Analysis
-
max time kernel
82s -
max time network
78s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
21-04-2024 20:33
General
-
Target
ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com].rar
-
Size
132.8MB
-
MD5
d797b7c39ac75189a3c91ee9f9018c05
-
SHA1
8f038be7ab3560d371448b4b88406ad01a2be38e
-
SHA256
6ee78b18ddb57ebb710f371d9c01b743fc7fb080527360a56d9981c56cdffffb
-
SHA512
9b3c43b28218ff01835c2ff515b4537f29d10bcd0a038ba85e3f57493b811a96e43e306b49e50ec80254f925ab100c915abb9507a1b829cf37f381e0993ddf3e
-
SSDEEP
3145728:gacSDhTHOPKpYT7C/CBExbffVB55yTPdlDTrxs0ngF:rHFTcmYwfv7yT/DTrxsY8
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 64 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 21 IoCs
-
HTTP links in PDF interactive object 2 IoCs
Detects HTTP links in interactive objects within PDF files.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 27 IoCs
-
Modifies data under HKEY_USERS 46 IoCs
-
Modifies registry class 50 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 53 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com].rar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com].rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\Desktop\ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com]\paperscanpro4.exe"C:\Users\Admin\Desktop\ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com]\paperscanpro4.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\ORPALIS\PaperScan 4 Professional Edition 4.0.9\install\4FF14CA\PaperScanPro-4.0.9.msi" AI_SETUPEXEPATH="C:\Users\Admin\Desktop\ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com]\paperscanpro4.exe" SETUPEXEDIR="C:\Users\Admin\Desktop\ORPALIS PaperScan Professional Edition 4.0.9 [PeskTop.com]\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1713472323 " AI_FOUND_PREREQS=".NET Framework 4.7.2 (web installer)"2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E9BADC7DF85ED0F371328546565FF171 C2⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B18AD086ADC0B22754B2FB18CF853DAA C2⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 331B89690E27C3C4472495DDFCF56C4D2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.orpalis.com/installation/thank-you-for-installing-paperscan-pro.php3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1CDFCA5C2FC1DE2E052791906E69E481 M Global\MSI00002⤵
- Loads dropped DLL
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000057C" "00000000000003A0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\PaperScan.Launcher.exe"C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\PaperScan.Launcher.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\PaperScan.ListDS32.exe"PaperScan.ListDS32.exe" C:\Users\Admin\AppData\Local\Temp\tmp1299.tmp2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\PaperScan64.exe"C:\Program Files (x86)\ORPALIS\PaperScan 4 Professional Edition\PaperScan64.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
974KB
MD5ced30ef05d2de8f875652c05a7d67025
SHA1830097c23eae8b17bd0a481a2a77735c725edc9e
SHA25687ca5a7a24899be03af4a5aaf31e1d071d47c0431cb3c8835926bb4e9a68773f
SHA5126c4788eb9f08bed8725fc79b28e2b135b39348e03fc0888f52c419c19e48078202cdb6d56db09f9a9f54387ee478f2b68c4abeee3de4d6f972bb5a647097825d
-
Filesize
226KB
MD5da561f44e405d74027797185e4600878
SHA158904d39c1d66baecc467c255d0ed30165751b65
SHA256008350d55afdffaabfde80037d74dc5d1967cde85d0e6970fba5378a2440606e
SHA512db9360b652342c09552e371e68251f96d5ea33f1fb2fe79e2d773a4fb93a1b7ccca807041a684b40ce2100925866cfb3f4e1148ded63b748897884d970295a9c
-
Filesize
471B
MD5eeece5e919a33d267b92b22e8c2e08e3
SHA15ab76b001333e3999c3d1c7dd928c9940bfed114
SHA2561e3ca69a2e6ee930e91c55183acc8001f0390f56870660482a67b6d928c827af
SHA5124052591db3f8243da47915192caf029ab08534bb9bdd0ba90de344fd81db284c8d5c3e8e2100320b52bf5fb4c8cfa0b14be3cef1fcdfb693ef8865b7bd77fc9c
-
Filesize
727B
MD5eee4c7065430328a936943b8a4cc64c1
SHA18d965baa8203acf507dc01147ccf011ad65fadf3
SHA256d6c086aaba2ac573829148dbceff5a0c290b74ea7722c07dff03d412b62853da
SHA5126569255a29a42256ef099b2ee98cb1481803ea9d1669daf0cf4e00569b5cc8fe70c4eadb183dc43bfa1304d562a97e8286d97ee2f9d4c67d65dba4cbe2a9ae0d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
727B
MD5cc6848d9ac77e31dfeadf8c1ab347bd7
SHA16bbab79a405666cb63f2e321330e10f4fabca6b4
SHA2561bfe4a31c943532b6f000d26e721022f250f5555ef2f0bf12605c35ec606a338
SHA51274214efdbe65e264e9b63506b4d74fd520d7322f03153a6f50dbf4236b36848fdd5b1b42431c600e8c75e4119c912b10a9a0d213043aa7102177ac95134d5966
-
Filesize
400B
MD5c63a3bb1117626bfb77c672a441ae665
SHA19ffea9f88e0e70cbafc2bea6caddb06bb5fe51ba
SHA2565267cf363fe48afdc382a473360ffea2b4a589aa2c81dacbeb1a29b8dca369d4
SHA512b3ae2992ba2d81a58bc2df6d2e45edd427b776356bf6d12eb3c3cc38c48be5b6aed3ce65199802d438c4e7709942d5e6b52443ef3f9d065bda3be3a675c145d5
-
Filesize
408B
MD5b1bc4750a26ff027e8eff5d81cae7318
SHA1240a45ec767553b65460df911782b84263e695a6
SHA2569bda404dcf13f2749aec5be50733af3df01752f9ebd5321f29a7090c811cac2f
SHA51247fcb11b860933d75f6e5346b5e8141908769c074f4b69d5e344b134534b9a19401aba4a01cc98b3637d91f3502979d726b04632d1b3149d5b2c94607fb6b2fc
-
Filesize
344B
MD522592e5487ed5c1e0bcbdd8df6aa17a3
SHA150267dfc43ea62d3b4c7f6307c91c71ceabb3027
SHA256f72439dba27011b733efcddaa7dc340b0de92e260b99d55f616610bc513e1514
SHA51242da89ed6e16b7c1a76b6da1a4d14a5ae0d716f71cfea2c7ecd5731bc8da4ac83b38d3abad1c2339a2743c8327a79133b51609eb919d6be5bab7478d9a6b9ca2
-
Filesize
304B
MD52a37d38862eb423c0d8a602ea869b2dc
SHA1a3f1c47226dc5c34477451a79edd8def52f68af0
SHA256ad3cfc2e5b512d3c538597d5271a75eea1d36c4b48266656ef33265298b80f22
SHA51218ff1861fc2d0d2a08d1af101db92292ade5c739a6568774ba5d3faae5601eead14a5e3a184d25e738f5c69b29ca366e75417e88ca5bf8a8ffa8557af104d4cb
-
Filesize
412B
MD513d5adfabe8e1c9faf91c73786f77dac
SHA1ea0c1117fdc6870568c93b44cff4ee27b8cb3d39
SHA256e28d02c7fd33bb84a058a14c8f2fe8aa1677a0b772970cad9df3207dd7298823
SHA5123ec1b44b1a877cf70b1a7f871e0e4b301d8756b6057c2f2ba9570eebbea616088e823339cf4eed003459325c3b068b0785516c109ee7b7294286ced4ca5be9ea
-
Filesize
14KB
MD5a19eb2269d8449012cf8cf3693e9698a
SHA17be34d8186407ede94e068874417ddaf3bf3012e
SHA256478f1e9f4cbcbc6062e3a609362a60e8c78e38507e60ba5a6b9db7d219e66a14
SHA51286d71a7087d8597b06d822dab99d9cad5208fff612fa20c95db2ee712be61003d40a494dfe6c3836627592a9963d5729bc5ce4d7b4bbeb24fa6b613bf0d6631e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1.1MB
MD5afc6287898cc2f4e11e7ecca5ba67979
SHA100417961dd06817ad989aff7d6832f854a4e81b8
SHA25665449b7ef921a26b22c2f5ba6bb8d22ced0a337313587c805bb165808346c402
SHA51211bf538fd8c9330d6554e06e65b094aac27c657a0450ee6dd0891fb35644505d65e968395902b1d115f64d8c9a30f3d81e3db301705d82c084f7b028b8bd616c
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
3.9MB
MD55d4fde4c707c1a2dd7e3c05a52f297fe
SHA1a5a1da3bc4ae26338c327e985f9434afb55cbbb2
SHA256db0f654c478f575534f1e94ecda41f53611024b4191517f28f8793478f0cf382
SHA512e0df43f49c28a8a607ba1b3c13bcec95a368c4fce1e15f6ebb902b1ec49d83a537acc66f170f74fd6c6114a5c72fbd4bcb67c4e35a1b42dce4f9a6783f3d7952
-
Filesize
34.3MB
MD5eb67c95518bfadbac8fd0a246380f92a
SHA1619d5f83953577a35bd66c73ff9f4c0f49177e8b
SHA2562f849f1686a825f454fcc66a793b8d12c00d5c786215a63a69ba66889a3bf79f
SHA5122ce122a8ca5e10d9ce03fce0cd949dacac4f7c85d0647753627e47ed00bf0035d11f941ea5f10b8744afe29fa37dac9395dbb4d61889ef7098fab39f107eac08
-
Filesize
1.5MB
MD5144831edb0592e611527872a5abae5b2
SHA117d5a5a09b1c7be14ba1828f132e37453c54ed10
SHA256d01d274aa064cb61d0ef707eb5a9a197d58117b6c6248a5dca0c5d18576f471e
SHA512e8cf3e4a1a5f4749e450ae0b0780c0201d09367a57b42f186e22ba5ecd67dd52b7a008fd4cd4324904ddc452e2f499558e7b7f4c24a4cebeeb5ce2031ae5ebf3
-
Filesize
13.7MB
MD5cc9e341b51458c734f55e42a2dd9a504
SHA1b8a46495187d9efe48bb936086e74e214486d668
SHA256e25fb88568d774dada22f50c62a5a0372cc744c519fb0b58fe4ef18fd8e4e480
SHA512bf8f31ddf3e286cffe96f52dcd8c7c2acc0c8708e6f5e70fa535c8eb0abe111a568e20fb957bf93426bad7d40b404b8679a1591ce30b8cf6583ba2952afaec94
-
Filesize
196KB
MD596c3d670b8428a5e122daee0661e393c
SHA1d4ea2ae807f154ba59351ca602525a00313c8553
SHA2564db27638b60a044a046a68b7f0604496e3a6a732acaa33273461e2daf22f504f
SHA512da7d2a82b6b73b7623529e1014bee50a68bbb59c30cfba2e4af6b4b98d03a376545193af45ce5ce007b3c8538cf9237b10fcdb304fb5262a81f8c31a458460f3
-
Filesize
10.0MB
MD54b68c037cc603b7f9c8683d71db0306f
SHA1323d734e483bc8ef28599c018a1f737f7030da4b
SHA2566961b960b5eb6f96adbf6d21c1b2c466f5f5fd017bf92399aa93175c69eb8b55
SHA51247d8a07f191b7b2d930307232c71869134a09c07ac5f1ce8d33a23c185393bd578a62a42af462466c0f03932ab35be421c2aa04976ce748d4797d5eb66074e9c
-
Filesize
3.7MB
MD591feee7a5212ab8244ab5915a443d92d
SHA1243c5f38314a4fb8c8412868bb131853929d95bf
SHA256a59241ac480779e9e3d09cb5952ee2bf26daf9277714751442f257c0d1ca1a80
SHA512e4367b4e922c443c652767b45ad4bf82fefded07b78c2a891f382b2d3ad3a49aa834e8a35816e87d52cf3dc805e403aa346810d71acd2820f17b3c65baf4fe49
-
Filesize
124.9MB
MD5d964449be90f3d1eabcd4bd4e0f1687b
SHA11f58c435655108220a656066933ce05de5a18f64
SHA25693ec1818f17060773929f735d16343edeb9fab83b35d01f6ae4473c979d33443
SHA5127a223efd9be3ac244065e387078bfc90704c2bf5665b14a8d9b1a90755f3f56759df88b36e1f9ca85b849728a9eddf48e9e15adf8a2044131a269de25b49dde4
-
Filesize
923KB
MD589e5a0ebcdd5c5c5814462e71b9323e3
SHA1d9e42e5c33ef6427df4cb966795d94492ae9fe2a
SHA25618476652e953d5d87067f0e2c84918ff3bae5cda8101d8f395b0c47cfc6c8b22
SHA5123dafc2a64a8e5e15030fca32d23f7059a41f371b086ec953815a5c51c122d06630d9ed5b0ce8085580e147181127879aa0e4ff37575a87a110ecd3d92911cdcf
-
Filesize
169KB
MD5b3d8bbe5cbf99ecb80e5bedc878c1ce1
SHA18b07b48a97bf711109a6546225fce3471a9d9598
SHA25616539e1e876ffb67d516611afb780cf6d993c4742efc8443f1b925f12ecaa6ae
SHA51259b02e868dec40eaf0daeff663e3b753fd4786a532f4dface440f956172c2cac9b60bf4f51d2f4e11b5b83135cf7baa209a26b09ef1dda71e214829003d6cf75
-
Filesize
584KB
MD58e565fd81ca10a65cc02e7901a78c95b
SHA11bca3979c233321ae527d4508cfe9b3ba825dbd3
SHA2567b64112c2c534203bb59ce1a9b7d5390448c045dda424fb3cfd5878edb262016
SHA512144bde89eba469b32b59f30e7f4d451329c541ed7b556bc60d118c9e2e5cdf148c2275cca51c4b9355686aefa16a4b86a26d4c8fe0dd2cf318b979863109592e
-
Filesize
709KB
MD5130a4e28b3349aff8a444f6fcebbac91
SHA1fee5efe0a1b9aea337e607f417bb091c3017537b
SHA256750bf3e65d692ff255620c5b8d7c951d93d3deb65586ebb5a3e3b7ba2de10e39
SHA5121564306e22db0000a78076e6811f0e4f9ca31c7fea95e1070a6ce422c408863810a2f55376b8db1aec2512e23d926d5d61ac280d4babc31c52dd645440ef510a
-
Filesize
9.4MB
MD5f844081c212986712286ba7e7acc3d62
SHA1da92a97e8de3ba0769200165d1e6742297391bea
SHA25626106e3622caefcb06b7b0409637ed01959612b459aa9e369b0be9b76e362c91
SHA512c6456c4db37428a383d5c0875f44bcfd28d87ec7299b3e02843790a93b51780aeb539a01cbf301fdebd643c11fe1b304736c863fc037a6865c7f14d0eb6a4e4e
-
Filesize
17.8MB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
304KB
-
Filesize
260KB
-
Filesize
32KB
-
Filesize
704KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
228KB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
104KB
-
Filesize
696KB
-
Filesize
21.6MB
-
Filesize
34.3MB
-
Filesize
7.5MB
-
Filesize
512KB
-
Filesize
5.1MB
-
Filesize
6.5MB
-
Filesize
9.4MB
-
Filesize
9.9MB
-
Filesize
17.8MB
-
Filesize
228KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
34.3MB
-
Filesize
7.5MB
-
Filesize
240KB
-
Filesize
5.1MB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
104KB
-
Filesize
512KB
-
Filesize
704KB
-
Filesize
512KB
-
Filesize
696KB
-
Filesize
6.9MB
-
Filesize
32KB
-
Filesize
6.9MB
-
Filesize
34.3MB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
