804826c7da65f0ef6aba984fc65cd2e701f4d26ef52fedd3dcea5808c4c70542

General

Target
0b58bcd32bc93b428e389f8976665749.exe
Size 5.7MB
Sample230115-rwvxjsfh97
SHA256 804826c7da65f0ef6aba984fc65cd2e701f4d26ef52fedd3dcea5808c4c70542
MD5 0b58bcd32bc93b428e389f8976665749
SHA1 8e7d64a9d31d71ca9048cb1a52893ab763869153
SHA512 fb8aadc29d76a0b03b417560b885c90767752dc7d8c3fc289bc76f14d54240c90d0779ee2ca1846cf69750085896cfa6711e4bcc5bdacab024df7b4a59255a2f
SSDEEP 98304:I0LLudgk03bPi/IIZKySE89KUXPf8L5gaXjelb4e+LfvfyW8A/:I0cg53b6/ImKRHnoKHl/2d
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1300	WindowsPaint-Ver3.8.7.2.exe

Loads dropped DLL 2 IoCs

pid	Process
1224	taskeng.exe
1224	taskeng.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1528	icacls.exe
596	icacls.exe
532	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1036	schtasks.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1036	1252	0b58bcd32bc93b428e389f8976665749.exe	27
PID 1252 wrote to memory of 1036	1252	0b58bcd32bc93b428e389f8976665749.exe	27
PID 1252 wrote to memory of 1036	1252	0b58bcd32bc93b428e389f8976665749.exe	27
PID 1252 wrote to memory of 1528	1252	0b58bcd32bc93b428e389f8976665749.exe	29
PID 1252 wrote to memory of 1528	1252	0b58bcd32bc93b428e389f8976665749.exe	29
PID 1252 wrote to memory of 1528	1252	0b58bcd32bc93b428e389f8976665749.exe	29
PID 1252 wrote to memory of 596	1252	0b58bcd32bc93b428e389f8976665749.exe	31
PID 1252 wrote to memory of 596	1252	0b58bcd32bc93b428e389f8976665749.exe	31
PID 1252 wrote to memory of 596	1252	0b58bcd32bc93b428e389f8976665749.exe	31
PID 1252 wrote to memory of 532	1252	0b58bcd32bc93b428e389f8976665749.exe	34
PID 1252 wrote to memory of 532	1252	0b58bcd32bc93b428e389f8976665749.exe	34
PID 1252 wrote to memory of 532	1252	0b58bcd32bc93b428e389f8976665749.exe	34
PID 1224 wrote to memory of 1300	1224	taskeng.exe	36
PID 1224 wrote to memory of 1300	1224	taskeng.exe	36
PID 1224 wrote to memory of 1300	1224	taskeng.exe	36

C:\Users\Admin\AppData\Local\Temp\0b58bcd32bc93b428e389f8976665749.exe
"C:\Users\Admin\AppData\Local\Temp\0b58bcd32bc93b428e389f8976665749.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /CREATE /TN "Windows\IntelComputingTooIklt\IntelPaint3.8.7.2." /TR "C:\ProgramData\MsiBoostSasum\WindowsPaint-Ver3.8.7.2.exe" /SC MINUTE
  2⤵
  - Creates scheduled task(s)
  PID:1036
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\ProgramData\MsiBoostSasum" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
  2⤵
  - Modifies file permissions
  PID:1528
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\ProgramData\MsiBoostSasum" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
  2⤵
  - Modifies file permissions
  PID:596
- C:\Windows\System32\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\ProgramData\MsiBoostSasum" /inheritance:e /deny "admin:(R,REA,RA,RD)"
  2⤵
  - Modifies file permissions
  PID:532

C:\Windows\system32\taskeng.exe
taskeng.exe {A2E7C844-B589-43EE-9420-D1CFC30B60C9} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1224
- C:\ProgramData\MsiBoostSasum\WindowsPaint-Ver3.8.7.2.exe
  C:\ProgramData\MsiBoostSasum\WindowsPaint-Ver3.8.7.2.exe
  2⤵
  - Executes dropped EXE
  PID:1300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsPaint-Ver3.8.7.2.exe

Path C:\ProgramData\MsiBoostSasum\WindowsPaint-Ver3.8.7.2.exe
Size 596.3MB
SHA256 72b84c2df4988c38ce4b90dfe6c52e245756ff90b02e45a3213b62d4fce96dde
MD5 38cf4617a206fb1c1ada1a61f2178a8e
SHA1 d09ff5e964bcd61d432af9cadd8dedbd80de58ee
SHA512 2feefb9b0c4670662fee7c8604d4a743ed059223ff78fdac1bba7a9aa4574ecbd6f9efe98fe3a92b0cfa282c6c1aa5f636aff0475e47fcca0b4ed6c26c4913b2
SSDEEP 98304:I0LLudgk03bPi/IIZKySE89KUXPf8L5gaXjelb4e+LfvfyW8A/O:I0cg53b6/ImKRHnoKHl/2dm
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsPaint-Ver3.8.7.2.exe

Path C:\ProgramData\MsiBoostSasum\WindowsPaint-Ver3.8.7.2.exe
Size 366.4MB
SHA256 b58a814bfca573ad5843cc9f7441d801b0849c21eff88b29213767ffe773ca91
MD5 b190e91a500456b067b65161a15bf424
SHA1 3ff2573b9a923d49acc1514e6132ef3a600d68bf
SHA512 793454365a51770681ad82fb6e066d8bb8601ae3f6f4ff0bd6d96f9c811c653c97fc1e1072b16e9856984b3c003fac7da42844d466b6b788ce417fdfd5328d8a
SSDEEP 98304:I0LLudgk03bPi/IIZKySE89KUXPf8L5gaXjelb4e+LfvfyW8A/O:I0cg53b6/ImKRHnoKHl/2dm
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsPaint-Ver3.8.7.2.exe

Path \ProgramData\MsiBoostSasum\WindowsPaint-Ver3.8.7.2.exe
Size 407.4MB
SHA256 e103dbba27de73084c540bd0325353d7a73df16972dd35c5517e294d8a4c9ae9
MD5 75f68054476896f77034116b91139da5
SHA1 8ea5fa7fdbdd22eaeddaae89097511873858a8ed
SHA512 fd2547ee74f86d193cf0303b786187bdb6b4a40b853e0fcbb9cb409a633dff6ab18e466042a52c722e099d1d9fa52f399129a9421acec2147ac6354fd268625f
SSDEEP 98304:I0LLudgk03bPi/IIZKySE89KUXPf8L5gaXjelb4e+LfvfyW8A/a:I0cg53b6/ImKRHnoKHl/2dy
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsPaint-Ver3.8.7.2.exe

Path \ProgramData\MsiBoostSasum\WindowsPaint-Ver3.8.7.2.exe
Size 417.6MB
SHA256 6deee387c4176037c66373bf4a66ee98376f650231be694b596a8e04d7658b92
MD5 aec908651b799facba9ca531c2f422ae
SHA1 4f9d941d8512e887ed9d55d0e045e251ef7a8664
SHA512 030b3464ff8aec5c5430745964db9920863f632f187850447a728dddd8528c021efb3a24660af874a7847f1c9334d3f5d210a4e88af79be5fdf240a1a1eb39bb
SSDEEP 98304:I0LLudgk03bPi/IIZKySE89KUXPf8L5gaXjelb4e+LfvfyW8A/O:I0cg53b6/ImKRHnoKHl/2dm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1252-54-0x000000013F030000-0x000000013F933000-memory.dmp

Download

memory/1252-57-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Download

memory/1300-67-0x000000013F310000-0x000000013FC13000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads