hxxp://paint[.]net

Resubmissions

24/04/2026, 04:21

260424-eyv9waex6v1

24/04/2026, 04:20

260424-eykhdaex5v1

Analysis

user interaction
yes
max time kernel
10s
max time network
9s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://paint.net
Sample260424-eykhdaex5v

Score

1^/10

persistence

Malware Config

Signatures

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5052	firefox.exe
Token: SeDebugPrivilege	5052	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe
5052	firefox.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 5052	4940	firefox.exe	79
PID 4940 wrote to memory of 5052	4940	firefox.exe	79
PID 5052 wrote to memory of 5576	5052	firefox.exe	80
PID 5052 wrote to memory of 5576	5052	firefox.exe	80
PID 5052 wrote to memory of 5576	5052	firefox.exe	80
PID 5052 wrote to memory of 660	5052	firefox.exe	81
PID 5052 wrote to memory of 660	5052	firefox.exe	81
PID 5052 wrote to memory of 660	5052	firefox.exe	81
PID 5052 wrote to memory of 660	5052	firefox.exe	81
PID 5052 wrote to memory of 4560	5052	firefox.exe	82
PID 5052 wrote to memory of 4560	5052	firefox.exe	82
PID 5052 wrote to memory of 4560	5052	firefox.exe	82
PID 5052 wrote to memory of 4560	5052	firefox.exe	82
PID 5052 wrote to memory of 5420	5052	firefox.exe	83
PID 5052 wrote to memory of 5420	5052	firefox.exe	83
PID 5052 wrote to memory of 5420	5052	firefox.exe	83
PID 5052 wrote to memory of 1788	5052	firefox.exe	84
PID 5052 wrote to memory of 1788	5052	firefox.exe	84
PID 5052 wrote to memory of 1788	5052	firefox.exe	84
PID 5052 wrote to memory of 1788	5052	firefox.exe	84
PID 5052 wrote to memory of 5640	5052	firefox.exe	85
PID 5052 wrote to memory of 5640	5052	firefox.exe	85
PID 5052 wrote to memory of 5640	5052	firefox.exe	85
PID 5052 wrote to memory of 5640	5052	firefox.exe	85
PID 5052 wrote to memory of 1012	5052	firefox.exe	86
PID 5052 wrote to memory of 1012	5052	firefox.exe	86
PID 5052 wrote to memory of 1012	5052	firefox.exe	86
PID 5052 wrote to memory of 1012	5052	firefox.exe	86
PID 5052 wrote to memory of 4740	5052	firefox.exe	87
PID 5052 wrote to memory of 4740	5052	firefox.exe	87
PID 5052 wrote to memory of 4740	5052	firefox.exe	87
PID 5052 wrote to memory of 4740	5052	firefox.exe	87
PID 5052 wrote to memory of 1872	5052	firefox.exe	88
PID 5052 wrote to memory of 1872	5052	firefox.exe	88
PID 5052 wrote to memory of 1872	5052	firefox.exe	88
PID 5052 wrote to memory of 1872	5052	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://paint.net"
1⤵
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://paint.net
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27097 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {961e2462-85a8-4b8c-96cf-129957611cc8} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27133 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {0133efce-a47f-40fd-8d35-0cf3b2e99b47} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3764 -prefsLen 25213 -prefMapHandle 3768 -prefMapSize 270279 -jsInitHandle 3772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3780 -initialChannelId {3c31b22c-3fbc-4afa-a5b0-e353539756d9} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3960 -prefsLen 27323 -prefMapHandle 3964 -prefMapSize 270279 -ipcHandle 4032 -initialChannelId {b2e59a19-a178-403a-84c3-90ed8695ebf3} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3020 -prefsLen 34822 -prefMapHandle 3084 -prefMapSize 270279 -jsInitHandle 2752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2672 -initialChannelId {762c7cb7-1553-4d9c-aedd-0eef982ac675} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5216 -prefsLen 35010 -prefMapHandle 5228 -prefMapSize 270279 -ipcHandle 2912 -initialChannelId {4a2a3901-ddee-44a7-ba54-ea7046990986} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5532 -prefsLen 32952 -prefMapHandle 5528 -prefMapSize 270279 -jsInitHandle 5524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5596 -initialChannelId {2932354b-aa59-4efb-8fff-115ae5c26166} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5740 -prefsLen 32952 -prefMapHandle 5744 -prefMapSize 270279 -jsInitHandle 5748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5680 -initialChannelId {d4c30c4c-7d44-4388-938c-d7d38f1f6c6c} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5924 -prefsLen 32952 -prefMapHandle 5928 -prefMapSize 270279 -jsInitHandle 5932 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5908 -initialChannelId {4a0df60b-c33a-4005-bc5e-fca8b144f046} -parentPid 5052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:1872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 b16bdb780d918dfe0345643e0dbad5c2e20c15cbf14a65cffb8a35bebdd297bc
MD5 e2b316707c40a967057c4cd5d0d61f2b
SHA1 af98236f6849e8026da67c8b0ed971af01f1aeea
SHA512 302a4af4310e72212230e815d01f86b54a92a3a0b362cfbfa1ffcc9ab22b29668ae1849ae22aeb4b1cdf68640eb5faea020b0c569639b105d37771463981d36e
SSDEEP 96:t7SdF95/7bkW6QXjrcE3hyUR6Jzx2WZiFN2FVF6F5Fd/dd66Joz0dzgClKtmc0dM:t7Ov5zboob3hyjfxo1d66Joz0dzgCl6o
TLSH
T15FC1EB24F6294A3BD809023BCDB61F500F35395A988E3F1932EC344D2D562EE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 100f4b25b3dce28a593f9ded87fd1d43d0df9122bdd7a82fe8bcc46cecbe4571
MD5 76fedf73b1d5e05df90593bbcdfb6a96
SHA1 e84dc03a9f8badb94585b07fb3ab56b09863d572
SHA512 61efa153dafb217c8bf3bb2956a01240b769feee40ff1628fc95cf60a057fa48c81e80411c64388de34ebbdcf72ef44d7c921847a19d05555ff5075d2a7522fb
SSDEEP 192:/1d66Joz0dzgCl6mc0de7Ov5zboHqZ3hyjH82:Nd66JozQzgC1jBboKZ3hyjl
TLSH
T156E12064EA28867BD408027BCDA61F410F35384A9C4E3F1936DC755C2D572EE3A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b6940d38d060f96c7f773ad7b6c20d2070dbfceb9f54aad13e5c40051952badc
MD5 36b8329c98f2c971d7a39dcf6bc79046
SHA1 b056f115293aed4bdd3f63e2decc766ca1ebcbd7
SHA512 566e21dd12f7ac0b8bb6d90e3629e864b612fbf69761d2416f076923a1c9b9edee37fe59aa2794b725ea1ce25a939d02a285add31277dfa8927ba58cea8c0bc4
TLSH
T15621259C39F88D6A98D7E29C7894028E93558A1716C72C430E13DE8ECDD6ED9326E43D
MD5 SHA1 SHA512 TLSH

Submit Download

084bf0b7-b54b-4ea5-ab61-0bf6ad3b0de2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\084bf0b7-b54b-4ea5-ab61-0bf6ad3b0de2
Size 886B
SHA256 068a7927c940584c110db7fedaf6f936bdbe8d91a8a7886858a8f1b10429a178
MD5 8276f4a1a72fd6eccbebc38873420177
SHA1 3f1500b24a679dd69ecc4ecfeb2d12f38a5968d3
SHA512 959ee454bc50c594c22fa6407d6834a321df6d37d1370bd3fb03bc94edfc88b2f56a4309193f01de2e8a17397fff7eb066f3e5aed4bef251cb978ab7ac489920
TLSH
T1A41104419538B9F28C68D38B89A07B5347D47513C0CA09043FA49E080EAE12EA76A717
MD5 SHA1 SHA512 TLSH

Submit Download

d0ffa290-df7f-4fb3-8603-912315eb24b4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\d0ffa290-df7f-4fb3-8603-912315eb24b4
Size 235B
SHA256 ed3d9c80d7d77e302523f7d6f092f4c6bd8ba2d3bbc723ea436b01733ecdf46b
MD5 a3e47f5347ae192093a56f47f9d31982
SHA1 c62f6a07f4811a02de62ffca6abd8b354c23ce91
SHA512 973e43c15e1f3b03650f52f6879521d535afe0bf483205515a1d52a9a4f5438a586e8683e46c235e67d6cad589dc26d0a74bd3fd9833ed813f25f0b5930bba82
TLSH
T1AAD0978024A8672D08200F07B4A028C270984C3318B4D960A9E142B4DABBEC8022181A
MD5 SHA1 SHA512 TLSH

Submit Download

d3643cb7-1c36-43ad-98bc-e46a65337f32

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\d3643cb7-1c36-43ad-98bc-e46a65337f32
Size 235B
SHA256 31743a3fb5596d7785318916c65492a8ddb1fb48c3a6a3334b281c9cc85a098d
MD5 909ea71f52884943c9656551fc57b581
SHA1 c0f3248134437501909716f360f60a908e866b8c
SHA512 8a8a5bd90c2a1f18cafde35cd21c1991b527966afa08b6fccb58bf64098ca56f4cda7c0879335b0792e09d7f175205670cbb6c72ca522b29bedaf57f0de55a6c
TLSH
T11FD097C068C86B9C08080F07F2E038C230448C3320A9A82087A284B48AFC9C86256A1B
MD5 SHA1 SHA512 TLSH

Submit Download

e90720e3-2da5-4bf8-ba72-9629badc2b39

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\e90720e3-2da5-4bf8-ba72-9629badc2b39
Size 2KB
SHA256 3c37972a5d37eec82baf071cf7308514bb20655f38878f2e2aa5d40d635aa33a
MD5 e53be7b0c0cb9abd16d914e61f34103d
SHA1 0e2e4ccc271e412ab186fc273b1044fc2323e6c3
SHA512 481ed696f85487d856c739b47ceea0c08f64562703c5c042e85fbcd7ed5ae22ff9e8ac3937ade9168c1915428a5c0a85aeef53ffaa3b417edddc644d464af94e
TLSH
T1D541712835785C7B8CDEF39D8881368E53A08A0300C61C832E51DF0C8D9A2EE776F52B
MD5 SHA1 SHA512 TLSH

Submit Download

f2626239-857c-4350-8598-8baec2057bfe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\f2626239-857c-4350-8598-8baec2057bfe
Size 883B
SHA256 960133a0d58e6fdc3c5e53e70bc15231b81eada60a0607a94a2f7d159607636a
MD5 242f40aa0dfadd58144f76521bea2d5d
SHA1 d236b2ed8dfe2e32fba96a42dbbaae6fa134067f
SHA512 34893bb9dd100a8fd339d4f89ce5157056418f5c0c994835ac3681ee9a26a6b683d1896d8dca85b76731dc943c6e64aaa8435702ff4bd2bd729044b75e93b381
TLSH
T17E1104409634B9F29D38C35B85A17B5257E47513C0C604143EF05E080E7E16EE35A317
MD5 SHA1 SHA512 TLSH

Submit Download

ffba5db7-7ccd-45e4-a976-67d632e1bd5d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\ffba5db7-7ccd-45e4-a976-67d632e1bd5d
Size 16KB
SHA256 0378a817e3f2078db228a57b8e26564fb25d41493d28d815c1d5a4509ad01f50
MD5 5981de3c5cb48d57ce47fdd5c3337de3
SHA1 e144ce9d21fe5d6577e24b18c7171516c77dcbe0
SHA512 9074f16bc503aa66abaef7a62864ae054f0f7100a84c88a538888e875b4de579674ca6589ef067f08062848a5ba6bf859b6fc8f4f77719df1eb1eda5454eb3f8
SSDEEP 192:vfO5a4HxFh1iLkJM2fmbU4tzxSiaEQWDjJBygNc1QeShdZC+X0X9FIaMzul91pLN:Xwa4HxFD4ugtlSiuWDjxR+3LAE
TLSH
T1EF72B856186049BA9251E36894FCBFC3E6F538CF4C418FCA9BE4BD4869DE06D112788B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
Size 6KB
SHA256 60b073f9293461782c264feeb587e49cdeefee92572fdbb1542cedf7916346e9
MD5 335a374f1f1f46e10c8be2f2528cb551
SHA1 313cab22604f6a6c40f83181af65101e7acdd790
SHA512 4c53bb1fd8bf7b2eb7bd39f9f2da0d60f2e3369868996f4b00a0c669472930303ef93b3811adac8feba5c2453bfe433638269ee78ece6122983d3d3e7bf974a7
SSDEEP 96:xHiUTUAPqGqcUfCKjKnjs1zSsfSSlrdv9j/nHHCriDYzMgBw88H8L4cnHVjZ:UwCRvfCNgBfSSpCaYzMgBw88qL
TLSH
T19BE12E3890088B7F74B6776C6C6888316AB2413BB7BF68C750B954C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads