General
- Target parsec-windows.exe
- Size 4.2MB
- Sample260620-3eysnaat3j
- SHA256 350dd7a6b66a6cde791716eedc34773738893d0cc6ee810b0afdfcd94aad9782
Malware Config
Targets
-
- Target parsec-windows.exe
- Size 4.2MB
- SHA256 350dd7a6b66a6cde791716eedc34773738893d0cc6ee810b0afdfcd94aad9782
Score8/10-
Drops file in Drivers directory
-
Creates new service(s)
-
Stops running service(s)
-
Adds Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies Windows Firewall
-
Drops file in System32 directory
-
- Target $PLUGINSDIR/ApplicationID.dll
- Size 196KB
- SHA256 1462a072345e86318b981089b08b613a34027ddf527bfb66606c683f218fc3b4
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
Score3/10 -
- Target parsecd.exe
- Size 504KB
- SHA256 a0fe7af829aef549ab876b6f95ca3406b35335fafb4c06a2d5cd407e6bc6c677
Score1/10 -
- Target pservice.exe
- Size 425KB
- SHA256 d054e3d51aca109ee08e0dba5ecf187548cf9f87dfd4aba8c54848014e5ba602
Score1/10 -
- Target skel/parsecd-150-101b.dll
- Size 5.9MB
- SHA256 8418ed1a636fb8c9a4078fe327c31785315038861d241bea423e7385b172ed8d
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target teams.exe
- Size 342KB
- SHA256 6dc71b2e92b770dcfeca4a32c8f1787210311f731f1124754df193ec22d5d13e
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target vdd/parsec-vdd.exe
- Size 505KB
- SHA256 e23332448fdaf5aa017cb308db5ef6855fac526a7ded05d80c039404126d5362
Score8/10-
Drops file in Drivers directory
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
Score3/10 -
- Target driver/mm.dll
- Size 169KB
- SHA256 96db6ae2f950b56e52be3e68f92893afa94645eae09fea2abd5dd1985758150a
Score1/10 -
- Target nefconw.exe
- Size 574KB
- SHA256 cf746d1b0bbb713993d4a90dccd774c78d9fff8c2ba5a054b6c8f56c77e1eee1
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target vddinstall.bat
- Size 420B
- SHA256 1e7c35eb6c296f96aee5ae4bbbd40395e8019bde95ef9bef91260dd8ef03c6d1
Score8/10-
Drops file in Drivers directory
-
Drops file in System32 directory
-
- Target vdduninstall.bat
- Size 272B
- SHA256 8f503e40a32959d9d2ee5a9e2a3da627f6ed158e6c87c47ef17f1e5d74f47b9a
Score4/10 -
- Target vusb/parsec-vud.exe
- Size 892KB
- SHA256 f8db024b61c36e5d45ca5b485bf855dbfe1d0523333158e873d7deb4d86ec0e4
Score8/10-
Drops file in Drivers directory
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
3