350dd7a6b66a6cde791716eedc34773738893d0cc6ee810b0afdfcd94aad9782

Sharing

Copy URL Twitter E-mail

General

Target
parsec-windows.exe
Size 4.2MB
Sample260509-e4g97sdz6m
SHA256 350dd7a6b66a6cde791716eedc34773738893d0cc6ee810b0afdfcd94aad9782
MD5 3bbf732e82b4b2705fd9d43055309b1b
SHA1 cb31b95746bb7102f2a6d3049c2dbfdeef128f44
SHA512 3a4409458df178a9ef2ba73472ed1f40e6897cbdefb02f9c075060b72c78d58a9e4caf2e90cd248acb24701a7dbb4c399454ebfc4527eb7849d5337e2c6076ad
SSDEEP 98304:99jnof7+RYa4tjaRUtCbTZRuGZZDT/miwn19zi:99jn4npjWtrli9m
TLSH
T1A41633BBB1F9B13AD4A2113D0F2ADA5C16D4BE1B0AC31BF7764072287174E81492D5BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  parsec-windows.exe
- Size 4.2MB
- SHA256 350dd7a6b66a6cde791716eedc34773738893d0cc6ee810b0afdfcd94aad9782
- MD5 3bbf732e82b4b2705fd9d43055309b1b
- SHA1 cb31b95746bb7102f2a6d3049c2dbfdeef128f44
- SHA512 3a4409458df178a9ef2ba73472ed1f40e6897cbdefb02f9c075060b72c78d58a9e4caf2e90cd248acb24701a7dbb4c399454ebfc4527eb7849d5337e2c6076ad
- SSDEEP 98304:99jnof7+RYa4tjaRUtCbTZRuGZZDT/miwn19zi:99jn4npjWtrli9m
- TLSH
  T1A41633BBB1F9B13AD4A2113D0F2ADA5C16D4BE1B0AC31BF7764072287174E81492D5BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/ApplicationID.dll
- Size 196KB
- SHA256 1462a072345e86318b981089b08b613a34027ddf527bfb66606c683f218fc3b4
- MD5 a858c1a57e32485505b1977cf0a125be
- SHA1 25d86c4b51f7cc10fc70e3a0493a39c4460cc350
- SHA512 32b597fc2412a9407fd12ac77c556ff9740f1dd0d2055426d11a7baf21b09c536a84cfb97865b4e94168656514e7ce71eb2bc4122aa340100f4ce483bad1722d
- SSDEEP 3072:2pBNN6AmU9cDlKd3P6V9nSm49WTgKg4Fa1V3FuXRAuAg0FubA9cVsL+73:2pzxmQ3yL+9MgKbxAOEXY
- TLSH
  T1B9147D10B491C472D1BF16340979ABA15B3CBD600BA89AEFA7D84D6E4F781C06B31B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- TLSH
  T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
- MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
- SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
- SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
- SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
- TLSH
  T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
- MD5 11092c1d3fbb449a60695c44f9f3d183
- SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
- SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
- SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
- TLSH
  T1D5E1093571C02DF7D08D897438167D2F43F4D52627BA05B046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  parsecd.exe
- Size 504KB
- SHA256 a0fe7af829aef549ab876b6f95ca3406b35335fafb4c06a2d5cd407e6bc6c677
- MD5 b2570b8597d021d74c41426516d1a942
- SHA1 1acf13ee940cb13e4d24a5daff3af3a19563a95e
- SHA512 b6374f8831a3d8aedf43b18832e72403e2bb8acb1df81fe726d9531a352a706877cdc48cf42a0f8eac76e695ca9680342f1392553f11222b7a2443423a99d316
- SSDEEP 6144:GyJkoTThgYkYB2kyTEW1xdW10Ymy0T1SVZByXTkkjvGms7X5c9U:Fh5gYkYgQOdW103fT4VZByDt+msja9U
- TLSH
  T1C1B428BB72E5B4B4D4A2827D8F54861DD6E13C1307D387BB2360732A2A23E91493D677
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  pservice.exe
- Size 425KB
- SHA256 d054e3d51aca109ee08e0dba5ecf187548cf9f87dfd4aba8c54848014e5ba602
- MD5 a124bf2c181267a8ef2ba952e3f547a5
- SHA1 e01bf2d2d4db3daace3639b380b027e96c68597b
- SHA512 5625d61ed50449f2b6455371232a596ba6ba8b6405c714d49d2e94c2e0cb47202624efa7eb974c3efc3b0f7e3c62ea67338f0861ac86ef023349642d97ee51e2
- SSDEEP 3072:2imvkgixXaLRO9l3WvJn3pM36w5kNpaycgMkVCxg3iSlDg5d+UTvGmRe8wn7slKq:2rvBOXJ3Wx3prSClDgfjvGms7X5OX
- TLSH
  T16F94197B72E5B0F4D0A2927D8F50861D96E27C231BD307BB2250733A9A32E81593D677
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  setup.json
- Size 31B
- SHA256 79e608e6eabc337b047ff0c44f8098f2e6170f0d8d59fab39e10c089ac0f3d6d
- MD5 9e2f6ce3148593bb25fd6725967b446b
- SHA1 d566b37006bc817d066bbe7e332f699ae296d8b3
- SHA512 cab70498ed2de662d1d735f6a0d550bdb02d07ee0d036fb4e4e4bb549fcb141ba343e7463ed6f829bea8227f0ab9c46e11999632a113a299b5e6ff976ac2213b
- MD5 SHA1 SHA512
Score

3^/10
behavioral15 behavioral16
- Target
  skel/appdata.json
- Size 156B
- SHA256 f22e6a7b4eb40a0f37cbe50b6feb9294335293e797404e7498a8b2e58c45d224
- MD5 79c10cc224f49706f8b7f651e2fc65a7
- SHA1 e4e65b551d4720cbc76a858c95be90b315bc4984
- SHA512 7ddd64d9b208e7dd3ba5850e6c7fa2fbe4167942185bf44c7ec75c4bbd8f87d0fb92b1ad056b77540e3273fae307be97148b31f48f8da823139d45a8fe443678
- TLSH
  T168C08C228818045B46B1E2DE40020C83920A034B06E48A0A303026CC0F22A06E1A7B89
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  skel/parsecd-150-101b.dll
- Size 5.9MB
- SHA256 8418ed1a636fb8c9a4078fe327c31785315038861d241bea423e7385b172ed8d
- MD5 3796012afeb63c6250452a75fad64046
- SHA1 8af053bd79979e9a8206a93c356b60e38838db2c
- SHA512 89b67900c4406a47e1546ebe60420c9f87c689f3815bf20e6eef5b6107b1ec8ffed65f50484db23d381c0fdd9758c4bbf2291b4dff131948350de9e30b6c2557
- SSDEEP 49152:ioLJzr+TSe9rgqGTMXYKnQm4n8CHQYMcDTVSTHWLdbq2JDE55lqK2KKEWVYSe21l:ilJ2EfOBz0I8bJZ+X
- TLSH
  T163569E37A3E511B8C66681388F47531BE6B17C4517E157EB02E45A292F63FE00ABE732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral19 behavioral20
- Target
  teams.exe
- Size 342KB
- SHA256 6dc71b2e92b770dcfeca4a32c8f1787210311f731f1124754df193ec22d5d13e
- MD5 faa24223985abfbf64e4ddcd43f062d3
- SHA1 e1374dc7c98405efc5a44aa3229b97eabdd69bb2
- SHA512 23324afcb51508f5ea3f120a5787b150a8226d677c5a55fef219674b4d619fd0d7300d2b4cad917864d5f54788b9c8546db2a77aa4f0d666a956014169c4a6c9
- SSDEEP 6144:GAR9duE83BYjyEbU1SDgFg8EwkSdbAxD22y6jvGmp:H9gp3WjyEbU1SDAgJw40c+mp
- TLSH
  T1BD7429BB72E478F4E4A2423D8F11860DD6F17C1346D38BBB229072669E23E905D29777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  vdd/parsec-vdd.exe
- Size 505KB
- SHA256 e23332448fdaf5aa017cb308db5ef6855fac526a7ded05d80c039404126d5362
- MD5 4b9a3048286692a865187013b70f44e8
- SHA1 eefe91d9702314341acccd828fe4edb6ee570d7b
- SHA512 a38b9a0a1626d9f40ff2c718717a793108c7e773b25493cc53c595e6b9840cc4de66587549f43ce00569b368834327184a90d55da3c4ae0e269e1d0edef6238d
- SSDEEP 12288:QbLQNEFqf6MouZQqdF9zuAkDjdCjXHSZz2AKhAOYYA:QbUNEFKXrZ6ZjdFZxKhAOYv
- TLSH
  T1B8B423629E70C033CBF70F3152B9E55A0B7DDE2DE5159AD30314FD4A3D32A84992AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery
- Drops file in Drivers directory
- Drops file in System32 directory
