Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-03-2024 21:21

General

  • Target

    Parrot.exe

  • Size

    51KB

  • MD5

    73d35451dbfbba5ac051d36f095a629f

  • SHA1

    0a1c087e6f91506f96e284b89d99a283d650de07

  • SHA256

    af983d2bf8f90fe563159983521b110e8560a409391254cb8ba7662df88fa3c3

  • SHA512

    9d74bb098aafa7cf3a9dee0f9a0638015d4be8ea26631082db810560748d2da85607d3bc67c9d75cfa2642e93dca3e0b0c6d214b38176a3b6ac2ba44cbe27836

  • SSDEEP

    768:oN2SaAr2oCgNHt9WoxayWIHZuvxulndbdb+UWEkrRNK+rR8NeJf9XR6idH6A3s:oASnrpNHt9bUYoWdbdb+VEkr+WXdHvc

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Parrot.exe
    "C:\Users\Admin\AppData\Local\Temp\Parrot.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
      2⤵
        PID:2912
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Windows\parrot.mp3"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3912
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x154 0x4b8
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2372

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\parrot.mp3

      Filesize

      8KB

      MD5

      ab4ee6036a4bd4db7808838411c44ac9

      SHA1

      7fcad4012fe4976e0d14828a58814acfa33136f5

      SHA256

      b5f09e2de74cbcc29b92612ded3ed2e24fdf5c6704d3ccb888a663dcb8c75da4

      SHA512

      b1ddcf096161e67ccdad111a1d2cae34b955abf6aa8cae9c4bc9c0fc65491a5b6f6537b16fca28e8034f1db3cc55ddccb963c51c9133f3b79d5d2baa06043354

    • C:\mail.vbs

      Filesize

      671B

      MD5

      0fb2174f62406bf056bb79fc7a11d855

      SHA1

      356e41229d24c51f6ee723d2db936e13db770508

      SHA256

      2e4986c2fa63e89e96492fdf7aaed9f82edf54039ee9d6f073e39f1290da4e8e

      SHA512

      b939ee5ea959212d2b777868a5bb843981e9873885bf4eb2900c0fc638bcd3d6e24fbe495ec68839512578e9246f89052f17e1d2a101a1b5e737b63f565bf6fa

