parallax | 2258485a001275cbcd9a02295be7876f036c6ae2df923ed5c00c3f07e32eb06a

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21/02/2025, 07:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe
Size

201KB
MD5

110e151e2f3c73e3446b514239d3f870
SHA1

081538124532e6fa5e1850ff981974dd572486a1
SHA256

2258485a001275cbcd9a02295be7876f036c6ae2df923ed5c00c3f07e32eb06a
SHA512

505a3554cd18d66f01c472479bc267c9e3b9d031109df88476aefe9829361d6ad4cb681346c79eb113328faa0b2589376b5903a5ea30387af4b1f2e08baec15c
SSDEEP

6144:Hza2Nj+MLxwkcWTq/81DDiSTz9nqEja3TXU0xtFl:HqEjk7l7Fl

Score

10^/10

parallax discovery persistence rat upx

Malware Config

Signatures

Parallax family
parallax
ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
rat parallax

Executes dropped EXE 2 IoCs

pid	Process
3248	security.exe
2276	security.exe

Loads dropped DLL 6 IoCs

pid	Process
880	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe
880	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe
880	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe
880	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe
880	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe
3248	security.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Security = "C:\\Users\\Admin\\AppData\\Roaming\\Security\\security.exe"	reg.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2268 set thread context of 880	2268	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe	31
PID 3248 set thread context of 2276	3248	security.exe	36
PID 3248 set thread context of 1920	3248	security.exe	37

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/880-364-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2276-783-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/880-786-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2276-790-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	security.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe
Token: SeDebugPrivilege	2276	security.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2268	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe
880	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe
3248	security.exe
2276	security.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 880	2268	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe	31
PID 2268 wrote to memory of 880	2268	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe	31
PID 2268 wrote to memory of 880	2268	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe	31
PID 2268 wrote to memory of 880	2268	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe	31
PID 2268 wrote to memory of 880	2268	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe	31
PID 2268 wrote to memory of 880	2268	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe	31
PID 2268 wrote to memory of 880	2268	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe	31
PID 2268 wrote to memory of 880	2268	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe	31
PID 880 wrote to memory of 3172	880	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe	32
PID 880 wrote to memory of 3172	880	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe	32
PID 880 wrote to memory of 3172	880	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe	32
PID 880 wrote to memory of 3172	880	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe	32
PID 3172 wrote to memory of 3224	3172	cmd.exe	34
PID 3172 wrote to memory of 3224	3172	cmd.exe	34
PID 3172 wrote to memory of 3224	3172	cmd.exe	34
PID 3172 wrote to memory of 3224	3172	cmd.exe	34
PID 880 wrote to memory of 3248	880	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe	35
PID 880 wrote to memory of 3248	880	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe	35
PID 880 wrote to memory of 3248	880	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe	35
PID 880 wrote to memory of 3248	880	JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe	35
PID 3248 wrote to memory of 2276	3248	security.exe	36
PID 3248 wrote to memory of 2276	3248	security.exe	36
PID 3248 wrote to memory of 2276	3248	security.exe	36
PID 3248 wrote to memory of 2276	3248	security.exe	36
PID 3248 wrote to memory of 2276	3248	security.exe	36
PID 3248 wrote to memory of 2276	3248	security.exe	36
PID 3248 wrote to memory of 2276	3248	security.exe	36
PID 3248 wrote to memory of 2276	3248	security.exe	36
PID 3248 wrote to memory of 1920	3248	security.exe	37
PID 3248 wrote to memory of 1920	3248	security.exe	37
PID 3248 wrote to memory of 1920	3248	security.exe	37
PID 3248 wrote to memory of 1920	3248	security.exe	37
PID 3248 wrote to memory of 1920	3248	security.exe	37
PID 3248 wrote to memory of 1920	3248	security.exe	37
PID 3248 wrote to memory of 1920	3248	security.exe	37
PID 3248 wrote to memory of 1920	3248	security.exe	37
PID 3248 wrote to memory of 1920	3248	security.exe	37

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_110e151e2f3c73e3446b514239d3f870.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\DINAM.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Security" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Security\security.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:3224
- - C:\Users\Admin\AppData\Roaming\Security\security.exe
    "C:\Users\Admin\AppData\Roaming\Security\security.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Users\Admin\AppData\Roaming\Security\security.exe
      "C:\Users\Admin\AppData\Roaming\Security\security.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2276
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      4⤵
      PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DINAM.bat

Filesize
147B

MD5
6f473a1ba53e043362047f72e20b34f4

SHA1
e8f121a589e1207ed950453376ee1d21b1223835

SHA256
5fbce2c77a90ba9edbcf60be3851ab81633b7c10b1babb624d475c7be589de4b

SHA512
b4976d40bc708ae6cddf367a5382cd532e4cf235b848cdaa4e4d317e06d9126e50745a7772591bc21dc7380689f4399e57501b0aa73cd231bce32e22d53b0818

Download Submit
\Users\Admin\AppData\Roaming\Security\security.exe

Filesize
201KB

MD5
19ec8318d739e001991124dd815207c6

SHA1
d90fe4383f3fb90e9cd04c542814728dc6c32889

SHA256
0db7a9138d5655ca87dc57239f1e2c4c133d74c87a4b01e3774f6956ba00a632

SHA512
18164d388bb77f9d538f6ea43cf798e03553f054a402f9819de4c4b779824838b35af32dbc42adfbdcf2251e06725d9dfeff197349fb99efb0b678f8b32e5944

Download Submit
memory/880-364-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/880-786-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2268-20-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2268-16-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2268-10-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2268-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2268-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2276-783-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2276-790-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads