Overview

overview

6

Static

static

3

Paragon Tw...er.exe

windows10-2004-x64

4

Paragon Tw...er.exe

windows11-ltsc_2024-x64

4

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...al.ini

windows10-2004-x64

1

$PLUGINSDI...al.ini

windows11-ltsc_2024-x64

1

$PLUGINSDI...rd.bmp

windows10-2004-x64

1

$PLUGINSDI...rd.bmp

windows11-ltsc_2024-x64

1

$PLUGINSDI...ll.exe

windows10-2004-x64

1

$PLUGINSDI...ll.exe

windows11-ltsc_2024-x64

1

$PLUGINSDI...up.exe

windows10-2004-x64

6

$PLUGINSDI...up.exe

windows11-ltsc_2024-x64

6

Paragon Tw...ty.exe

windows10-2004-x64

6

Paragon Tw...ty.exe

windows11-ltsc_2024-x64

6

appicon.ico

windows10-2004-x64

3

appicon.ico

windows11-ltsc_2024-x64

3

ptu_ascens...er.exe

windows10-2004-x64

1

ptu_ascens...er.exe

windows11-ltsc_2024-x64

1

ptu_core.dll

windows10-2004-x64

1

ptu_core.dll

windows11-ltsc_2024-x64

1

updater/updater.exe

windows10-2004-x64

1

updater/updater.exe

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Paragon Tweaking Utility-4.4.2-amd64-installer.exe
  • Size 49.3MB
  • Sample260822-mx3xbstclc
  • SHA256 466b389348694a8376b3408f09ae2fb3f721bff2005ac8e9b6729aa1ba46c765
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywaretrojan

Malware Config

Targets

    • Target
      Paragon Tweaking Utility-4.4.2-amd64-installer.exe
    • Size 49.3MB
    • SHA256 466b389348694a8376b3408f09ae2fb3f721bff2005ac8e9b6729aa1ba46c765
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    defense_evasiondiscoveryspywaretrojan
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/InstallOptions.dll
    • Size 15KB
    • SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/ioSpecial.ini
    • Size 211B
    • SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/modern-wizard.bmp
    • Size 25KB
    • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/ptu-preinstall.exe
    • Size 6.5MB
    • SHA256 356a88e32835d8555263aba8decd58f16d9bb79f7bc17e016ab921e2d721c12f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
    • Size 1.7MB
    • SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discoverypersistenceprivilege_escalationdefense_evasion

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral13behavioral14
    • Target
      Paragon Tweaking Utility.exe
    • Size 66.7MB
    • SHA256 351660382de7b20ce62ba5db5ebb969b089dab6f0c895e758c6b20eedf27d0b7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    defense_evasiondiscoverypersistencetrojan

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral15behavioral16
    • Target
      appicon.ico
    • Size 93KB
    • SHA256 db1468e9a2c0b58f6e523fa764b6b0fc650a23c883c36c6ef89f781aab94097c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral17behavioral18
    • Target
      ptu_ascension_helper.exe
    • Size 22.4MB
    • SHA256 5d11caaac9323d39e28ec76a2a6325f1569be8ed42c85ef25df6cb760c6cb427
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      ptu_core.dll
    • Size 417KB
    • SHA256 67013d4925247c5e3862a5ae66f6d219e010f1e83a8b1a9c2f123f8ac49cc7d6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      updater/updater.exe
    • Size 6.5MB
    • SHA256 356a88e32835d8555263aba8decd58f16d9bb79f7bc17e016ab921e2d721c12f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Command Shell

1
T1059.003

Persistence

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Power Settings

1
T1653

Privilege Escalation

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Network Share Discovery

1
T1135

Peripheral Device Discovery

1
T1120

Query Registry

7
T1012

System Information Discovery

7
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

defense_evasiondiscoveryspywaretrojan
Score
4/10

behavioral2

defense_evasiondiscoveryspywaretrojan
Score
4/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

discoverypersistenceprivilege_escalation
Score
6/10

behavioral14

defense_evasiondiscoverypersistenceprivilege_escalation
Score
6/10

behavioral15

defense_evasiondiscoverypersistencetrojan
Score
6/10

behavioral16

defense_evasiondiscoverypersistencetrojan
Score
6/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10