165b5a81a861e79f1e333226cb8e120023a4df4ba913e62677fdbb43ca212c02

Analysis

max time kernel
90s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
02-09-2024 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PaintDotNet_x64.msi
Size

42.1MB
MD5

31eb66f25819d9c80acba3d303e40698
SHA1

16195d7ace6f09041681f2bab2b019efe7512b60
SHA256

9ab5009f9d378785abb19f2e2e5cae5c6605c9309b365bb6e29f9a42e69e1eaf
SHA512

48a3381d666e30c08bd100cd19f1d146ee05c70f4e156582834bdcf429bbb58cca06be89a6efedd91c3567d539b0277cd6d95605578dc2a98ac3c6630bf3244b
SSDEEP

196608:UuSd3334PMCsfg9cQrAbJAkQMlbVPEAG+kaAG0Uf21d3334AX1aTFnD4YQzLMViw:P/MCsecGPM/jGVJ1mFDD9

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exe

flow	pid	Process
2	4916	msiexec.exe
3	4916	msiexec.exe
4	4916	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in Windows directory 5 IoCs

Processes:

msiexec.exe

description	ioc	Process
File opened for modification	C:\Windows\Installer\e57ab44.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAC1E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD67.tmp	msiexec.exe
File created	C:\Windows\Installer\e57ab44.msi	msiexec.exe

Loads dropped DLL 2 IoCs

Processes:

MsiExec.exe

pid	Process
1740	MsiExec.exe
1740	MsiExec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

Processes:

msiexec.exe

pid	Process
4916	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MsiExec.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009a5c3185e018bce80000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009a5c31850000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809009a5c3185000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9a5c3185000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009a5c318500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exe

description	pid	Process
Token: SeShutdownPrivilege	4916	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4916	msiexec.exe
Token: SeSecurityPrivilege	1352	msiexec.exe
Token: SeCreateTokenPrivilege	4916	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4916	msiexec.exe
Token: SeLockMemoryPrivilege	4916	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4916	msiexec.exe
Token: SeMachineAccountPrivilege	4916	msiexec.exe
Token: SeTcbPrivilege	4916	msiexec.exe
Token: SeSecurityPrivilege	4916	msiexec.exe
Token: SeTakeOwnershipPrivilege	4916	msiexec.exe
Token: SeLoadDriverPrivilege	4916	msiexec.exe
Token: SeSystemProfilePrivilege	4916	msiexec.exe
Token: SeSystemtimePrivilege	4916	msiexec.exe
Token: SeProfSingleProcessPrivilege	4916	msiexec.exe
Token: SeIncBasePriorityPrivilege	4916	msiexec.exe
Token: SeCreatePagefilePrivilege	4916	msiexec.exe
Token: SeCreatePermanentPrivilege	4916	msiexec.exe
Token: SeBackupPrivilege	4916	msiexec.exe
Token: SeRestorePrivilege	4916	msiexec.exe
Token: SeShutdownPrivilege	4916	msiexec.exe
Token: SeDebugPrivilege	4916	msiexec.exe
Token: SeAuditPrivilege	4916	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4916	msiexec.exe
Token: SeChangeNotifyPrivilege	4916	msiexec.exe
Token: SeRemoteShutdownPrivilege	4916	msiexec.exe
Token: SeUndockPrivilege	4916	msiexec.exe
Token: SeSyncAgentPrivilege	4916	msiexec.exe
Token: SeEnableDelegationPrivilege	4916	msiexec.exe
Token: SeManageVolumePrivilege	4916	msiexec.exe
Token: SeImpersonatePrivilege	4916	msiexec.exe
Token: SeCreateGlobalPrivilege	4916	msiexec.exe
Token: SeBackupPrivilege	4100	vssvc.exe
Token: SeRestorePrivilege	4100	vssvc.exe
Token: SeAuditPrivilege	4100	vssvc.exe
Token: SeBackupPrivilege	1352	msiexec.exe
Token: SeRestorePrivilege	1352	msiexec.exe
Token: SeRestorePrivilege	1352	msiexec.exe
Token: SeTakeOwnershipPrivilege	1352	msiexec.exe
Token: SeRestorePrivilege	1352	msiexec.exe
Token: SeTakeOwnershipPrivilege	1352	msiexec.exe
Token: SeRestorePrivilege	1352	msiexec.exe
Token: SeTakeOwnershipPrivilege	1352	msiexec.exe
Token: SeBackupPrivilege	3824	srtasks.exe
Token: SeRestorePrivilege	3824	srtasks.exe
Token: SeSecurityPrivilege	3824	srtasks.exe
Token: SeTakeOwnershipPrivilege	3824	srtasks.exe
Token: SeBackupPrivilege	3824	srtasks.exe
Token: SeRestorePrivilege	3824	srtasks.exe
Token: SeSecurityPrivilege	3824	srtasks.exe
Token: SeTakeOwnershipPrivilege	3824	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid	Process
4916	msiexec.exe
4916	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

msiexec.exe

description	pid	Process	procid_target
PID 1352 wrote to memory of 3824	1352	msiexec.exe	85
PID 1352 wrote to memory of 3824	1352	msiexec.exe	85
PID 1352 wrote to memory of 1740	1352	msiexec.exe	87
PID 1352 wrote to memory of 1740	1352	msiexec.exe	87
PID 1352 wrote to memory of 1740	1352	msiexec.exe	87

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\PaintDotNet_x64.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4916

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3824
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0B89A98FD4480BB9FBCA5DACFD0C7164
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1740

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7

Filesize
2KB

MD5
4527a9e282931651682b8c77546c12fd

SHA1
4962fa85079940fa68b0868f0f73863acaefe59f

SHA256
0ee93741226ca6cbbc44858debb1b29cb0183845e53e2dd5ff88467ddde87b43

SHA512
ab1fd0fdf1de913a5cab17d1d6701f5d748cdc99d653d468c14ba27311d15934e5b08ae77ee29bf0cdb39bd92d19d1fdce814831c845055bfd2e411a0fde1e1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691

Filesize
1KB

MD5
211adfa29f48f36728d9f888c33eb562

SHA1
2d76c056b5efbdfa1ff8bbf0def095e97304d5ea

SHA256
54c562fe1e7ade20685ccb421add65043c63dbb424aa976259abc95f6261bdc9

SHA512
5a3f78dfa06c748f03b75c5b68373589ef23e4342f51d4b5aa35c349e1a8a64ee0779b52340584889a858f9c440a7a132278e1f6dc838490972529941ed9d05d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_B3A35C2FC4F12D9008DA0464762D9ED7

Filesize
510B

MD5
edf6a7396d85ecd1e4e9e8290598a9e7

SHA1
fe4d9505c4c98db32f8d75ba437594289100b0bd

SHA256
9efd62d9d96c176a9430b31f3cb65b2088b9439a5831659c60360f4bab5520b6

SHA512
0d17c21c0ec3731dec341d8d88f92c63a74b9215d3ec4e75d34d924b8262f2954088f15c720818bbb2340bcd8f63eb4ab453eb7e40c0d304404968df07752e5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7

Filesize
490B

MD5
c55c6ffa2edda84919e74ae79205d67b

SHA1
32fb5873559a1a7fe8eaab3aff37ba991992d9a3

SHA256
29ae3fc3dfbcf708b1aa7db94a8aeae153a7f714de0c1ae2ac8fce5755f77aee

SHA512
90f8db6e49b32997af0d3aca5a5f399107bca3ff573878da0bf14551bc4d19d571b05e999004c793eb9c003c129829bd7cb9d09cb2f244bd1b54341e99ff75d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691

Filesize
486B

MD5
c98d477cd554afacf075a74b8ac65bd2

SHA1
21147cfd227172013d7bce0ecc9e152cd4642911

SHA256
2734f7a3f81f9ee6e6e623832427e2344c0b9b5203f8edd29f1a85e832fb679c

SHA512
4d08ebf2e211f432c7d4680d1d81582d747536f45bd190112e1cd9cfc58d006377c9f1f8b25234359d2907150a62458059bfc19b92c8c89a1acb7f1b3504c626

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_B3A35C2FC4F12D9008DA0464762D9ED7

Filesize
490B

MD5
4caa09d190f887bed3ba3896d290ffdb

SHA1
16305c2e4dfd568d55f8506d21bdbd5d42e20d72

SHA256
441fe584a1f7814e66747b60ab23e4b665a14f9e53d212db29c0a38e6893e86a

SHA512
d6caa288ddee8f4d8cd537205fac0bc0663410453f0698785f6a70d3c5d8d23db6b4e9ce76551f24834f134c210ea40fec1580702d7de8237830849caf7f43f4

Download Submit
C:\Windows\Installer\MSIAC1E.tmp

Filesize
294KB

MD5
3dad1eaf900ac0d557048901f39c40ec

SHA1
d47fcbc48af53bf2435acaeb5390a89bf0a19e33

SHA256
ae90445e7c28c72eace289a334d483daa051e654b8f12a95dd1c7a25287c815b

SHA512
7886f624736fafcd45ceae44f5964bf6b5d31f2139f6ac628f6f3dd91eb80c740267aac4b2ecd493064aaf88f69ac8c883159d36a119ce81840919661008aa4c

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
12.8MB

MD5
bd8c37b4e51440243ba47ec7a40767e9

SHA1
41fdb75aab714756474fe6a0b87c05fd74b5ea3f

SHA256
729ef5deb5aa3ae5cce967def919ae770ed6d88e937e50b27417451e809d7141

SHA512
0259af6f10cc70d77b14a6326104a20b34ceb7ded5fd6ef52ca5746f468142ecc7cca9d1988eeb5702739b51ef58e2658218af86fa66a67434ca72f18fd4cc75

Download Submit
\??\Volume{85315c9a-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{99b97cc0-e770-4ab2-8bf0-08c7f1a74441}_OnDiskSnapshotProp

Filesize
6KB

MD5
4a58d0a269ae060b2ccf4fb81c7f9eb2

SHA1
63149b3e240642054c6df2489c6b6f20b5390618

SHA256
7816e9c48054bb77d0c33264aa2625b4773bf4a4741d1a9b6667768c48ccd7f1

SHA512
fa174b798e82523adbd800f0fb8ed9bec448b43e98dbb53fc0f7c2e5ec815352cc9aacaab2d70c7df24e9b07ec64076d1cc8b4e4042ab0efd522e9c01b903387

Download Submit