2021b93cb15159d6c8c8ec80d4fd77346b3d8ef1b2645235274bb22e0a41621a

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
parkcontrol.exe
Size 1.1MB
Sample260908-lf4xmaxarb
SHA256 2021b93cb15159d6c8c8ec80d4fd77346b3d8ef1b2645235274bb22e0a41621a
MD5 1b7322c6cd72727332e1ae2cb0bc758e
SHA1 91e51a625bf1834a4e388c151b9a750ed4d01312
SHA512 daf6edc69da6e976508779a4a7ba70316355872a46d1703b8014f7dcc1981834fe3ceadfaed4239c3088e5963e68a038c5c2aeb61da92e9a96563d9f4fb98b3e
SSDEEP 24576:nUNiJjXafU5RwJi1729/86J4h9DAnzr3c+QT6GgpYEe9gcjgOfQf4:UN+qi172xrJcAnfc+QYETQQ
TLSH
T1A335234DAEA4E115D832A5710DFDDDA37634B610385A8BCB6F40EB20FBB11469C2D3B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery persistence

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files\ParkControl\pl_rsrc_english.dll	parkcontrol.exe
File created	C:\Program Files\ParkControl\pl_rsrc_japanese.dll	parkcontrol.exe
File created	C:\Program Files\ParkControl\pl_rsrc_polish.dll	parkcontrol.exe
File created	C:\Program Files\ParkControl\pl_rsrc_ptbr.dll	parkcontrol.exe
File created	C:\Program Files\ParkControl\pl_rsrc_chinese_traditional.dll	parkcontrol.exe
File created	C:\Program Files\ParkControl\pl_rsrc_italian.dll	parkcontrol.exe
File created	C:\Program Files\ParkControl\uninstall.exe	parkcontrol.exe
File created	C:\Program Files\ParkControl\pl_rsrc_bulgarian.dll	parkcontrol.exe
File created	C:\Program Files\ParkControl\pl_rsrc_korean.dll	parkcontrol.exe
File created	C:\Program Files\ParkControl\pl_rsrc_russian.dll	parkcontrol.exe
File created	C:\Program Files\ParkControl\pl_rsrc_spanish.dll	parkcontrol.exe
File created	C:\Program Files\ParkControl\ParkControl.exe	parkcontrol.exe
File opened for modification	C:\Program Files\ParkControl	parkcontrol.exe
File created	C:\Program Files\ParkControl\pl_rsrc_chinese.dll	parkcontrol.exe
File created	C:\Program Files\ParkControl\pl_rsrc_finnish.dll	parkcontrol.exe
File created	C:\Program Files\ParkControl\pl_rsrc_french.dll	parkcontrol.exe
File created	C:\Program Files\ParkControl\pl_rsrc_german.dll	parkcontrol.exe
File created	C:\Program Files\ParkControl\pl_rsrc_slovenian.dll	parkcontrol.exe

Executes dropped EXE 3 IoCs

pid	Process
4476	parkcontrol.exe
3908	parkcontrol.exe
2688	ParkControl.exe

Loads dropped DLL 8 IoCs

pid	Process
4076	parkcontrol.exe
4076	parkcontrol.exe
4476	parkcontrol.exe
4476	parkcontrol.exe
3908	parkcontrol.exe
3908	parkcontrol.exe
2688	ParkControl.exe
2688	ParkControl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	parkcontrol.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	parkcontrol.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	parkcontrol.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	parkcontrol.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	parkcontrol.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	parkcontrol.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	parkcontrol.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ParkControl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ParkControl.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3908	parkcontrol.exe
3908	parkcontrol.exe
3908	parkcontrol.exe
3908	parkcontrol.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3908	parkcontrol.exe
3908	parkcontrol.exe
3908	parkcontrol.exe
3908	parkcontrol.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 4476	4076	parkcontrol.exe	89
PID 4076 wrote to memory of 3908	4076	parkcontrol.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\parkcontrol.exe
"C:\Users\Admin\AppData\Local\Temp\parkcontrol.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Program Files\ParkControl\parkcontrol.exe
  "C:\Program Files\ParkControl\parkcontrol.exe" /update
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:4476
- C:\Program Files\ParkControl\parkcontrol.exe
  "C:\Program Files\ParkControl\parkcontrol" ""
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3908

C:\Program Files\ParkControl\ParkControl.exe
"C:\Program Files\ParkControl\parkcontrol.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:2688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ParkControl.exe

Path C:\Program Files\ParkControl\ParkControl.exe
Size 585KB
SHA256 4d703a3ea70ab7a84f8506628b57ad15df9ee97b2f23ec2853c9aa3753a1fd40
MD5 239ddddd24575284d302d1130424b9c0
SHA1 449416d55d972d11948fb4a722897c56efcb0105
SHA512 22f20acb47f1190e5029961faff11649cebd6266def783f939d2fea179ee0e26aed4b9992f392c07a09b64a3bd711fab45319b4d256160c194104f681c251818
SSDEEP 6144:4kgeYqzi58Yj9fonOWtyQX4R0I0tb2txGpB1m4tASnUlg/22ZQbzfZEUTikpmYaj:qSYR8HKtxomGtUly222fGRumLEQ
TLSH
T198D4185FE6B623E4E4BBC03485526136F9713C9C47389BDB5690A6671B33BE0A93E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl_rsrc_english.dll

Path C:\Program Files\ParkControl\pl_rsrc_english.dll
Size 1.9MB
SHA256 b5ea322e6c1bdd84de2d56eca77be67ff0d85a7681dd0588dae1c09b8fef5048
MD5 618679fb5d723656ad404fb1dcd26772
SHA1 5d7f8772aaa351881c9babbd756803180d922c28
SHA512 981c1c3354ee47f0e0447a3eab9a43106a3e25eee6d9e421dafde8f9bc533d12de95bd2ccf98530e7395ac4b794ce12c0ded91ba47a4b3d41c48063b8a9bd6a5
SSDEEP 6144:ufFa9MmhuV2FFdq7qFrwnim0gsZEeV3dncdgBxjFC8fB4adLxp7WGCNE/Jt1icNa:ufcH9zBVFzLXKGh4ZJe6cwTqREewU3S
TLSH
T1099572CE12FADC58F179EE781DA04E5818D73C8DE838B13D3A31711E99786669828F53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk34D4.tmp\LangDLL.dll
Size 5KB
SHA256 6f14c8f01f50a30743dac68c5ac813451463dfb427eb4e35fcdfe2410e1a913b
MD5 ab1db56369412fe8476fefffd11e4cc0
SHA1 daad036a83b2ee2fa86d840a34a341100552e723
SHA512 8d886643b4fc24adf78f76b663227d6e61863f89e0cbd49548f40dd040666ca94ea46bec9e336850e4f300995d56e6dc85b689c8e09ff46758822d280f06b03d
SSDEEP 48:S46+/zTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mxofjLl:z5uPbOBtWZBV8jAWiAJCdv2CmAL
TLSH
T123C19474B3C248B9C491413368AB33D36612EE746784500F9B6315AA38209E7AD3EBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk34D4.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads