General
- Target Microsoft.MSPaint_2024.2405.19017.0_neutral_~_8wekyb3d8bbwe.AppxBundle
- Size 64.5MB
- Sample260715-dhhheads9w
- SHA256 2366b602630b6a02882b4ad0d65138952ab9fdc878e188f65329d931f0c1bfe4
Malware Config
Targets
-
- Target AppxMetadata/Stub/Paint3DStub_1.0.74.0_ARM.appx
- Size 729KB
- SHA256 0b9c9178122f61e29864899309e12c9a3b99fdb68ea0f6b29218b734e376e694
Score1/10 -
- Target Microsoft.Apps.Stubs.dll
- Size 388KB
- SHA256 cf1797ce403ee78e626976e89efe248567381751fbff863b92d6ab5cf05cc2df
Score1/10 -
- Target Microsoft.Apps.Stubs.winmd
- Size 7KB
- SHA256 c8d661a19e35d0b319a4e60f5b7194173101c186d0e38b9a5b632bf24e146d08
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Paint3DStub.winmd
- Size 3KB
- SHA256 80625227637f7161a50a606e4aaf44f732571c83a389754092fd3465502b42e5
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target PaintStudio.View.exe
- Size 274KB
- SHA256 cfab11efcb197b6c6927f10018bca9f7cd122671cbc4a2ebf1b76669f25948fe
Score1/10 -
- Target AppxMetadata/Stub/Paint3DStub_1.0.74.0_Win32.appx
- Size 720KB
- SHA256 05b86383c76679034b9783b8891bef24c85e566b026ee21f8a09d6e5a35eec99
Score1/10 -
- Target Microsoft.Apps.Stubs.dll
- Size 385KB
- SHA256 135e714e54ada199e4158450787e37297636f553600570f08b0ac1f878f0b097
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.Apps.Stubs.winmd
- Size 7KB
- SHA256 c8d661a19e35d0b319a4e60f5b7194173101c186d0e38b9a5b632bf24e146d08
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Paint3DStub.winmd
- Size 3KB
- SHA256 1458b62f108deab8e9cff02876a6c27889123269f70adb1b10f7b3cf9bd16a4c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target PaintStudio.View.exe
- Size 287KB
- SHA256 df8a694943fc07c9fc7dd0c8e0158a2226b6d6cb0cf0801474dfd482896138c0
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target AppxMetadata/Stub/Paint3DStub_1.0.74.0_x64.appx
- Size 723KB
- SHA256 9f8a37c74e47402622b0ebf39883e7fcfcf8c99e5f24f50faca7611bf92fed0d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.Apps.Stubs.dll
- Size 401KB
- SHA256 a3730395dbcb86d4abf71953827d3f1254eb5938bc99ae102b71b4e2ba713b4e
Score1/10 -
- Target Microsoft.Apps.Stubs.winmd
- Size 7KB
- SHA256 c8d661a19e35d0b319a4e60f5b7194173101c186d0e38b9a5b632bf24e146d08
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Paint3DStub.winmd
- Size 3KB
- SHA256 bb9181f73dea689a4b70bb0ef0de789b817838bc6d4e404c964fa0685a8fdb08
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target PaintStudio.View.exe
- Size 288KB
- SHA256 d2e3336220307ba13c8d185968071eecd0c45f6c10f863b9aeadac1e6cd4c443
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target PaintStudio.View_6.2405.19017.0_ARM.appx
- Size 21.0MB
- SHA256 487c4f77cc0ba58fea4ac8096b71da9feedf8a986aad4a5929aef38d97c06463
Score1/10