    • memory/3912-36-0x00007FF647F30000-0x00007FF648028000-memory.dmp

      Filesize

      992KB

    • memory/3912-37-0x00007FFD05680000-0x00007FFD056B4000-memory.dmp

      Filesize

      208KB

    • memory/3912-38-0x00007FFCF2650000-0x00007FFCF2904000-memory.dmp

      Filesize

      2.7MB

    • memory/3912-40-0x00007FFD025A0000-0x00007FFD025B7000-memory.dmp

      Filesize

      92KB

    • memory/3912-39-0x00007FFD05660000-0x00007FFD05678000-memory.dmp

      Filesize

      96KB

    • memory/3912-41-0x00007FFD02580000-0x00007FFD02591000-memory.dmp

      Filesize

      68KB

    • memory/3912-42-0x00007FFD023D0000-0x00007FFD023E7000-memory.dmp

      Filesize

      92KB

    • memory/3912-43-0x00007FFD023B0000-0x00007FFD023C1000-memory.dmp

      Filesize

      68KB

    • memory/3912-44-0x00007FFD02390000-0x00007FFD023AD000-memory.dmp

      Filesize

      116KB

    • memory/3912-45-0x00007FFD02370000-0x00007FFD02381000-memory.dmp

      Filesize

      68KB

    • memory/3912-46-0x00007FFCF2450000-0x00007FFCF2650000-memory.dmp

      Filesize

      2.0MB

    • memory/3912-47-0x00007FFCF13A0000-0x00007FFCF244B000-memory.dmp

      Filesize

      16.7MB

    • memory/3912-48-0x00007FFD021A0000-0x00007FFD021DF000-memory.dmp

      Filesize

      252KB

    • memory/3912-49-0x00007FFD02340000-0x00007FFD02361000-memory.dmp

      Filesize

      132KB

    • memory/3912-51-0x00007FFD02160000-0x00007FFD02171000-memory.dmp

      Filesize

      68KB

    • memory/3912-50-0x00007FFD02180000-0x00007FFD02198000-memory.dmp

      Filesize

      96KB

    • memory/3912-52-0x00007FFD02140000-0x00007FFD02151000-memory.dmp

      Filesize

      68KB

    • memory/3912-53-0x00007FFD02120000-0x00007FFD02131000-memory.dmp

      Filesize

      68KB

    • memory/3912-54-0x00007FFD02100000-0x00007FFD0211B000-memory.dmp

      Filesize

      108KB

    • memory/3912-56-0x00007FFD02000000-0x00007FFD02018000-memory.dmp

      Filesize

      96KB

    • memory/3912-55-0x00007FFD02020000-0x00007FFD02031000-memory.dmp

      Filesize

      68KB

    • memory/3912-57-0x00007FFD01FD0000-0x00007FFD02000000-memory.dmp

      Filesize

      192KB

    • memory/3912-58-0x00007FFD01F60000-0x00007FFD01FC7000-memory.dmp

      Filesize

      412KB

    • memory/3912-59-0x00007FFD017B0000-0x00007FFD0181F000-memory.dmp

      Filesize

      444KB

    • memory/3912-60-0x00007FFD01F20000-0x00007FFD01F31000-memory.dmp

      Filesize

      68KB

    • memory/3912-62-0x00007FFD01770000-0x00007FFD01781000-memory.dmp

      Filesize

      68KB

    • memory/3912-61-0x00007FFD01790000-0x00007FFD017A7000-memory.dmp

      Filesize

      92KB

    • memory/3912-63-0x00007FFD01710000-0x00007FFD01767000-memory.dmp

      Filesize

      348KB

    • memory/3912-64-0x00007FFCF8530000-0x00007FFCF855F000-memory.dmp

      Filesize

      188KB

    • memory/3912-65-0x00007FFD016F0000-0x00007FFD01703000-memory.dmp

      Filesize

      76KB

    • memory/3912-66-0x00007FFCFEEA0000-0x00007FFCFEEB1000-memory.dmp

      Filesize

      68KB

    • memory/3912-67-0x00007FFCF12D0000-0x00007FFCF1395000-memory.dmp

      Filesize

      788KB

    • memory/3912-68-0x00007FFCF8510000-0x00007FFCF8522000-memory.dmp

      Filesize

      72KB

    • memory/3912-69-0x00007FFCF84F0000-0x00007FFCF8501000-memory.dmp

      Filesize

      68KB

    • memory/3912-80-0x00007FFCF0DF0000-0x00007FFCF0E07000-memory.dmp

      Filesize

      92KB

    • memory/3912-79-0x00007FFCF0E10000-0x00007FFCF0E40000-memory.dmp

      Filesize

      192KB

    • memory/3912-78-0x00007FFCF0E40000-0x00007FFCF0E52000-memory.dmp

      Filesize

      72KB

    • memory/3912-77-0x00007FFCF0E60000-0x00007FFCF0E8C000-memory.dmp

      Filesize

      176KB

    • memory/3912-76-0x00007FFCF0E90000-0x00007FFCF0EA4000-memory.dmp

      Filesize

      80KB

    • memory/3912-75-0x00007FFCF2F40000-0x00007FFCF2F55000-memory.dmp

      Filesize

      84KB

    • memory/3912-74-0x00007FFCF2F60000-0x00007FFCF2F76000-memory.dmp

      Filesize

      88KB

    • memory/3912-73-0x00007FFCF2F80000-0x00007FFCF2F9E000-memory.dmp

      Filesize

      120KB

    • memory/3912-72-0x00007FFCF2FA0000-0x00007FFCF2FB4000-memory.dmp

      Filesize

      80KB

    • memory/3912-71-0x00007FFCF2FC0000-0x00007FFCF2FD2000-memory.dmp

      Filesize

      72KB

    • memory/3912-70-0x00007FFCF2FE0000-0x00007FFCF2FF4000-memory.dmp

      Filesize

      80KB

    • memory/3912-81-0x00007FFCEF640000-0x00007FFCF0DF0000-memory.dmp

      Filesize

      23.7MB

    • memory/3912-84-0x00007FFCEF480000-0x00007FFCEF5F8000-memory.dmp

      Filesize

      1.5MB

    • memory/3912-82-0x00007FFCEF620000-0x00007FFCEF631000-memory.dmp

      Filesize

      68KB

    • memory/3912-83-0x00007FFCEF600000-0x00007FFCEF612000-memory.dmp

      Filesize

      72KB

    • memory/3912-85-0x00007FFCEF460000-0x00007FFCEF477000-memory.dmp

      Filesize

      92KB

    • memory/3912-86-0x00007FFCF1270000-0x00007FFCF12C6000-memory.dmp

      Filesize

      344KB

    • memory/3912-87-0x00007FFD02200000-0x00007FFD02228000-memory.dmp

      Filesize

      160KB

    • memory/3912-88-0x00007FFCF1240000-0x00007FFCF1264000-memory.dmp

      Filesize

      144KB

    • memory/3912-91-0x00007FFCF11C0000-0x00007FFCF1235000-memory.dmp

      Filesize

      468KB

    • memory/3912-92-0x00007FFCF1150000-0x00007FFCF11B2000-memory.dmp

      Filesize

      392KB

    • memory/3912-90-0x00007FFD021E0000-0x00007FFD021F6000-memory.dmp

      Filesize

      88KB

    • memory/3912-89-0x00007FFD07870000-0x00007FFD07880000-memory.dmp

      Filesize

      64KB

    • memory/3912-93-0x00007FFCF10E0000-0x00007FFCF114D000-memory.dmp

      Filesize

      436KB

    • memory/3912-94-0x00007FFCF10C0000-0x00007FFCF10D5000-memory.dmp

      Filesize

      84KB

    • memory/3912-96-0x00007FFCEE890000-0x00007FFCEE8A2000-memory.dmp

      Filesize

      72KB

    • memory/3912-97-0x00007FFCEE710000-0x00007FFCEE88A000-memory.dmp

      Filesize

      1.5MB

    • memory/3912-95-0x00007FFCEE8B0000-0x00007FFCEE8C1000-memory.dmp

      Filesize

      68KB

    • memory/3912-98-0x00007FFCEE6F0000-0x00007FFCEE703000-memory.dmp

      Filesize

      76KB

    • memory/4648-0-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/4648-27-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB