Overview
overview
10Static
static
10Paint.NET_v4.2.10.exe
windows11-21h2-x64
10PaintDotNe...er.dll
windows11-21h2-x64
1PaintDotNet.exe
windows11-21h2-x64
1PaintDotNet_x64.msi
windows11-21h2-x64
6SetupShim.exe
windows11-21h2-x64
3System.AppContext.dll
windows11-21h2-x64
1System.Buffers.dll
windows11-21h2-x64
1System.Col...nt.dll
windows11-21h2-x64
1System.Col...ic.dll
windows11-21h2-x64
1System.Col...ed.dll
windows11-21h2-x64
1System.Col...ns.dll
windows11-21h2-x64
1System.Com...nc.dll
windows11-21h2-x64
1System.Com...es.dll
windows11-21h2-x64
1System.Com...er.dll
windows11-21h2-x64
1System.Com...el.dll
windows11-21h2-x64
1System.Console.dll
windows11-21h2-x64
1System.Dat...on.dll
windows11-21h2-x64
1System.Dia...ts.dll
windows11-21h2-x64
1System.Dia...ug.dll
windows11-21h2-x64
1System.Dia...fo.dll
windows11-21h2-x64
1System.Dia...ss.dll
windows11-21h2-x64
1System.Dia...ce.dll
windows11-21h2-x64
1System.Dia...er.dll
windows11-21h2-x64
1System.Dia...ls.dll
windows11-21h2-x64
1System.Dia...ce.dll
windows11-21h2-x64
1System.Dia...ng.dll
windows11-21h2-x64
1System.Dra...es.dll
windows11-21h2-x64
1System.Dyn...me.dll
windows11-21h2-x64
1System.Glo...rs.dll
windows11-21h2-x64
1System.Glo...ns.dll
windows11-21h2-x64
1System.Glo...on.dll
windows11-21h2-x64
1System.IO....le.dll
windows11-21h2-x64
1Analysis
-
max time kernel
92s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
02-09-2024 04:00
Behavioral task
behavioral1
Sample
Paint.NET_v4.2.10.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
PaintDotNet.SystemLayer.dll
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
PaintDotNet.exe
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
PaintDotNet_x64.msi
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
SetupShim.exe
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
System.AppContext.dll
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
System.Buffers.dll
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
System.Collections.Concurrent.dll
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
System.Collections.NonGeneric.dll
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
System.Collections.Specialized.dll
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
System.Collections.dll
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
System.ComponentModel.EventBasedAsync.dll
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
System.ComponentModel.Primitives.dll
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
System.ComponentModel.TypeConverter.dll
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
System.ComponentModel.dll
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
System.Console.dll
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
System.Data.Common.dll
Resource
win11-20240802-en
Behavioral task
behavioral18
Sample
System.Diagnostics.Contracts.dll
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
System.Diagnostics.Debug.dll
Resource
win11-20240802-en
Behavioral task
behavioral20
Sample
System.Diagnostics.FileVersionInfo.dll
Resource
win11-20240802-en
Behavioral task
behavioral21
Sample
System.Diagnostics.Process.dll
Resource
win11-20240802-en
Behavioral task
behavioral22
Sample
System.Diagnostics.StackTrace.dll
Resource
win11-20240802-en
Behavioral task
behavioral23
Sample
System.Diagnostics.TextWriterTraceListener.dll
Resource
win11-20240802-en
Behavioral task
behavioral24
Sample
System.Diagnostics.Tools.dll
Resource
win11-20240802-en
Behavioral task
behavioral25
Sample
System.Diagnostics.TraceSource.dll
Resource
win11-20240802-en
Behavioral task
behavioral26
Sample
System.Diagnostics.Tracing.dll
Resource
win11-20240802-en
Behavioral task
behavioral27
Sample
System.Drawing.Primitives.dll
Resource
win11-20240802-en
Behavioral task
behavioral28
Sample
System.Dynamic.Runtime.dll
Resource
win11-20240802-en
Behavioral task
behavioral29
Sample
System.Globalization.Calendars.dll
Resource
win11-20240802-en
Behavioral task
behavioral30
Sample
System.Globalization.Extensions.dll
Resource
win11-20240802-en
Behavioral task
behavioral31
Sample
System.Globalization.dll
Resource
win11-20240802-en
Behavioral task
behavioral32
Sample
System.IO.Compression.ZipFile.dll
Resource
win11-20240802-en
General
-
Target
SetupShim.exe
-
Size
133KB
-
MD5
829f3a3164d7e6b1bd72a2412aefd0df
-
SHA1
2d656d236ea967245cb0b18d48355e4650863612
-
SHA256
40f630e6f8838fe6070fce2aef769530033d8bd6b8699e9565468a16f0e3f110
-
SHA512
7ddf8d47e1bb496fc83f865c92ee3f3b1aef7cfc4cacb63307dcdf931a33f700e8f3b2a225ee273412dd074883e3e389e5b94336cae98db0faa1284abbadfea4
-
SSDEEP
3072:2N8Hab73bFvqGnVFYvB6T8dhNgeae1U1P7oBVYoHoC8GAjuF6PfaMqVuipKYnTbM:2qs73bEXB7d1IPOopjuF63cKGvM
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
SetupShim.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SetupShim.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
SetupShim.exedescription pid process target process PID 4020 wrote to memory of 2436 4020 SetupShim.exe SetupFrontEnd.exe PID 4020 wrote to memory of 2436 4020 SetupShim.exe SetupFrontEnd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SetupShim.exe"C:\Users\Admin\AppData\Local\Temp\SetupShim.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SetupFrontEnd.exe"SetupFrontEnd.exe" "C:\Users\Admin\AppData\Local\Temp\SetupShim.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\pdnSetupShim.logFilesize
577B
MD567be229517828a8a7c3589a7736a666f
SHA109143b5f59103608c61d414f403f3cd79fe5b07c
SHA256ebc8f1ba1beaaf2b0c98ca252fd6a25b8bb844397618d6139f6a5deb5bcfdcc8
SHA512252dbd7c7aee33093daa1346654048c15ee1b402b5781cb2e823d414a2f426652e39232e6b3b701472ffca46cdc8c27470f40ebd2e2406eb8d5ebdeaaa764e6d
-
memory/2436-18-0x00007FFF03063000-0x00007FFF03065000-memory.dmpFilesize
8KB
-
memory/2436-19-0x0000015CA4830000-0x0000015CA484A000-memory.dmpFilesize
104KB
-
memory/2436-20-0x0000015CA65D0000-0x0000015CA6638000-memory.dmpFilesize
416KB
-
memory/2436-21-0x0000015CBEEA0000-0x0000015CBEF80000-memory.dmpFilesize
896KB
-
memory/2436-22-0x0000015CBF170000-0x0000015CBF35C000-memory.dmpFilesize
1.9MB
-
memory/2436-23-0x0000015CBF020000-0x0000015CBF0B4000-memory.dmpFilesize
592KB
-
memory/2436-24-0x0000015CBF550000-0x0000015CBF73E000-memory.dmpFilesize
1.9MB
-
memory/2436-25-0x0000015CBF740000-0x0000015CBF83C000-memory.dmpFilesize
1008KB
-
memory/2436-26-0x0000015CA6410000-0x0000015CA6411000-memory.dmpFilesize
4KB
-
memory/2436-27-0x0000015CBF360000-0x0000015CBF4D8000-memory.dmpFilesize
1.5MB
-
memory/2436-28-0x0000015CA6460000-0x0000015CA6480000-memory.dmpFilesize
128KB
-
memory/2436-29-0x00007FFF03060000-0x00007FFF03B22000-memory.dmpFilesize
10.8MB
-
memory/2436-30-0x00007FFF03060000-0x00007FFF03B22000-memory.dmpFilesize
10.8MB
-
memory/2436-31-0x00007FFF03060000-0x00007FFF03B22000-memory.dmpFilesize
10.8MB
-
memory/2436-33-0x00007FFF03060000-0x00007FFF03B22000-memory.dmpFilesize
10.8MB