Overview

overview

5

Static

static

3

ParaBox.exe

windows10-2004-x64

5

ParaBox.exe

windows11-ltsc_2024-x64

5

Analysis

  • user interaction
    yes
  • max time kernel
    250s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-fr
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-frlocale:fr-fros:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/10/2026, 20:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ParaBox.exe
  • Size 114.9MB
  • Sample261003-zfcd9sfd72
  • SHA256 b0743f186e360ee50ac9d063059605814d9a5938b9578b5abe54084516e6de65
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
defense_evasionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Event Triggered Execution: Accessibility Features 1 TTPs

    Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.

    persistenceprivilege_escalation
  • Modifies Control Panel 38 IoCs
    defense_evasion
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ParaBox.exe
    "C:\Users\Admin\AppData\Local\Temp\ParaBox.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    PID:4340
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x0000000000000500 0x00000000000004FC
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5160
  • C:\Windows\system32\sethc.exe
    sethc.exe 10
    1⤵
      PID:3772
    • C:\Windows\system32\sethc.exe
      sethc.exe 100
      1⤵
        PID:1272
      • C:\Windows\System32\rundll32.exe
        rundll32.exe uxtheme.dll,#64 C:\Windows\resources\themes\Aero\AeroLite.msstyles?NormalColor?NormalSize
        1⤵
          PID:5420

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              ParaGreenContrast.theme
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\ParaGreenContrast.theme
              • Size 2KB
              • SHA256 49db94326447fc895b5ea4e43c0c7758ead7aa869fc4e03656c5e428cc9aa162
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              paraapp_profile.png
              • Path C:\Users\Admin\AppData\Local\Temp\paraapp_profile.png
              • Size 841KB
              • SHA256 91d7011111d3272d4a70c0c7f2c33e5031195be9f96a356010c454293de06991
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download