Overview
overview
10Static
static
10Paint.NET_v4.2.10.exe
windows11-21h2-x64
10PaintDotNe...er.dll
windows11-21h2-x64
1PaintDotNet.exe
windows11-21h2-x64
1PaintDotNet_x64.msi
windows11-21h2-x64
6SetupShim.exe
windows11-21h2-x64
3System.AppContext.dll
windows11-21h2-x64
1System.Buffers.dll
windows11-21h2-x64
1System.Col...nt.dll
windows11-21h2-x64
1System.Col...ic.dll
windows11-21h2-x64
1System.Col...ed.dll
windows11-21h2-x64
1System.Col...ns.dll
windows11-21h2-x64
1System.Com...nc.dll
windows11-21h2-x64
1System.Com...es.dll
windows11-21h2-x64
1System.Com...er.dll
windows11-21h2-x64
1System.Com...el.dll
windows11-21h2-x64
1System.Console.dll
windows11-21h2-x64
1System.Dat...on.dll
windows11-21h2-x64
1System.Dia...ts.dll
windows11-21h2-x64
1System.Dia...ug.dll
windows11-21h2-x64
1System.Dia...fo.dll
windows11-21h2-x64
1System.Dia...ss.dll
windows11-21h2-x64
1System.Dia...ce.dll
windows11-21h2-x64
1System.Dia...er.dll
windows11-21h2-x64
1System.Dia...ls.dll
windows11-21h2-x64
1System.Dia...ce.dll
windows11-21h2-x64
1System.Dia...ng.dll
windows11-21h2-x64
1System.Dra...es.dll
windows11-21h2-x64
1System.Dyn...me.dll
windows11-21h2-x64
1System.Glo...rs.dll
windows11-21h2-x64
1System.Glo...ns.dll
windows11-21h2-x64
1System.Glo...on.dll
windows11-21h2-x64
1System.IO....le.dll
windows11-21h2-x64
1Analysis
-
max time kernel
92s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
02-09-2024 04:00
Behavioral task
behavioral1
Sample
Paint.NET_v4.2.10.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
PaintDotNet.SystemLayer.dll
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
PaintDotNet.exe
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
PaintDotNet_x64.msi
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
SetupShim.exe
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
System.AppContext.dll
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
System.Buffers.dll
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
System.Collections.Concurrent.dll
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
System.Collections.NonGeneric.dll
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
System.Collections.Specialized.dll
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
System.Collections.dll
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
System.ComponentModel.EventBasedAsync.dll
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
System.ComponentModel.Primitives.dll
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
System.ComponentModel.TypeConverter.dll
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
System.ComponentModel.dll
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
System.Console.dll
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
System.Data.Common.dll
Resource
win11-20240802-en
Behavioral task
behavioral18
Sample
System.Diagnostics.Contracts.dll
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
System.Diagnostics.Debug.dll
Resource
win11-20240802-en
Behavioral task
behavioral20
Sample
System.Diagnostics.FileVersionInfo.dll
Resource
win11-20240802-en
Behavioral task
behavioral21
Sample
System.Diagnostics.Process.dll
Resource
win11-20240802-en
Behavioral task
behavioral22
Sample
System.Diagnostics.StackTrace.dll
Resource
win11-20240802-en
Behavioral task
behavioral23
Sample
System.Diagnostics.TextWriterTraceListener.dll
Resource
win11-20240802-en
Behavioral task
behavioral24
Sample
System.Diagnostics.Tools.dll
Resource
win11-20240802-en
Behavioral task
behavioral25
Sample
System.Diagnostics.TraceSource.dll
Resource
win11-20240802-en
Behavioral task
behavioral26
Sample
System.Diagnostics.Tracing.dll
Resource
win11-20240802-en
Behavioral task
behavioral27
Sample
System.Drawing.Primitives.dll
Resource
win11-20240802-en
Behavioral task
behavioral28
Sample
System.Dynamic.Runtime.dll
Resource
win11-20240802-en
Behavioral task
behavioral29
Sample
System.Globalization.Calendars.dll
Resource
win11-20240802-en
Behavioral task
behavioral30
Sample
System.Globalization.Extensions.dll
Resource
win11-20240802-en
Behavioral task
behavioral31
Sample
System.Globalization.dll
Resource
win11-20240802-en
Behavioral task
behavioral32
Sample
System.IO.Compression.ZipFile.dll
Resource
win11-20240802-en
General
-
Target
SetupShim.exe
-
Size
133KB
-
MD5
829f3a3164d7e6b1bd72a2412aefd0df
-
SHA1
2d656d236ea967245cb0b18d48355e4650863612
-
SHA256
40f630e6f8838fe6070fce2aef769530033d8bd6b8699e9565468a16f0e3f110
-
SHA512
7ddf8d47e1bb496fc83f865c92ee3f3b1aef7cfc4cacb63307dcdf931a33f700e8f3b2a225ee273412dd074883e3e389e5b94336cae98db0faa1284abbadfea4
-
SSDEEP
3072:2N8Hab73bFvqGnVFYvB6T8dhNgeae1U1P7oBVYoHoC8GAjuF6PfaMqVuipKYnTbM:2qs73bEXB7d1IPOopjuF63cKGvM
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SetupShim.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4020 wrote to memory of 2436 4020 SetupShim.exe 82 PID 4020 wrote to memory of 2436 4020 SetupShim.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\SetupShim.exe"C:\Users\Admin\AppData\Local\Temp\SetupShim.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\SetupFrontEnd.exe"SetupFrontEnd.exe" "C:\Users\Admin\AppData\Local\Temp\SetupShim.exe"2⤵PID:2436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
577B
MD567be229517828a8a7c3589a7736a666f
SHA109143b5f59103608c61d414f403f3cd79fe5b07c
SHA256ebc8f1ba1beaaf2b0c98ca252fd6a25b8bb844397618d6139f6a5deb5bcfdcc8
SHA512252dbd7c7aee33093daa1346654048c15ee1b402b5781cb2e823d414a2f426652e39232e6b3b701472ffca46cdc8c27470f40ebd2e2406eb8d5ebdeaaa764e6d