3f504f7015e51873898235bfac8108d2ea29cdb2dec27c76dd42395316e8ffb0

Resubmissions

01/06/2023, 22:52

230601-2tdklagg99 7

01/06/2023, 22:46

230601-2p7mwahc2w 7

Analysis

max time kernel
29s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2023, 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Paint tool Sai Angel Drawin/Paint Tool SAI/papertex/Papel.bmp
Size

257KB
MD5

3e940d47505ae20ae27a3023c1e4c5f0
SHA1

54d857a1756f7d86beab7fdb1b136e8cd579eeac
SHA256

6cfc0e01583bfd0a1b1598bb954077acd3502bc5c24524132e3a17dac129137c
SHA512

4e54e9be69330ca2b35871a898ac7cc6d90c3c5b9f1b0f67b796ec3b2e0a50fe7e2633523fb3d096b0733f806f6ea7f9b380b5ebdc7f5c2d11ad2a8054d4618b
SSDEEP

6144:9tLBKai7LLme60hsGPE5L9FUONQdY3X6Zfpv:wai72D0hsQkFUNEX4pv

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1704	mspaint.exe
1704	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1704	mspaint.exe
1704	mspaint.exe
1704	mspaint.exe
1704	mspaint.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1704	1444	cmd.exe	84
PID 1444 wrote to memory of 1704	1444	cmd.exe	84

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Paint tool Sai Angel Drawin\Paint Tool SAI\papertex\Papel.bmp"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Paint tool Sai Angel Drawin\Paint Tool SAI\papertex\Papel.bmp"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads