Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 14:30
Behavioral task
behavioral1
Sample
paint.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
General
-
Target
paint.exe
-
Size
4.3MB
-
MD5
91f58c76697f964e359844b460980bff
-
SHA1
d943bbf58b25f3bd49393044ba02b8a0bd9c5cd5
-
SHA256
335182fb927d6ce2bbe800b35997d7e0e6010ce388434c65355c11353b0116f2
-
SHA512
1af656c10d97d652eccfd01c1d84fccf02e6a59219b7f611987f5241d53e98ed5f44d785609491075f992273ed0359cd56fe1101da3b5596bdb9ceb3d1bc9868
-
SSDEEP
98304:OfWMn/85jV8kbave4qaI6d3WonyEQ+us76D+iLdkCWdFv:yYkeeI6d3Wy57mLnCFv
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ paint.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ paint.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion paint.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion paint.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion paint.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion paint.exe -
resource yara_rule behavioral2/memory/2012-1-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-0-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-3-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-2-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-4-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-5-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-6-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-7-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-8-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-22-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/1008-23-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/1008-25-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/1008-24-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/1008-26-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/1008-27-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/1008-28-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/1008-29-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/1008-30-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/1008-32-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-33-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-34-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-35-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-36-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-37-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-39-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-40-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-41-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-42-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-43-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-44-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-45-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida behavioral2/memory/2012-46-0x00007FF75BAD0000-0x00007FF75C623000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA paint.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA paint.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 1520 taskmgr.exe 1520 taskmgr.exe 2012 paint.exe 2012 paint.exe 1520 taskmgr.exe 1520 taskmgr.exe 2012 paint.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1520 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 2012 paint.exe Token: SeIncBasePriorityPrivilege 2012 paint.exe Token: 33 2012 paint.exe Token: SeLoadDriverPrivilege 2012 paint.exe Token: SeProfSingleProcessPrivilege 2012 paint.exe Token: SeBackupPrivilege 2012 paint.exe Token: SeRestorePrivilege 2012 paint.exe Token: SeShutdownPrivilege 2012 paint.exe Token: SeTakeOwnershipPrivilege 2012 paint.exe Token: SeDebugPrivilege 1520 taskmgr.exe Token: SeSystemProfilePrivilege 1520 taskmgr.exe Token: SeCreateGlobalPrivilege 1520 taskmgr.exe Token: SeDebugPrivilege 1008 paint.exe Token: SeIncBasePriorityPrivilege 1008 paint.exe Token: 33 1008 paint.exe Token: SeLoadDriverPrivilege 1008 paint.exe Token: SeProfSingleProcessPrivilege 1008 paint.exe Token: SeBackupPrivilege 1008 paint.exe Token: SeRestorePrivilege 1008 paint.exe Token: SeShutdownPrivilege 1008 paint.exe Token: SeTakeOwnershipPrivilege 1008 paint.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 2012 paint.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe 2012 paint.exe 1520 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\paint.exe"C:\Users\Admin\AppData\Local\Temp\paint.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2012
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1520
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\paint.exe"C:\Users\Admin\AppData\Local\Temp\paint.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
PID:1008