deeeb30e5f0be778456f342e00fdeeeff8fb01fba7ebfff09c2154b961dc36d1

General

Target

MoneyGrabber.exe
Size

369KB
MD5

782522ffec6918e07c3e153a604476de
SHA1

f49b43cebd12559c6dcac7fbcb739413ccf10b5d
SHA256

deeeb30e5f0be778456f342e00fdeeeff8fb01fba7ebfff09c2154b961dc36d1
SHA512

55a17f1df0666f0ff5d7ea560f553e87908fb292b319368254487a17a007aa8191d1908bf2bc94c7b239711e3dc411d57bc27cfd32ee7af26caec426b105e7bc
SSDEEP

6144:y1q1eajrFwRhKQECsXxGKu6ohB9IprsZWrjOcZmboj:JhjrFwJshvu6ygS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Internet Explorer\LowRegistry\Shell Extensions	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Internet Explorer\LowRegistry\Shell Extensions\Cached	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Internet Explorer\LowRegistry	PaintStudio.View.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	PaintStudio.View.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4320	PaintStudio.View.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
4808	mspaint.exe
4808	mspaint.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4320	PaintStudio.View.exe
Token: SeDebugPrivilege	4320	PaintStudio.View.exe
Token: SeDebugPrivilege	4320	PaintStudio.View.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4808	mspaint.exe
4320	PaintStudio.View.exe
4320	PaintStudio.View.exe

C:\Users\Admin\AppData\Local\Temp\MoneyGrabber.exe
"C:\Users\Admin\AppData\Local\Temp\MoneyGrabber.exe"
1⤵
PID:4516

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ResolveConnect.jfif" /ForceBootstrapPaint3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4808

C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

Filesize
233B

MD5
8c82a72bde6f53ef303b548c6c3ed454

SHA1
43467714adf4a7f0d8d7ba523d3b21893ea63836

SHA256
88184b1a9ef4eebe865d2d70c7cdbd45104317a5698ea4ac0afb062d879e648e

SHA512
ac7ebf287f823521e6115194e25c322ce0a3deddc90c3d21d5df88bbb6aedc459459a778f604792346b38414de1907453ed820f4b345fc56f09877289f5fd71c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json

Filesize
2KB

MD5
404a3ec24e3ebf45be65e77f75990825

SHA1
1e05647cf0a74cedfdeabfa3e8ee33b919780a61

SHA256
cc45905af3aaa62601a69c748a06a2fa48eca3b28d44d8ec18764a7e8e4c3da2

SHA512
a55382b72267375821b0a229d3529ed54cef0f295f550d1e95661bafccec606aa1cd72e059d37d78e7d2927ae72e2919941251d233152f5eeb32ffdfc96023e5

Download Submit

Analysis

Sharing