Overview
overview
10Static
static
10cc552bed96...e1.exe
windows7-x64
10cc552bed96...e1.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3PaintDotNet.Base.dll
windows7-x64
1PaintDotNet.Base.dll
windows10-2004-x64
1PaintDotNet.Core.dll
windows7-x64
1PaintDotNet.Core.dll
windows10-2004-x64
1PaintDotNet.Data.dll
windows7-x64
1PaintDotNet.Data.dll
windows10-2004-x64
1PaintDotNe...rk.dll
windows7-x64
1PaintDotNe...rk.dll
windows10-2004-x64
1PaintDotNe...es.dll
windows7-x64
1PaintDotNe...es.dll
windows10-2004-x64
1PaintDotNe...er.dll
windows7-x64
1PaintDotNe...er.dll
windows10-2004-x64
1PaintDotNet.exe
windows7-x64
1PaintDotNet.exe
windows10-2004-x64
1PaintDotNet_x64.msi
windows7-x64
6PaintDotNet_x64.msi
windows10-2004-x64
6PaintDotNet_x86.msi
windows7-x64
6PaintDotNet_x86.msi
windows10-2004-x64
6SetupFrontEnd.exe
windows7-x64
1SetupFrontEnd.exe
windows10-2004-x64
1SetupShim.exe
windows7-x64
1SetupShim.exe
windows10-2004-x64
1System.Buffers.dll
windows7-x64
1System.Buffers.dll
windows10-2004-x64
1System.Col...le.dll
windows7-x64
1System.Col...le.dll
windows10-2004-x64
1System.Memory.dll
windows7-x64
1System.Memory.dll
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-03-2024 20:16
Behavioral task
behavioral1
Sample
cc552bed9629fe4d9f2d6d60120bc8e1.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
cc552bed9629fe4d9f2d6d60120bc8e1.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
PaintDotNet.Base.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
PaintDotNet.Base.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
PaintDotNet.Core.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
PaintDotNet.Core.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
PaintDotNet.Data.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
PaintDotNet.Data.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
PaintDotNet.Framework.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
PaintDotNet.Framework.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
PaintDotNet.Resources.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
PaintDotNet.Resources.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
PaintDotNet.SystemLayer.dll
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
PaintDotNet.SystemLayer.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
PaintDotNet.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
PaintDotNet.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
PaintDotNet_x64.msi
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
PaintDotNet_x64.msi
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
PaintDotNet_x86.msi
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
PaintDotNet_x86.msi
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
SetupFrontEnd.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
SetupFrontEnd.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
SetupShim.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
SetupShim.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
System.Buffers.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
System.Buffers.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
System.Collections.Immutable.dll
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
System.Collections.Immutable.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
System.Memory.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
System.Memory.dll
Resource
win10v2004-20240226-en
General
-
Target
SetupFrontEnd.exe
-
Size
89KB
-
MD5
86547d7bff541e04d5a31db85efe627c
-
SHA1
7e61f64a38ccaa9c17e7c2559bc106c042081cba
-
SHA256
3de2570125fba893091f0a5bc557524fe53cf8d35a0f36a66562a29f6d68be98
-
SHA512
8bfa86e0fee1b2e56c39ca5d73f48178daa6742d755b0084253f25062f5877aff80aa2e3150897cc6fc7c1ac1cd8705c8d1a7647094b8c650565791cfba9fb5c
-
SSDEEP
1536:HvQBk8mSlzR8thiQCeEYwx22eMOZ5caNpHn60ajITWEnSBcoooCH/Xjtx1KhQLhu:PQgjtMQ3ww/Xjtx1KmQgWH9JPQLz6cw3
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SetupFrontEnd.exedescription pid process Token: SeDebugPrivilege 2176 SetupFrontEnd.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
SetupFrontEnd.exepid process 2176 SetupFrontEnd.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2176-0-0x0000000010090000-0x00000000100AA000-memory.dmpFilesize
104KB
-
memory/2176-1-0x0000000002640000-0x00000000026B8000-memory.dmpFilesize
480KB
-
memory/2176-2-0x0000000002F00000-0x0000000002FF0000-memory.dmpFilesize
960KB
-
memory/2176-3-0x000007FEF5720000-0x000007FEF610C000-memory.dmpFilesize
9.9MB
-
memory/2176-4-0x00000000031F0000-0x00000000033F2000-memory.dmpFilesize
2.0MB
-
memory/2176-5-0x0000000002FF0000-0x0000000003088000-memory.dmpFilesize
608KB
-
memory/2176-6-0x0000000003810000-0x0000000003A18000-memory.dmpFilesize
2.0MB
-
memory/2176-7-0x0000000003600000-0x00000000036FC000-memory.dmpFilesize
1008KB
-
memory/2176-8-0x00000000004C0000-0x00000000004C1000-memory.dmpFilesize
4KB
-
memory/2176-9-0x0000000003D00000-0x0000000003E98000-memory.dmpFilesize
1.6MB
-
memory/2176-10-0x00000000005F0000-0x0000000000610000-memory.dmpFilesize
128KB
-
memory/2176-11-0x0000000003750000-0x00000000037D0000-memory.dmpFilesize
512KB
-
memory/2176-12-0x0000000001F00000-0x0000000001F08000-memory.dmpFilesize
32KB
-
memory/2176-13-0x0000000003750000-0x00000000037D0000-memory.dmpFilesize
512KB
-
memory/2176-30-0x000007FFFFEC0000-0x000007FFFFED0000-memory.dmpFilesize
64KB
-
memory/2176-34-0x000007FEF5720000-0x000007FEF610C000-memory.dmpFilesize
9.9MB
-
memory/2176-35-0x0000000003750000-0x00000000037D0000-memory.dmpFilesize
512KB
-
memory/2176-36-0x0000000003750000-0x00000000037D0000-memory.dmpFilesize
512KB
-
memory/2176-37-0x0000000003750000-0x00000000037D0000-memory.dmpFilesize
512KB
-
memory/2176-38-0x0000000003750000-0x00000000037D0000-memory.dmpFilesize
512KB
-
memory/2176-39-0x0000000003750000-0x00000000037D0000-memory.dmpFilesize
512KB