Overview

overview

6

Static

static

3

Paragon Tw...er.exe

windows10-2004-x64

4

Paragon Tw...er.exe

windows11-ltsc_2024-x64

4

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...al.ini

windows10-2004-x64

1

$PLUGINSDI...al.ini

windows11-ltsc_2024-x64

1

$PLUGINSDI...rd.bmp

windows10-2004-x64

1

$PLUGINSDI...rd.bmp

windows11-ltsc_2024-x64

1

$PLUGINSDI...ll.exe

windows10-2004-x64

1

$PLUGINSDI...ll.exe

windows11-ltsc_2024-x64

1

$PLUGINSDI...up.exe

windows10-2004-x64

6

$PLUGINSDI...up.exe

windows11-ltsc_2024-x64

6

Paragon Tw...ty.exe

windows10-2004-x64

6

Paragon Tw...ty.exe

windows11-ltsc_2024-x64

6

appicon.ico

windows10-2004-x64

3

appicon.ico

windows11-ltsc_2024-x64

3

ptu_ascens...er.exe

windows10-2004-x64

1

ptu_ascens...er.exe

windows11-ltsc_2024-x64

1

ptu_core.dll

windows10-2004-x64

1

ptu_core.dll

windows11-ltsc_2024-x64

1

updater/updater.exe

windows10-2004-x64

1

updater/updater.exe

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Paragon Tweaking Utility-4.4.3-amd64-installer.exe
  • Size 49.6MB
  • Sample260823-d837ssxtdx
  • SHA256 c8002d531169485d1cc9aba2f94ae4adc2512264099a7c2e781674dd527a2d79
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywaretrojan

Malware Config

Targets

    • Target
      Paragon Tweaking Utility-4.4.3-amd64-installer.exe
    • Size 49.6MB
    • SHA256 c8002d531169485d1cc9aba2f94ae4adc2512264099a7c2e781674dd527a2d79
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    defense_evasiondiscoveryspywaretrojan
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/InstallOptions.dll
    • Size 15KB
    • SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/ioSpecial.ini
    • Size 211B
    • SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/modern-wizard.bmp
    • Size 25KB
    • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/ptu-preinstall.exe
    • Size 6.5MB
    • SHA256 2fc9070997bcd1e107d133de93a07b2847b413005585735d4aa9609b91623087
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      $PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
    • Size 1.7MB
    • SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discoverypersistenceprivilege_escalationdefense_evasion

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral13behavioral14
    • Target
      Paragon Tweaking Utility.exe
    • Size 67.2MB
    • SHA256 c32b3b170f6c4cc9e4effe8b5e7e56e9d37d86cd020678da87d03509605c901a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    defense_evasiondiscoverypersistencetrojan

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral15behavioral16
    • Target
      appicon.ico
    • Size 93KB
    • SHA256 db1468e9a2c0b58f6e523fa764b6b0fc650a23c883c36c6ef89f781aab94097c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral17behavioral18
    • Target
      ptu_ascension_helper.exe
    • Size 22.4MB
    • SHA256 3cd4f80f626c4be0454cc27d2b77209f4347f752e66c5ce1ce7b1d9a5f96619d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      ptu_core.dll
    • Size 419KB
    • SHA256 d8ea09c2ff5cb930c0d979b5c46e10ad4f7b97fbe8527ef97efc02edea888a0d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      updater/updater.exe
    • Size 6.5MB
    • SHA256 2fc9070997bcd1e107d133de93a07b2847b413005585735d4aa9609b91623087
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Command Shell

1
T1059.003

Persistence

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Power Settings

1
T1653

Privilege Escalation

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Network Share Discovery

1
T1135

Peripheral Device Discovery

1
T1120

Query Registry

7
T1012

System Information Discovery

7
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

defense_evasiondiscoveryspywaretrojan
Score
4/10

behavioral2

discovery
Score
4/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

discoverypersistenceprivilege_escalation
Score
6/10

behavioral14

defense_evasiondiscoverypersistenceprivilege_escalation
Score
6/10

behavioral15

defense_evasiondiscoverypersistencetrojan
Score
6/10

behavioral16

defense_evasiondiscoverypersistencetrojan
Score
6/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10