c1998d14673d31d4e5c
SSDEEP

49152:P3myVbHOO2Q4gSrF32OL5OsrcnWYBR959Cenopym7r4bvwfIr+Z4NJU/EPM/Ob:PWyBH52oYZLTrcWYn959CeTIIr+eXUSf

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2780	parsec-windows.exe

C:\Users\Admin\AppData\Local\Temp\parsec-windows.exe
"C:\Users\Admin\AppData\Local\Temp\parsec-windows.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2780

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact