Analysis
-
max time kernel
56s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
06-03-2024 13:16
General
-
Target
drawpile-2.1.20-setup.exe
-
Size
15.8MB
-
MD5
e26f405d32db4698c688893e35b54883
-
SHA1
5fbb215923a2a4631d10e14eedcaafddb1840c70
-
SHA256
878a47414d5209e784a415d507aac864827490f106ed0290802a333d641a7ac4
-
SHA512
0ce6bafb8bef8ef3f6580ddee91b0b645b57fa4cf1cc4620c56b7578968aecdc062d01a82b68f2e22cac1f72579cd4bda27cc3954c24f54365d079dba36b771b
-
SSDEEP
393216:Xv49iYZyoxeQSOXrR5dQeN1BCk1SJtPLdeHMWSme85CSeYZl1DQGIqH:/HY0oxeZONAJtFzjSdtEGH
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 61 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 23 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\drawpile-2.1.20-setup.exe"C:\Users\Admin\AppData\Local\Temp\drawpile-2.1.20-setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-PDIIP.tmp\drawpile-2.1.20-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-PDIIP.tmp\drawpile-2.1.20-setup.tmp" /SL5="$70124,16341776,57856,C:\Users\Admin\AppData\Local\Temp\drawpile-2.1.20-setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Drawpile\drawpile.exe"C:\Program Files\Drawpile\drawpile.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Program Files\Drawpile\drawpile.exe"C:\Program Files\Drawpile\drawpile.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD52f1535f6ca35872994e5c3c38af2dac7
SHA19a7bdfce6d66cc6acf1d5359e2750adadf76272c
SHA256232ccdb1846c4473813ccba1a359d875c6e38b5556aba7de1ae7d1bdd4971bc4
SHA512ba7e145e5b708bb06c727dfae376ae7bea7719d6fda99191dad2d59eb2d799ba0694d7333712b86b8c74a2325b905b0e29d7a75e3ed730268c9e9780013d387d
-
Filesize
192KB
MD5d936a0bb2aff0b105d110cadd61b88a1
SHA112f2030ea087d41ebbdfceb32cef06ceb832b8d1
SHA2564ce8e40f5371e221d716c6afb916471b0d70458e2eec6de094ddb393cb584dd9
SHA51261ca97c759805ef0c2335d548f1b789ed92eca42403d5c42b92dd80d0a515326fe233df8cc98fbe559c47aebdabd21d776edbae68b88311a47cb9cd6ec2a2901
-
Filesize
8KB
MD530a60f6f54fe76e5fa010e5dba38ea61
SHA160ec3dd976a79049a7295a37de4012bc21faf512
SHA2568c1af5efcb34f50f9d7c7aa289615e106918e6dec8ca38bff90d99e9b86707be
SHA5120f7a5ad15d2ebf2b4e60b647ad2bb231f3fe2467b3e6108f286f7a8ef9311e58b166676b4400f6cb685eba05f45b509f824a86834c8dabd342755c9d8ec9c4d3
-
Filesize
320KB
MD559ec3c2c611211a5969eca6355e32b36
SHA133b49aff5b7e4d2c1889f0adf663f7ca261f400a
SHA256f1f8881cb073c24b89a031a585b9f58b9a425d6a352c4e2bea83de46bdba229a
SHA51233f034257b7ad09ff15a44a05ba3214becfd833ad524fe2e6412f65afb50d3f4e1ae09d7b4f178e77662819eb6c1e5f8b763bf91885109f3ca4acc2d87a1c0b2
-
Filesize
8KB
MD543b3ff80b2184bf7cb9a6ea242c17952
SHA120894f7820e6963139610554c2f0e504c935f6c7
SHA256d594f21dca5110914686dd282333becde9cd85957b9e1f036ca3c0048326cd19
SHA512e6117fa1ebfac9129def54ac9331c5ccaf090da16ba171498dc68999c7525971eb55fe33eb30dae56c69feae02d6f979cb9e817807cc2ef87ec818c438bc995f
-
Filesize
3.5MB
MD51f32e819b8cb3487e7d7aa827deb5a64
SHA1ad31ee01467de5bb9d22ad684349dd1636cbc8ac
SHA25607082bb41a729d944b590bcbd9cbec01815f84f6e73869e334d7e597c15cb7e6
SHA5128a0b92f8d6bdd27ea515414dffd6d3ca5713fff09e41b9939f86a32d5957c23f6d101820e426f3a54727c2e413d252fcb4a2e32ff0484d8ebbb976fd6b3c4300
-
Filesize
2.9MB
MD5685d729ec0cc1079b4d6b9d4c7cfdc43
SHA176864e61605f05aea4eb66a776e77a07eafb9832
SHA256bce6fb6f8e0b440890950e2f18c1a879581e5b8d39dbba3db30ecfc53b6741bc
SHA5126ad87255e0eb10c31678adb1222f49168ff027cf83f5dc1d4195a124ab42e6639114265746db262e12eaae88e82eab668cff3e57c38a88aca9a6f110906f2cdd
-
Filesize
436KB
MD55581c67e2c0311d134f6c53ab12806e2
SHA1aa87051a8c2123569cf2a44e7f1330998bb4ea25
SHA256a6c39377664192c9b01bb526b127d04923545a54b247ef9455bf1ff8bfab1ddf
SHA51246936c102b002b45712c9d6edb82ff4622e2ca74846f789ccdf7cbbda9af9e0497520372966119dc7a30f3949bbe28324f21b48619f7c32afa69273d785f7fd9
-
Filesize
316KB
MD5d8be978c0b170b2878da7e8ade912aad
SHA1d35fbc0bb61622fa9be44e86ded799c6eac4fa10
SHA25650d15929f91a20fad0dbefce94b9fcbeaecc7cca71e139f9009e1001c5d0ecea
SHA5125b8c76ce473083c62b62fb4b24f0b338d83dcce998635182e7cbe76d5e7861db73e2ded250d230f9f600219ba8617757df046748817d444f9c246aac2c3f0b66
-
Filesize
1.3MB
MD56fdd24e598ca0209eab3f25ea9a27310
SHA16cfef5822e8fa3776039ed73d3cb2b631ffd59cc
SHA2561097543bc71d35db9e80d0eb26252ec3241d17fb161b856e0390ac88fcea26ba
SHA5125429bc0c6248acd95fdd7d0a016191fa095394e2310abf2ce7bce05ac29d3aaca498c9e291e29d68468b3330735e3a45a32c6380f600024fb69b5234cf2b40ad
-
Filesize
192KB
MD5d5dfb43fbc8768c7a1a021eb14e918b5
SHA1fe22cc36350817cbad9b011307d74eb48a9f1e35
SHA25621e815864068638e3f1d9ddc269203270cdbcc5c37eac42d918a4bc1a4bb3456
SHA512f5d028aeec3d79b851758718f585bd90994032a0338d25d12e1029888c983cb2c77e2930bd1ce564e358a83e7541cbdc37ac8b9fe5be84b7adfbc370162c5569
-
Filesize
832KB
MD5336aa98213622506311eb85267ae8769
SHA193cfd7906dbc42e468ebc36a15100a7ccc6a07a8
SHA256681a3d8bf94ef1b7ff5f1d8509b8fe267a00337ed2227ce6926a7b786976a3eb
SHA512bd19daf708af0eeea857182eb0e726dda38bec96cd2cb88ed876325d48bf3a6f1975fa601aed8fb1133e9b515b4f9847be7dabdb253a712ee51502b2a77c167d
-
Filesize
185KB
MD5de41cdb56e52635f7d4518d4da48c4c4
SHA1db94bd2c35abf93b474ebd2e98d9a0aba0af2d6a
SHA256b7a8f33c02e0b5ceffc3b5eef7878b3254d196cf84ef66fbb1d12c649efe3eb7
SHA51203428f7d3937c06bb7ecd2c8042009fb43c23206e5ff2994e51c90ed7d97e33355cd9cb3bd6575494e784965f7fa4b40d47e8ccf558001b595e552a75c14f96b
-
Filesize
192KB
MD5b1ae6a2d740ce0ef4f95a283c3711880
SHA110b8351c1f3eb0ab45aa7a5cb8f67c87d820d929
SHA256f464e91939dfc57eb2a59af8df247575007f51528c44aab03f75d279c9ed9bb8
SHA51297982073f312de114fe427d797b100df901bce8d2ba8b705ea2a6a358d725a208bac1cacf2e1fba7d9da14b351c3428988cac05bc0141b2d11542ec0a2201960
-
Filesize
423KB
MD577e30d1dd3c49db0ccebebaaa986493b
SHA10da15a9a5646f3f8b90f15d9746afc22f3ad9d32
SHA2560c0db843caf61120a027694158243cdede6549ff4ab5cee37f8354b72d08bd65
SHA512159aaf9f20cce084c97b54ece081d4a56b8980d527663825cf204f307374f8f30b0d7e6873ed78f38f11ed85dc8dcd6888082ee3a25ac40c1e9a4dd33bf09dbd
-
Filesize
2.0MB
MD5e2d3282d6bcc94719453097e447e8c2f
SHA118200ec56be7e240f5f5f5e2d853a0593fd6fed6
SHA256d0f2652f781c63f01d2d2cc9e0922a977fe27c4f3546cc2afe252b79be82c266
SHA512052df9086f780e44f294fd86f38c9c8567534998b4fa246a82283f26d1ba2ac05d6911fd1f4b71258c089b2e2f064156605000bfd4d0db37a8941dbc441bd14e
-
Filesize
256KB
MD5b9e7a684b15fe177e343d1f3cbcaa5b7
SHA1f72a2071ffd10b8d6b2a55dd60aaf72d006d7298
SHA25601d0154aff52fb59757df74c0c796891f65318e7ea22714b0bbcb473611b1889
SHA5126e97f826f6e9e622df3d0ff643770bded922d0c48f1b0dc83ef6de48f68907df74b01e1b279c7b2c510f74ee0a699532ef4f90e773ca2770826e64960ad64413
-
Filesize
1.3MB
MD5673b02a37816805f761c5baa5057bdec
SHA17d9d9f8f19a3dce05bc38f5ad850251f70eda749
SHA2565069590ecbab3e5cfea78554ec683a19acb1e4db8325d36427dc32dfac5bea7e
SHA512ca50d013e917424a15d72f82a0799a1255191eabd0d125d345af57bad5506e6160f4df86ab47ec8f181f3bf21072026e9314d5ce301b5d32464fac28419f5f0c
-
Filesize
55KB
MD58a7b0309ffa3d3c74860a327a628e480
SHA1a9330116f26b308f5faf8147080b1126fcd7d2f9
SHA2566f25e6253ff73aba108d34be01879be22f6d5d7e7dcd18883d34cb63cd989a59
SHA512812eaeabe92598c9db11d404d870f5e6fcceca93a92a940101175c5b7b680adcb5541bdeed730427b1e6dcc052822dc3c5fb02a9cf228adac7d786c5733df72f
-
Filesize
114KB
MD55e4d73a5d31888832bef9265f2c280f8
SHA1176b43a9798324a6b1cc1af669246d20778a830f
SHA25695060ba036af0e5fa59c045de08e9789818e85cbd251ac816068da20c87ba2dc
SHA512ee81fcc9d320b319b38f7419a0102bb99037eb44fe4d33a2ad05340a7c80eec5f040e0a5331834e9a52f860b7633b10ba760a623c3791a3da6ae1d8568a0619c
-
Filesize
1.9MB
MD575bf0b1915aa381810981790cf11d924
SHA1c1bd4d8ae59a424d1a4460614c194c42c13e8b00
SHA2565eeef7fedc02bc3720964a31e367b44addbea8bf662f3fff52cfc764bc7a70ed
SHA5129b62ee0f9d12c249db7860749cdf0eae2e7d3704b3de58ae4a2f5c99b895f87fc9e12d1222aadf9e757cf7eb7fd87df91e14080e2325225fa2deb9d07b309171
-
Filesize
1.1MB
MD5be5b7296a365eed2bfadbb50c4bc7866
SHA19740879c00a1f13af071a161abfbce68baea34d5
SHA256e61e561425b90994c2f66ac8e503709c03c3bf1a5bde6476f05cc8369b388e1f
SHA51285e58709a39560bb3904092c84913e3853761dfa14c69e387b982c6167ee34e5203034e9638c9fb78304ca79ef2f9d41714c1a42528f475e7d82572c3f8df27c
-
Filesize
910KB
MD51100865ead2274a9bc1e8362dd2f4be2
SHA1dcc59705a1c21961285144a8609d3aa0ed2a778f
SHA2567d2c4f9df922e38c555ee4524ef59ede400ef5072dfa6d45865bc01779248e98
SHA51253eb063c755ae97d06ff94d81a5bf7b06ef8be654e7c1cd2f2db62caf1191a8f305ca2eb46cf3f4fc788a7091c2abfe09cd2b6a4d4dc62f8c95ee7f32ca8689b
-
Filesize
1.3MB
MD574ad7b9139ec46a1cc3db493584aa8e2
SHA199b3959781d1f5cdf7c2f1f24321d230108fe3aa
SHA2563450e2b21c9f8db6ec3a1674a7ccbd7c30a256bccf1f4c5056ce5a9147694abd
SHA512ca73504099bf5b4e48ad82a9a13c7df8dd0bc69a488ce6bbb4e0c74c39c4fb88b075703d965ad7a72485b1a32ce8fe46bc08139ae8df6d6212e4dd9ff6d1c93f
-
Filesize
1.3MB
MD550f00aa08a68a6a7a8bb40f83e98b41f
SHA1a474a4a31ac25c891c1d200c510fd24efec94684
SHA25626520526bb8cffeb52accaf115ffa035c7852a1be315c9b98fd33441510a579b
SHA512204336a3c3537b834a58aa33cbcde10a0d62e0144cda198126795f1da90b05c4e7dc7689eb35ab048ad14ec6402f0ebe1dd0ddd4a5c551ee8bbf21526ab731c6
-
Filesize
3.9MB
MD5ccf337bb64a40c7884781b69467dccce
SHA179b5af12f1a91ce9fae37b9e6327d993239c0330
SHA25655947734e34972ba8b11e6e173b02d475c4598b0c1c497c0495b8035175fb964
SHA512e8e57b228c6736d7a036b6ef29b4278b655e1d8c484961f7a4548f137a96af2d1e243a54fc6b2fe1421cc252f2e2a50130c0ce3b5bbb91be6a0c0c65da8fff1e
-
Filesize
1.9MB
MD592af14a66b65468164cba28b1a2ad5fd
SHA1b261c92eb2f58207f31eff1c2f82145f5f5b3224
SHA256a098742a74aa6b4ea97ed9c9b9beb79d338f6d2e8cb350535b939ff84dcc0582
SHA512ee636090c3f50cb7caf2c103d46dc482f1189ff870cc3a2bef90183274b8d64444889e7fdbd1ad711593bb0a9277c814ac29be9932933d6b41a2a560dd84b984
-
Filesize
7.8MB
MD532ff8a1712ebf936f9863731eb7720dc
SHA100a6eb8d1c5537877505f594c7c17719655ee950
SHA256d03d5cae9f66b2c7dd40bc1cbdcf15371b84776a9af1f3eb00cbdce1785e2565
SHA512411a5c3f9aa495fcdcd3b8966b4eadd62116806beca785f1be1512313e3755264507c433cbdcc0bbc0749400d6430173e84c7580d29e6dadcab953d6b688d1a7
-
Filesize
338KB
MD56ece5142b22949af397c6002f3ab4baf
SHA10a4e6d899585669d01e430d5151b4e8e3d4a07a0
SHA256e4481afeacb86a4817258204bd127c0bcf44674d2edad2e82e6a68cdf315dc52
SHA51217a6685c3c39348f0020db1c808d928d04adb1b66887c062e10605f8900eca795c616fe9cbf990fb90aa9b94d6290dea2800fde46677878285cff5322aa36899
-
Filesize
1.2MB
MD51891e053c286a04acee2e25d4904c3f4
SHA1681a761c5aa0ee5da8a8b71f3bb2698854a7b4b3
SHA256dfd6da64233e4635ddc0a7da14c1124e817455a42be7c1f655dc8527af6dcd2d
SHA5120c8c332f50abe90652448cbdf3159596be809c1ba17615f803f63f92d128af01d027ee17941f75c0b42edf19926efcf06dd2f252e0f32e7fa9f85dc17db3c554
-
Filesize
192KB
MD5c012ad2935690e60b87c6e30ab4c7a7e
SHA1ea9e2b1af9b433c9bb25acb1f03ed3d0049312fc
SHA25619bd30f21a2d856f28ac7f51379018955280534465d8ce7ec0467621345660bb
SHA5123732f142ab3b5ea864a87b48f89d62a352a94c7c936fea9566020d7e5742f337f0fb822a03664f0aa2bcda8cb85ea79877385ce3af95d9bde73d95b9eede144b
-
Filesize
552KB
MD533323cf4720978ad7614b6b728b73e44
SHA16490d1817bae6030d05ac08d3832ac19400224fe
SHA2560f3abbbd1dd0c14be07b0b6d27b3036901fd27f98e7dedbcefa482aa0f4c3788
SHA5122974316f266fef779a2a328c4c8d6ef1be1ec6e2037c070473d1e87b87bb91b14395661094249094eadbca21921e92a528ef2362214243a490aba88e5bd0646c
-
Filesize
227KB
MD5a1dc46a0a323a0d07dc430626bc4cab3
SHA1b14770a1aff13109a98a5a4e61725bf2153d3a57
SHA256dd19c7751943dcf1224040c0833ab6a5d1775d499683f399f7dbcebdad875849
SHA512b4b93f8091254fd6d536e653208da58b021f8deba1f7ea3fa83e8eddaf16081765874f4bd330e59933aeb6e5eddea492f59b944fadef87f956f0f017a868706a
-
Filesize
192KB
MD54c36a1d400cbc5c0ae1e02c19e2334ff
SHA1d89886ec3684b061821153caa4209d19ee897c5c
SHA2567d8c97f39ff8c57d7d297ad9da93a17339f24b362bbaa39f9230a33c4cd8fa11
SHA5129727e44da15802bdb7a04895f2a57c3dda25796927d385ea207c21042126885b1ed86ca992f5345d0918b3ab53790fdc079e893354133c1baad13b86eaff0cbc
-
Filesize
256KB
MD5cb572629c24f18360e85531ef3627191
SHA1738358c38efafede32161d0fe5e1cdccd588cddf
SHA256ef9acbbd7b4e2a0b57321516a0c570f1821de4ce289944788e1710aa86fed925
SHA512ae5f55dde5bf8b005493eee83cf500aa36d7750b610ead983af10268d01440975be5d676852a1463019c99e6d551fbf18353ae51a9938b1d687f03d9398d870a
-
Filesize
192KB
MD50003fda33d38737418dc0056f3f1d104
SHA1443d184dda3a003a015cfaa5d815d1479a539a0f
SHA2568808c980e785f09b7f147971ed7704c75fa87553b70527721b36a589e0730cb4
SHA51253b3ee1ed77309a30535ea33e73c01f2c289d7893f005bd1d6e17648229ddd287fb27c2f9ce7980900cbbc58a54a7922c7b8f77f97e58a798acf7867d0e484f0
-
Filesize
192KB
MD5d57e71eb146f839e3f3a4b3f05d2b81e
SHA1e9bd30da4f508ca06692f7e0b206725027326030
SHA256068d7cedd7ef135bf1a5e23c038d0d1f3da1b2f22e7b7ded60e9437304c2cf7d
SHA5121c9c301195bfc93672d473924c09d5bac8bfc694c81b423443b57c861344564eba6e81bc294ee5433760207c8c48d4a962469dc68e9b8fa2fd0b9d4c609ec346
-
Filesize
179KB
MD54b2fa271f2bb44b085f5491f565e3a09
SHA104c82de4ad34cdde841d536c6985fd9c514edc77
SHA2563269a9aef31f96ac1d1d5b7def59305a3a99e0d6ed1e8cbe0fa4b120344268b2
SHA5122c858b1dc2aa2f799278f9eeb6490f0db8d615b03f33cc4f4f2a47247d2108360125346f7bd174658fc6bc4b7ef1343b4af20643f74b64a05f56fd508e3924b6
-
Filesize
770KB
MD536308923caeeb30b27f131692144af4c
SHA159f031d6cb16fbce4181e6e722e7faeeb4903ff5
SHA256954b5c99e149f4d6d05f0a711b9003688545e810fa45d93e9a48df7e29bdcfce
SHA51244bea4eaa23bf989e360853131ee59be508d401b3fc4d50906344b4c74ded0d7d7c9b5f59bc7d99df81a3bc482bcbef353ac8bc2d0e2123b1958f827bc25b9f2
-
Filesize
708KB
MD523656a168f47708225fc81c51aefcdf4
SHA1e54806db47fd2f6a566c0ab04ffc7bf993176032
SHA2568d76868a8db139e9f8bffdf7c1edb9f8788bd468b1fbdadb770ab5a70a127b52
SHA512c6632e6c5c6d3bfa13c2935dd56e6123ff7c14a11783feef63217edf247c99628d30cfe07770724be2d2a83f6798d3c0c09681c6aaeaf2a0f4f4d1b18e5b9613
-
Filesize
697KB
MD5832dab307e54aa08f4b6cdd9b9720361
SHA1ebd007fb7482040ecf34339e4bf917209c1018df
SHA256cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3
SHA512358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49
-
Filesize
240KB
-
Filesize
5.5MB
-
Filesize
944KB
-
Filesize
268KB
-
Filesize
5.4MB
-
Filesize
864KB
-
Filesize
1.5MB
-
Filesize
5.7MB
-
Filesize
664KB
-
Filesize
188KB
-
Filesize
2.0MB
-
Filesize
84KB
-
Filesize
512KB
-
Filesize
1.3MB
-
Filesize
360KB
-
Filesize
844KB
-
Filesize
152KB
-
Filesize
4.3MB
-
Filesize
428KB
-
Filesize
356KB
-
Filesize
268KB
-
Filesize
1.6MB
-
Filesize
2.8MB
-
Filesize
656KB
-
Filesize
164KB
-
Filesize
5.4MB
-
Filesize
1.7MB
-
Filesize
3.4MB
-
Filesize
500KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
20KB
-
Filesize
760KB
-
Filesize
4KB
-
Filesize
760KB