behavioral23 behavioral24
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
- MD5 675c4948e1efc929edcabfe67148eddd
- SHA1 f5bdd2c4329ed2732ecfe3423c3cc482606eb28e
- SHA512 61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683
- SSDEEP 96:J9zdzBzMDByZtr/HDQIUIq9m6v6vBckzu9wSBpLEgvElHlernNQaSGYuH2DQ:JykDr/HA5v6G2IElFernNQZGdHW
- TLSH
  T15EE10A3574C02CF7D0CD49743816791B83F4C52527BA05B04A7B1AD576E1AE7FE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  driver/mm.cat
- Size 11KB
- SHA256 136e64ac07dce5a3b4935d5a9c5cfe03983c0b3065f46a30a45536d5b1681d5c
- MD5 1fe1fc7cc73fb17e995d65835d51ca94
- SHA1 249acf0a3a362b2163127bd76f6d4d6aa463297d
- SHA512 31fe1bdcb5f243a6eecc40006fc70793bc5aea9d95ffe449117cb67366f0f120c393716ffe93b65a73c8b2dfe02917f1d0dcf4ca62aa302fe685513b8cc80bdc
- SSDEEP 192:27bR3HCkJC9aJ9EwvZvhYC3kn5NQlO8X01k9z3AwkqY:aRJZvh3Un5KlO8R9zJkqY
- TLSH
  T1093219B1896841C2F9677C6093E8F9973C3D27C7582044A6269FFB190CA73C4FB2826D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral29 behavioral30
- Target
  driver/mm.dll
- Size 169KB
- SHA256 96db6ae2f950b56e52be3e68f92893afa94645eae09fea2abd5dd1985758150a
- MD5 f09967cc8cc9bf03612ddecb6bf86daa
- SHA1 166f8e3000b6a1e2b13b46e85b7559b9837b9aa7
- SHA512 190d2edea81c42a2d7a5bc69cb98f03368e702a5fcb3fc1dcd4e9c387687bab542e4b0e5de67292e8b8a7efed7fd9e30d1efdd35bcdfea28417de71db0e13864
- SSDEEP 3072:3zx0G2cnU93aR9bN9m3KUrru7qqybewIvUZdRfCzzr/:3zS9w9m3KUHAVvUZWXz
- TLSH
  T1FB042964B7B420A1E9FB8670CBB209D3F6B971022F2056DF11A481690FA7BF4A53D35C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  driver/mm.inf
- Size 4KB
- SHA256 34da9ff45c13577631f67e33d11b8a26e3d22ca685d00c388b6122a795800588
- MD5 d8030afe09a2f984be00389b31f7039b
- SHA1 ab7a55fa6641cc31b0b7e70c8680bbbd553fc8a1
- SHA512 0787e9e95369686b20bcbddb9ff984111c4ed53a064fc8f198691db5c124dfbe1b1f4d434dbfd81482545b723c01325ed9bcc626f461191b3ae4095222df10a6
- SSDEEP 48:MoXx6bEEAkWfd6QxVO2X2iI+xCPOgbqGSW8nijzXk0m0hX:K4zDI+xCP1SW8niXX
- TLSH
  T14281A082A3DC0208B1F36E84EBF550B65A227C99593CE65D11E442DA5AF0E40DAF37E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Drops file in Drivers directory

Drops file in System32 directory

Badlisted process makes network request

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32