General
- Target Clip Studio Paint EX 5.0.2 (x64) onhaxpk.net.zip
- Size 679.5MB
- Sample260628-ekk7rae17v
- SHA256 386e6b01c533edbee6be7366a9e65d08ed7bc348773384dab9c2931e93f4d736
Score
8/10
Malware Config
Targets
-
- Target Clip Studio Paint EX 5.0.2 (x64) onhaxpk.net.zip
- Size 679.5MB
- SHA256 386e6b01c533edbee6be7366a9e65d08ed7bc348773384dab9c2931e93f4d736
Score1/10 -
- Target CSP_502w_setup.exe
- Size 463.9MB
- SHA256 037e5ffbd8f21af13f774bfb3bd8d736ce6d0b7f750b0f99fb1d5815f3853865
Score5/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target Patch1.zip
- Size 33.1MB
- SHA256 4d53c27694f26be43b267a595589ebdf3e6ebfcb9f966d23eb896be015651cec
Score1/10 -
- Target Patch1/CLIPStudioPaint.exe
- Size 88.5MB
- SHA256 6fb51a3ff24b15ec3c084a3cc5281c43db3d5e617091cb1d60e717f492935319
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target readme.txt
- Size 81B
- SHA256 9747274b713f69443b0fd645ec89f5da33d6e506212d5d37cc85c441a3935d6f
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1