c674987d89f4eb4c51127bbe68d3ba2672f7721ebf92be649801f54c37c39856

Analysis

max time kernel
133s
max time network
138s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
03/10/2023, 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Remittance-Advice.html
Size

12KB
MD5

c84cf611e4608510f85847548e0e8439
SHA1

2f2c2c2f230c61f7fdcb4df514206e875e5b68eb
SHA256

c674987d89f4eb4c51127bbe68d3ba2672f7721ebf92be649801f54c37c39856
SHA512

388170dc170c1fe3b699326c4c5c509a3d69b6859cdc689df6d9b2556ddec85d939cd0a2745ef561f79d4fb564e5901aa9a1d8b5047344371fbef017e10f3639
SSDEEP

192:e09Fi7pD2SCDWWvbI5HkHxtC5YNefx97C02DX8uS7121AMEAVl6nQrX9v:KPCDWobI5EnqYNO91z7121jEAbD9v

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\INF\netsstpa.PNF	svchost.exe
File created	C:\Windows\INF\netrasa.PNF	svchost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000\Software\Microsoft\Internet Explorer\LowRegistry\Shell Extensions	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000\Software\Microsoft\Internet Explorer\LowRegistry\Shell Extensions\Cached	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000\Software\Microsoft\Internet Explorer\LowRegistry	PaintStudio.View.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133408054421875263"	chrome.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	PaintStudio.View.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1804	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4788	vlc.exe
4364	PaintStudio.View.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
320	chrome.exe
320	chrome.exe
1356	mspaint.exe
1356	mspaint.exe
4364	PaintStudio.View.exe
4364	PaintStudio.View.exe
4364	PaintStudio.View.exe
4364	PaintStudio.View.exe
4364	PaintStudio.View.exe
4364	PaintStudio.View.exe
4364	PaintStudio.View.exe
4364	PaintStudio.View.exe
4364	PaintStudio.View.exe
4364	PaintStudio.View.exe
4364	PaintStudio.View.exe
4364	PaintStudio.View.exe
4364	PaintStudio.View.exe
4364	PaintStudio.View.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4788	vlc.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
636	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe
Token: SeShutdownPrivilege	320	chrome.exe
Token: SeCreatePagefilePrivilege	320	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
4788	vlc.exe
4788	vlc.exe
4788	vlc.exe
4788	vlc.exe
4788	vlc.exe
4788	vlc.exe
4788	vlc.exe
4788	vlc.exe
4788	vlc.exe
4788	vlc.exe
2348	firefox.exe
2348	firefox.exe
2348	firefox.exe
2348	firefox.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
320	chrome.exe
4788	vlc.exe
4788	vlc.exe
4788	vlc.exe
4788	vlc.exe
4788	vlc.exe
4788	vlc.exe
4788	vlc.exe
4788	vlc.exe
4788	vlc.exe
2348	firefox.exe
2348	firefox.exe
2348	firefox.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4788	vlc.exe
1356	mspaint.exe
4364	PaintStudio.View.exe
4364	PaintStudio.View.exe
2348	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 216	320	chrome.exe	52
PID 320 wrote to memory of 216	320	chrome.exe	52
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 672	320	chrome.exe	73
PID 320 wrote to memory of 836	320	chrome.exe	72
PID 320 wrote to memory of 836	320	chrome.exe	72
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74
PID 320 wrote to memory of 888	320	chrome.exe	74

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Remittance-Advice.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff1dac9758,0x7fff1dac9768,0x7fff1dac9778
  2⤵
  PID:216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1788 --field-trial-handle=1800,i,18099943519581711137,18182297641673367978,131072 /prefetch:8
  2⤵
  PID:836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1800,i,18099943519581711137,18182297641673367978,131072 /prefetch:2
  2⤵
  PID:672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2052 --field-trial-handle=1800,i,18099943519581711137,18182297641673367978,131072 /prefetch:8
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2788 --field-trial-handle=1800,i,18099943519581711137,18182297641673367978,131072 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2776 --field-trial-handle=1800,i,18099943519581711137,18182297641673367978,131072 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4696 --field-trial-handle=1800,i,18099943519581711137,18182297641673367978,131072 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1800,i,18099943519581711137,18182297641673367978,131072 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4844 --field-trial-handle=1800,i,18099943519581711137,18182297641673367978,131072 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5096 --field-trial-handle=1800,i,18099943519581711137,18182297641673367978,131072 /prefetch:1
  2⤵
  PID:524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5116 --field-trial-handle=1800,i,18099943519581711137,18182297641673367978,131072 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 --field-trial-handle=1800,i,18099943519581711137,18182297641673367978,131072 /prefetch:8
  2⤵
  PID:4084

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3168

C:\Windows\System32\SystemSettingsBroker.exe
C:\Windows\System32\SystemSettingsBroker.exe -Embedding
1⤵
PID:3268

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
1⤵
PID:2232

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s SstpSvc
1⤵
PID:1840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5024

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
- Drops file in Windows directory
PID:4088

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s RasMan
1⤵
PID:4540

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\NewProtect.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1804

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\8280e42b8feb4e3a87aaa1cfd466c7ad /t 4444 /p 1804
1⤵
PID:4188

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ProtectSet.aif"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4788

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\PopUndo.jfif" /ForceBootstrapPaint3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1356

C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4364

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4168
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2348.0.1270224904\202362691" -parentBuildID 20221007134813 -prefsHandle 1728 -prefMapHandle 1720 -prefsLen 20858 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {129f24dc-62a3-49c0-999a-2830a10dbe07} 2348 "\\.\pipe\gecko-crash-server-pipe.2348" 1820 202760d9258 gpu
    3⤵
    PID:2464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2348.1.961148750\442784603" -parentBuildID 20221007134813 -prefsHandle 2152 -prefMapHandle 2148 -prefsLen 20939 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e727e162-f817-446d-b7e5-3079308b22b0} 2348 "\\.\pipe\gecko-crash-server-pipe.2348" 2164 2026b06fe58 socket
    3⤵
    - Checks processor information in registry
    PID:4508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2348.2.311445650\1337091009" -childID 1 -isForBrowser -prefsHandle 2836 -prefMapHandle 2756 -prefsLen 21042 -prefMapSize 232645 -jsInitHandle 1036 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9979f1a6-f8e3-4fac-b635-edc139023e2f} 2348 "\\.\pipe\gecko-crash-server-pipe.2348" 2632 2027606a458 tab
    3⤵
    PID:5064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2348.3.1996935960\1776831857" -childID 2 -isForBrowser -prefsHandle 3388 -prefMapHandle 3380 -prefsLen 26402 -prefMapSize 232645 -jsInitHandle 1036 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e0c7ddb-4ccf-4123-86a2-361d1bacabca} 2348 "\\.\pipe\gecko-crash-server-pipe.2348" 3420 2026b061c58 tab
    3⤵
    PID:4084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2348.4.773749280\727181668" -childID 3 -isForBrowser -prefsHandle 3992 -prefMapHandle 3996 -prefsLen 26461 -prefMapSize 232645 -jsInitHandle 1036 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee9e249d-aaef-43a5-b07f-19216c91b39a} 2348 "\\.\pipe\gecko-crash-server-pipe.2348" 3956 2027b2dab58 tab
    3⤵
    PID:1068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2348.5.608715460\1821486573" -childID 4 -isForBrowser -prefsHandle 4940 -prefMapHandle 4948 -prefsLen 26461 -prefMapSize 232645 -jsInitHandle 1036 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {45ed012a-d16e-4013-8dce-b2360e435038} 2348 "\\.\pipe\gecko-crash-server-pipe.2348" 4952 2027b2d9f58 tab
    3⤵
    PID:608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2348.7.2051499473\205901317" -childID 6 -isForBrowser -prefsHandle 5292 -prefMapHandle 5296 -prefsLen 26461 -prefMapSize 232645 -jsInitHandle 1036 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd7c63a2-b6be-4719-bed7-44067003d7d0} 2348 "\\.\pipe\gecko-crash-server-pipe.2348" 5284 2027c24e658 tab
    3⤵
    PID:300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2348.6.141065976\1985938704" -childID 5 -isForBrowser -prefsHandle 5092 -prefMapHandle 5096 -prefsLen 26461 -prefMapSize 232645 -jsInitHandle 1036 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ab20030-1479-4920-b196-8907587bab59} 2348 "\\.\pipe\gecko-crash-server-pipe.2348" 4976 2027c24e058 tab
    3⤵
    PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
10af19511f8e15b5a83903bada326a00

SHA1
884ab361efb3388027d4b61b65bcb38055dbd052

SHA256
fff11d080dac75d4493ae4b15c039347c738ac331b1832cf525c1b19087e73cd

SHA512
998cfc53569e502fc603ce6fd9f0858e286ece3cd20a7e6192819f350f2d6960d1537ee5b649c5e7c20408ece3353f151db63c962436f0076f31acb040539ecc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
e25a1a2fb99b698743bc06f1ad8647d8

SHA1
eb4577628274e654c039a596f5a03b21eb3473c5

SHA256
6c334f78e959fe96fbf5ed591893dd5417b2f77121122f837e523f8d10ae92ec

SHA512
a19344a0b6a5e9645752a1ee76e672ff2e7b7596c85969f84433f8f9c3bd75dd17a805b9b5d6c7a050d8813f3f8b012c1075001ec52c9ffeeadf012aabc8f4fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
587e8487d6d57ba9892bf6d61c233ea5

SHA1
3d5aca728938b04394050cd260c05d677614ce4e

SHA256
f48f4f06739e863bf3a4e2927078d62dcbb4b4b947405f4068513c13d9307b1e

SHA512
a562f77dc99cfd8e504bebef2e74c994538de63b793d6f3742a5912fd17c457d530d77115398b7ae62f52b688e7bd322170bfd87c10fd43adedc89943a0ff873

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
5fbd8940678412d74c9c6f59a05c09e7

SHA1
8922744b4328a5b6ec5e08c059c97bc047429c10

SHA256
f39612c059455e90e7489caa4f0cc9da84212b46204b06a63cc9d80ca5eaf20a

SHA512
7ef8b421ac87b342a4927b749364c4eda396f2ca8cd1529e2f9c9c92e4bf4fef8f1d367acf9613fc7505398d945c2fc42fccdfb2d771735521f623592dc9ce11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
8ae48e598ad2a282b424ee66529fbfe9

SHA1
224bd4612ef1b207f7534e4f5b4a8f8d5d24603b

SHA256
4eb2ef76d19ae6a0868624ed7888c4f6fd5b90141f4ef8e8f6fe18a34e83732d

SHA512
53e197a7e94a24095c457b158fc258cfd64f266c8465440749c1d6b08c60d1e1c51e713368579a8dc4e55ab1433b9218e88f360f77eac5496de8f17c297b5822

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
0fc11724ff9c212f03ea78dbc1bb4ec3

SHA1
f6086064efc869e8d58254f11f65c515ee80f07b

SHA256
f1fa4219f8ba562a7390a3432b4bf740ce8e28b5c30e2eced624627649b6b931

SHA512
866c613157a858534be17ce3a6f461e5a28313595f4e68feac0c50ae24f35ff6e204c8202945e860439dccfd2b2d221f66a5df6116bdc94454638466eca45bb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
df8ba83f107f58f4279cb6f9d94f5348

SHA1
6157030c422c2118c625550157e194348b426f35

SHA256
3204176dcf53de8af6961a27286c0cefc62978b9756a6e969ccf479e33a12530

SHA512
3790592e221052f11d89c4a1802019b6fa64072223f9e282b36ed6bb25f8ee083d68005e3826d099edcb47a387d417eda50f95f61054e72682e20c2f2fb1c9a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
0a63cce3f72928820548d8213e05f17a

SHA1
ee191532bd2a053c8f3522dbfc504ac2f8d4b85b

SHA256
14568838d062520b83a0a4dae8d3077fd447fe1222929de73e25b065a9a685ad

SHA512
c56f640dcc91378b02dddc9bd263c7639d7047779245aa2ad1e80014c38a20f98c899db42350a9fb8cec9f881fbb5d083a72176f3af025872774c300080d11bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
4a1e2b4335b42fe0253c8745abd21602

SHA1
9d48a37e8b523c72636fb7f217c84133a476e732

SHA256
5abf893de2f5e9cbde73c64b24086c0ba8e61c256c71f184f363690dec58c9c3

SHA512
387ff17f8404598f3b5fa4ff4e0a4f8206073b63aeb77fa85aecf9b0f66e2e58d553f2499732c98c9a484224d7b124e08bb97e633da1e3071fb38625f0dc41c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
b4aed25b97e131ba814bfc1b38dbeaed

SHA1
43515a89d0537a8babee1d5b91830efa1c202c6d

SHA256
b74104d3fb794fdedeb88227962700a97928546b7a0ea59f65280d68e1a8e767

SHA512
7209fd3e9145367a5aa24d2f72647dc0bf38f5057bb807b2d0323d878bd6f1d8b7258b9980c19bd55e9392a4264f42e9bc3357182233ca894f05d1b4fd200315

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dkkukhpb.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
84d7689f8dab97aa07083d8579c1aa96

SHA1
5d3d606617de53a08b14ccaa88ceaf07701a9ac6

SHA256
455358ecceb965c08a27a59522828e44209e28263aec71a17de1d1b395e62672

SHA512
b8cc9b4e63175a01e1b12af11771ff2fa97613f9c3a7fdf858c728762d5867b14543f9b17c02ef89f6705affd02c70d0e7c2e5209eac76abda589663f879b11b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

Filesize
231B

MD5
ae284dae1736b6d4c25a6646126c375e

SHA1
0042d9dce01a68b67e220b6438e30cdab725b779

SHA256
4434a1cb8de38b4caaead100ef08011628f75468279107291f25c984bbc9ca87

SHA512
35d95defefcbb2faae7065e014d21aed88f49d10e6a5979659667736882af1f32e45003d3e471781f07bd9698a62fcc11e6e1bd5dff711b6311bf3639ec0e060

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json

Filesize
2KB

MD5
404a3ec24e3ebf45be65e77f75990825

SHA1
1e05647cf0a74cedfdeabfa3e8ee33b919780a61

SHA256
cc45905af3aaa62601a69c748a06a2fa48eca3b28d44d8ec18764a7e8e4c3da2

SHA512
a55382b72267375821b0a229d3529ed54cef0f295f550d1e95661bafccec606aa1cd72e059d37d78e7d2927ae72e2919941251d233152f5eeb32ffdfc96023e5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dkkukhpb.default-release\prefs.js

Filesize
6KB

MD5
98741ddfdd2ae1d743e5275acadf010c

SHA1
6495cf8090de37e3b5362bfea53bc1ab42cef6b4

SHA256
afb4ac582aa9bca54597277f00c8660c2a464072fb24a237b8254dbb79365b99

SHA512
62d89a3f6b99eb64166f83b1ccbc1ab95f79e2a0da9ad00ec36ea2987aef88de98596d3f57238f0fe8dc29834c9d546e80e3f7d7a4fb6c7b11638e77171359e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dkkukhpb.default-release\prefs.js

Filesize
6KB

MD5
956e325a8aa724dade56fe956d512f9e

SHA1
8a3471b6a2ee4e8014ba860966921c0c14113d7d

SHA256
f9c283edebf2d9db3f2bb3d8321ad4b052172558345380a5226b0a1c486479e2

SHA512
1d37fb5828f003062ebce03b29589b10c70a7f20b115ccf24ed1e4ba142388effb9cedf6a06b145ae7fb55904f96b6311da409a85d9413536a77e0fda2542789

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dkkukhpb.default-release\sessionstore.jsonlz4

Filesize
881B

MD5
cdcf9811ba5dcf447fe8c5c53369e995

SHA1
be69cd47714775a95c56956dbae4de25ea6cf904

SHA256
f18590fbe575876b10ab355ded61f397907e65e27b7357d57db2510019a2abb9

SHA512
80ed66f0814e334b9ff74e7a109a439030f3c461607343eb512dd4953065d81d74b6e8726a902e35e1579730dd4184cec3865ca9182d5f75423936a4247769ce

Download Submit
C:\Windows\INF\netrasa.PNF

Filesize
22KB

MD5
80648b43d233468718d717d10187b68d

SHA1
a1736e8f0e408ce705722ce097d1adb24ebffc45

SHA256
8ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380

SHA512
eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9

Download Submit
C:\Windows\INF\netsstpa.PNF

Filesize
6KB

MD5
01e21456e8000bab92907eec3b3aeea9

SHA1
39b34fe438352f7b095e24c89968fca48b8ce11c

SHA256
35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f

SHA512
9d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec

Download Submit
memory/4788-225-0x00007FF70D460000-0x00007FF70D558000-memory.dmp

Filesize
992KB

Download
memory/4788-226-0x00007FFF1D920000-0x00007FFF1D954000-memory.dmp

Filesize
208KB

Download
memory/4788-227-0x00007FFF0D4B0000-0x00007FFF0D764000-memory.dmp

Filesize
2.7MB

Download
memory/4788-228-0x00007FFF09AE0000-0x00007FFF0AB8B000-memory.dmp

Filesize
16.7MB

Download
memory/4788-229-0x00007FFF0CA60000-0x00007FFF0CB72000-memory.dmp

Filesize
1.1MB

Download