c4cdaa6cfc97a3ba8c70fe676cbcf5fa2280a616aad83b51f587d57f1764e7e0

Analysis

max time kernel
137s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PaintDotNet_x86.msi
Size

56.2MB
MD5

ec6bf9b6cfb60286994910fb8363ee5c
SHA1

bc65389e57575b2f831280c9bf8880ae98a0709c
SHA256

9a9f3f78a7288f24093c9ecdd9499b03fb660c66383d46bcba4e74b2b7cac714
SHA512

136dba7818d0c3e40ab13ecc3625d72a9850fd19c83b9e20c1075e40e375e2b79b7b172ad2d3d3fc7f9355af4da1625a7bb1cc37b80bb6e81730084823e525cb
SSDEEP

393216:l7MMnozGuRlM7PZiKXOqCdALhOhuo6km1YvjcMpE9BiS+mFESSbQSnHtDTLu5ZWE:l75MnIiKH8nu63pbH4OO

Score

6^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

msiexec.exe

flow pid process

21 4388 msiexec.exe
32 4388 msiexec.exe
34 4388 msiexec.exe
36 4388 msiexec.exe

flow	pid	process
21	4388	msiexec.exe
32	4388	msiexec.exe
34	4388	msiexec.exe
36	4388	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Windows directory 5 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI8C91.tmp	msiexec.exe
File created	C:\Windows\Installer\e5789e1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5789e1.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B48.tmp	msiexec.exe

Loads dropped DLL 2 IoCs

Processes:

MsiExec.exe

pid process

2032 MsiExec.exe
2032 MsiExec.exe

pid	process
2032	MsiExec.exe
2032	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000982641fbe24eac720000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000982641fb0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900982641fb000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d982641fb000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000982641fb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exe

description	pid	process
Token: SeShutdownPrivilege	4388	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4388	msiexec.exe
Token: SeSecurityPrivilege	4868	msiexec.exe
Token: SeCreateTokenPrivilege	4388	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4388	msiexec.exe
Token: SeLockMemoryPrivilege	4388	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4388	msiexec.exe
Token: SeMachineAccountPrivilege	4388	msiexec.exe
Token: SeTcbPrivilege	4388	msiexec.exe
Token: SeSecurityPrivilege	4388	msiexec.exe
Token: SeTakeOwnershipPrivilege	4388	msiexec.exe
Token: SeLoadDriverPrivilege	4388	msiexec.exe
Token: SeSystemProfilePrivilege	4388	msiexec.exe
Token: SeSystemtimePrivilege	4388	msiexec.exe
Token: SeProfSingleProcessPrivilege	4388	msiexec.exe
Token: SeIncBasePriorityPrivilege	4388	msiexec.exe
Token: SeCreatePagefilePrivilege	4388	msiexec.exe
Token: SeCreatePermanentPrivilege	4388	msiexec.exe
Token: SeBackupPrivilege	4388	msiexec.exe
Token: SeRestorePrivilege	4388	msiexec.exe
Token: SeShutdownPrivilege	4388	msiexec.exe
Token: SeDebugPrivilege	4388	msiexec.exe
Token: SeAuditPrivilege	4388	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4388	msiexec.exe
Token: SeChangeNotifyPrivilege	4388	msiexec.exe
Token: SeRemoteShutdownPrivilege	4388	msiexec.exe
Token: SeUndockPrivilege	4388	msiexec.exe
Token: SeSyncAgentPrivilege	4388	msiexec.exe
Token: SeEnableDelegationPrivilege	4388	msiexec.exe
Token: SeManageVolumePrivilege	4388	msiexec.exe
Token: SeImpersonatePrivilege	4388	msiexec.exe
Token: SeCreateGlobalPrivilege	4388	msiexec.exe
Token: SeBackupPrivilege	1112	vssvc.exe
Token: SeRestorePrivilege	1112	vssvc.exe
Token: SeAuditPrivilege	1112	vssvc.exe
Token: SeBackupPrivilege	4868	msiexec.exe
Token: SeRestorePrivilege	4868	msiexec.exe
Token: SeRestorePrivilege	4868	msiexec.exe
Token: SeTakeOwnershipPrivilege	4868	msiexec.exe
Token: SeRestorePrivilege	4868	msiexec.exe
Token: SeTakeOwnershipPrivilege	4868	msiexec.exe
Token: SeRestorePrivilege	4868	msiexec.exe
Token: SeTakeOwnershipPrivilege	4868	msiexec.exe
Token: SeBackupPrivilege	4824	srtasks.exe
Token: SeRestorePrivilege	4824	srtasks.exe
Token: SeSecurityPrivilege	4824	srtasks.exe
Token: SeTakeOwnershipPrivilege	4824	srtasks.exe
Token: SeBackupPrivilege	4824	srtasks.exe
Token: SeRestorePrivilege	4824	srtasks.exe
Token: SeSecurityPrivilege	4824	srtasks.exe
Token: SeTakeOwnershipPrivilege	4824	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

4388 msiexec.exe
4388 msiexec.exe

pid	process
4388	msiexec.exe
4388	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 4868 wrote to memory of 4824	4868	msiexec.exe	srtasks.exe
PID 4868 wrote to memory of 4824	4868	msiexec.exe	srtasks.exe
PID 4868 wrote to memory of 2032	4868	msiexec.exe	MsiExec.exe
PID 4868 wrote to memory of 2032	4868	msiexec.exe	MsiExec.exe
PID 4868 wrote to memory of 2032	4868	msiexec.exe	MsiExec.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\PaintDotNet_x86.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4388

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4824

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding B59A13212D6884C6850C7740A442B683
2⤵
- Loads dropped DLL
PID:2032

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1112

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17
Filesize
2KB

MD5
7f304f88a9ec859c3ec129d4d1e5f12c

SHA1
3bc010dc12415bb2668f775b9c7cfb780a244e07

SHA256
20019ca117478f5a78d4d28d39c454fc9f5d577780edba0499e752cd0fcd041d

SHA512
95ba947677eb171fa8af549f4452f5467153e4c727af43d2e73685b88f0b9038a3e3ee3a960501a39b39e88bc9a6fe1ae8e0d29acb4a118576eb606568e39bfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
1KB

MD5
169257ee1dae792fa516b7ee24fdbf6d

SHA1
749debd32071e052889110b6e2672ed0f7a0239f

SHA256
5c2d0b615f51c090e6afa909d6612573b902d06582db619452d6443463e9ab45

SHA512
ee0e15925c925452250c6d3a3a06c330257411d12708c98ed7ecee74792e977bb103f3572e1e585648fdd57865ef0718e601d63a70d8605fafecf1f4d4c2a16b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7833C286363AD25C70511661A83D581_0074F282EF1707B4127B4440C07CA094
Filesize
510B

MD5
75bfab5db99d3a568718a5579d2ff770

SHA1
57e820ba6726f9b2b6c7967e6d4ca9e10e29995e

SHA256
028d247d354834f0802009e505ff0dc6a0b5d768ab0a9cea73508c0a0854bf7a

SHA512
45c4fa4d31f697a67fc8695ca802a3ac6880240e4c70a08fc1c01bae8c80dfd6037cc2e7546d2eeb3e44233de2b598a213b62ada64bfa157f78dfb65ec3aa04e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17
Filesize
488B

MD5
430b3c6c6cd1d692b0c2e7d9162c28ca

SHA1
68e65318347f132143c7189c7fde2f3df09bf83b

SHA256
f305c5234c87adabb43b020090a567e3d75b3eb5bafe7e768587b5839b8d09d5

SHA512
9c49728747689d7ff91d927452fd6a979d33d6b30fea4f39a44cd13915d2f5a465375afe62e5f64a2fbbab42f72e315a6d9686dac115eacfb5ccb7cb46152b68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
482B

MD5
11525bad9a4ab88efe44e8435c3df3bc

SHA1
802bc6a90e39f504ebcc19f88e98cdd9b5cb1883

SHA256
b74328a0ad68124f938db4d9e163fcc35a62eb2e705209955ca87e3e8d43648d

SHA512
e7cc7e825f6dbdb18238f8a1edc7c03caae02452f507c2be7fff7799070b0e349c2ead1a40c6759a931aa33203c59db304f04b2ea845812ba51bfb87a3dd0f5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7833C286363AD25C70511661A83D581_0074F282EF1707B4127B4440C07CA094
Filesize
484B

MD5
3f5a198412673ce818933e27f7f20d79

SHA1
173747f867b6adf2bd8b157ef922a7d34442d175

SHA256
ab3f8781b97f4aca4ae038df074762f0b0f1d3dedaf715f9ddf11ff1c50090c3

SHA512
0f9318912cb1725a4dc8933f9fba9ab426868c113c047d8a436a585c1f848f7c55f1e9f151c9e147888023149a3e671526870ed64985135d9ca9c417b4a47920

Download Submit
C:\Windows\Installer\MSI8B48.tmp
Filesize
298KB

MD5
373e46a1e858b6a10432d589de09732f

SHA1
26e71b5373999a23eb6e2a282de3683dd9d698b5

SHA256
0357b1185454d1a7d0c72de5af8e82a2185c0f1e52fb2d21b53e149d0a688041

SHA512
9b83f10f5e1cbe8ff97a5ead0ca02fce5f58e6e573077d2293f5c34e8d894836dd8e2a6b1dcdfa6c98f156704208f85e8595046527adab3fbe831236c71aaef8

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
23.7MB

MD5
7e29bf53a6a0fd7b84758a4f3b075091

SHA1
3593e4bd13b6cb8c426c7c45bc82c61c00d5bdab

SHA256
3284ee97638035309eb22c4103f433fa248f6f2fb71d7870e26482ebe1e32a64

SHA512
e1c1807b63f01cb5b502dea970d998fdd6ae93cc00d3e8e961f9b913e25f575d70569caeaa91fedb53d9ca2e1c5c2d39d8d9baf4e5c1b6b49682dce43e43f343

Download Submit
\??\Volume{fb412698-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b4a4c9d3-4407-4e16-95fb-9b09e7bdbf53}_OnDiskSnapshotProp
Filesize
6KB

MD5
698e3e127b3e32e9cdef2fcf64a4d361

SHA1
1933a4b1d97726d24731c8a2fcd6d489cbb5cc65

SHA256
1c03f7fdc66d26622545f5fe0fca416d2ef643b234af824ba141a601d091debe

SHA512
023230a6ff0a1213769b8fc1aaa8f79c39152b4c2fae8fc754e3a85fd3d851a2646129c01ae110ab236f17bb8999824e74ee63331c4e146f73dc536250cc8ac9

Download Submit