db5d7f84baf1b1e37383273814398ada75b8d1b0b1b4ec9227776f090cbc5870

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

Paste 4.4....d].dmg

macos-10.15-amd64

Paste 4.4...._store

windows7-x64

Paste 4.4...._store

windows10-2004-x64

Paste 4.4....n.icns

windows7-x64

Paste 4.4....n.icns

windows10-2004-x64

Paste 4.4....g.tiff

windows7-x64

Paste 4.4....g.tiff

windows10-2004-x64

Paste 4.4....123.gz

windows7-x64

Paste 4.4....123.gz

windows10-2004-x64

Paste 4.4....124.gz

windows7-x64

Paste 4.4....124.gz

windows10-2004-x64

Paste 4.4....d-uuid

windows7-x64

Paste 4.4....d-uuid

windows10-2004-x64

Paste 4.4....fo.xml

windows7-x64

Paste 4.4....fo.xml

windows10-2004-x64

Paste 4.4.....plist

windows7-x64

Paste 4.4.....plist

windows10-2004-x64

Paste 4.4....Helper

macos-10.15-amd64

Paste 4.4....kgInfo

windows7-x64

Paste 4.4....kgInfo

windows10-2004-x64

Paste 4.4....es.xml

windows7-x64

Paste 4.4....es.xml

windows10-2004-x64

Paste 4.4..../Paste

macos-10.15-amd64

Paste 4.4.....dylib

macos-10.15-amd64

Paste 4.4....kgInfo

windows7-x64

Paste 4.4....kgInfo

windows10-2004-x64

Paste 4.4....n.icns

windows7-x64

Paste 4.4....n.icns

windows10-2004-x64

Paste 4.4....te.cer

windows7-x64

Paste 4.4....te.cer

windows10-2004-x64

Paste 4.4....ts.pdf

windows7-x64

Paste 4.4....ts.pdf

windows10-2004-x64

Analysis

max time kernel
134s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 00:00

Sharing

Copy URL

Twitter E-mail

Static task

static1

pdf evasion

1 signatures

Behavioral task

behavioral1

Sample

Paste 4.4.0 [MacKed].dmg

Resource

macos-20240711.1-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

Paste 4.4.0 [MacKed]/.ds_store

Resource

win7-20240903-en

discovery

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral3

Sample

Paste 4.4.0 [MacKed]/.ds_store

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral4

Sample

Paste 4.4.0 [MacKed]/.VolumeIcon.icns

Resource

win7-20240903-en

discovery

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral5

Sample

Paste 4.4.0 [MacKed]/.VolumeIcon.icns

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

Paste 4.4.0 [MacKed]/.background/dmgcanvas_bg.tiff

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

Paste 4.4.0 [MacKed]/.background/dmgcanvas_bg.tiff

Resource

win10v2004-20240910-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

Paste 4.4.0 [MacKed]/.fseventsd/000000000159b123.gz

Resource

win7-20240903-en

discovery

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral9

Sample

Paste 4.4.0 [MacKed]/.fseventsd/000000000159b123.gz

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral10

Sample

Paste 4.4.0 [MacKed]/.fseventsd/000000000159b124.gz

Resource

win7-20240903-en

discovery

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral11

Sample

Paste 4.4.0 [MacKed]/.fseventsd/000000000159b124.gz

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral12

Sample

Paste 4.4.0 [MacKed]/.fseventsd/fseventsd-uuid

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

Paste 4.4.0 [MacKed]/.fseventsd/fseventsd-uuid

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Info.xml

Resource

win7-20240704-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral15

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Info.xml

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app/Contents/Info.plist

Resource

win7-20240708-en

discovery

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral17

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app/Contents/Info.plist

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral18

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app/Contents/MacOS/LaunchAtLoginHelper

Resource

macos-20240711.1-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app/Contents/PkgInfo

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app/Contents/PkgInfo

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral21

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app/Contents/_CodeSignature/CodeResources.xml

Resource

win7-20240903-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral22

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app/Contents/_CodeSignature/CodeResources.xml

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/MacOS/Paste

Resource

macos-20240711.1-en

evasion

macos-10.15-amd64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/MacOS/macked.app.dylib

Resource

macos-20240711.1-en

evasion

macos-10.15-amd64

1 signatures

150 seconds

Behavioral task

behavioral25

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/PkgInfo

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral26

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/PkgInfo

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral27

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Resources/AppIcon.icns

Resource

win7-20240903-en

discovery

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral28

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Resources/AppIcon.icns

Resource

win10v2004-20240802-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral29

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Resources/AppleIncRootCertificate.cer

Resource

win7-20240729-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral30

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Resources/AppleIncRootCertificate.cer

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Resources/Assets.pdf

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral32

Sample

Paste 4.4.0 [MacKed]/Paste.app/Contents/Resources/Assets.pdf

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

6 signatures

150 seconds

Report Analysis Logs

General

Target

Paste 4.4.0 [MacKed]/Paste.app/Contents/Info.xml
Size

2KB
MD5

c430f3318cf0923fa2a3e4be295bbb18
SHA1

3736a90b8960e088311362277a146f85329958c2
SHA256

73354ba74dbc7e0423b8d44297d7328d214e469254ac7be9a7d0c75ce038ae0b
SHA512

523e6982408383d494f3ab66688a78992cb15e9fd0a7cdabec573fbe6ad43a9955f0993f92b35b7d2d1dcece3a08d5ba82dc696eab5368821189fdad70acdfa9

Score

1^/10

Malware Config

Signatures

Processes

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Paste 4.4.0 [MacKed]\Paste.app\Contents\Info.xml"
1⤵
PID:4808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4808-0-0x00007FFAA5010000-0x00007FFAA5020000-memory.dmp

Filesize
64KB

Download
memory/4808-1-0x00007FFAE502D000-0x00007FFAE502E000-memory.dmp

Filesize
4KB

Download
memory/4808-2-0x00007FFAE4F90000-0x00007FFAE5185000-memory.dmp

Filesize
2.0MB

Download
memory/4808-3-0x00007FFAE4F90000-0x00007FFAE5185000-memory.dmp

Filesize
2.0MB

Download
memory/4808-4-0x00007FFAE4F90000-0x00007FFAE5185000-memory.dmp

Filesize
2.0MB

Download