7de2cea01011401058b4f54580befae1d07fb46bf0698b42328bb1cba2ef8dad

Analysis

user interaction
yes
max time kernel
300s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Korsakoff GUI.exe
Size 2.8MB
Sample261104-xp378stygv
SHA256 7de2cea01011401058b4f54580befae1d07fb46bf0698b42328bb1cba2ef8dad
MD5 a4e2e16dfa42f160cc55892aaa68287e
SHA1 e58480d4c09e7b652b3bde2639a1382cbf4d9146
SHA512 d8d40841140fa617d7188288a6067aeb44e49397b8153dad1889e1ae52a27edae2233b5c3e7c80331f7336d4c21d7c6448fa12c2964c6d3bb2bc91022fed6a6a
SSDEEP 49152:TG23OcQc2f7Qh4g1RAtgtMR4X1N+S+wt0K2bnUUm3PcYf6GQwXo42G23OcQcrGwH:TG2+c12DQhPRAcu4+SVeGHv6+Xo42G27
TLSH
T1F2D51242BF408AD2C4148A7CD85B93252771BD97DA83834B2298BBAF78B36D0754F7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1"	Korsakoff GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	Korsakoff GUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Korsakoff GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e80d43aad2469a5304598e1ab02f9417aa80000	Korsakoff GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000657c56fcfe41dd01e1b2342b0b42dd01e1b2342b0b42dd0114000000	Korsakoff GUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Korsakoff GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Korsakoff GUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Korsakoff GUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Korsakoff GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Korsakoff GUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	Korsakoff GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	Korsakoff GUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Korsakoff GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Korsakoff GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	Korsakoff GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Korsakoff GUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	PaintStudio.View.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	Korsakoff GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Korsakoff GUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Korsakoff GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Korsakoff GUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	Korsakoff GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Korsakoff GUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	Korsakoff GUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Korsakoff GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Korsakoff GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Korsakoff GUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	Korsakoff GUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Korsakoff GUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheVersion = "1"	PaintStudio.View.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Korsakoff GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Korsakoff GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Korsakoff GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Korsakoff GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Korsakoff GUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Korsakoff GUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Korsakoff GUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Korsakoff GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Korsakoff GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Korsakoff GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Korsakoff GUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Korsakoff GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Korsakoff GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Korsakoff GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	Korsakoff GUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "3"	Korsakoff GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	Korsakoff GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Korsakoff GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\MuiCache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Korsakoff GUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	Korsakoff GUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Korsakoff GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Korsakoff GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	Korsakoff GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Korsakoff GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Korsakoff GUI.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	Korsakoff GUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Korsakoff GUI.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3248	PaintStudio.View.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
888	mspaint.exe
888	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4100	Korsakoff GUI.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3248	PaintStudio.View.exe
Token: SeDebugPrivilege	3248	PaintStudio.View.exe
Token: SeDebugPrivilege	3248	PaintStudio.View.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
4100	Korsakoff GUI.exe
888	mspaint.exe
3248	PaintStudio.View.exe

C:\Users\Admin\AppData\Local\Temp\Korsakoff GUI.exe
"C:\Users\Admin\AppData\Local\Temp\Korsakoff GUI.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4100

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\cqrd.jpeg" /ForceBootstrapPaint3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:4748

C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Projects.json.~tmp

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json.~tmp
Size 243B
SHA256 16fed739db5a9767f524f3fc588499ef9e1d03ce6bf4d3d10db196b52fd22809
MD5 e953ad411c2bb5095f546898e4ba238b
SHA1 1bb4e9b47c34d1c041bcef38a958ff6e1a2f75ec
SHA512 eedb0432c11f1ccd40e2a56a6d17fa248d0949bcc201b9a42e8c32582af746507551f41a58ac4d4f737071f838e8ed0af6161ef494e91bd02c67315536bb24b2
TLSH
T1E2D0A76E94886E1E99914356495C8843A99C97B4B6154918E48BAD58EB620D941E3820
MD5 SHA1 SHA512 TLSH

Submit Download

Projects.json.~tmp

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json.~tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Projects.json.~tmp

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json.~tmp
Size 238B
SHA256 c66eb466f193071d1d64df6548312efeaf081933a06af6c25f1017fe03642959
MD5 5fc4898100c1ccc89ab235e635fa7f28
SHA1 e00bd03ae95292af58a15a5b7208298180b4080a
SHA512 c4c76ecff4e8b5d56a16a8466162eab12b0fd3ac8e70f5fa3135502875d38fc8f9ac280f7319a56fd7f40626de6d0de089b5117d6d5e4cda72f9e5821172adb1
TLSH
T1B3D0A71E60845E6EA58403545E588D4666F81775B6510C18EC4BAC5866A345C13E6876
MD5 SHA1 SHA512 TLSH

Submit Download

Canvas_4.bin

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\WorkingFolder\Canvas_4.bin
Size 387B
SHA256 04879008e8e65a1f5509f8fe750e782af4bf43282b786e5ee2bddd27b38ae6cc
MD5 6c7671db64dd3ab15898de495b3356d1
SHA1 e17461d4d7678730a97bb34b8495c2a48afb54a4
SHA512 4f2b064db0829f3376be0b5382bd0d6cdd4023e10cfcac0df5efdcad4b66f0815dc91f0cd7b8a2c0c1ea2774fa6f24218f9f520cb9a0791077cf74195b0fb9c3
TLSH
T1EEE09BD2BF44D425C9BB5E3E41B241629439DC47114365C57F1140255D55F085646795
MD5 SHA1 SHA512 TLSH

Submit Download

cloudCommunitySettings.json.~tmp

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json.~tmp
Size 2KB
SHA256 52bfb22aa2d7b0ce083d312fb8fa8dcda3063207186f99fc259aebd9064cbedc
MD5 f4e4a03ebd0ab3a953c56a300d61d223
SHA1 97a9acf22c3bdd6989d7c120c21077c4d5a9a80e
SHA512 12aa71eea45720a4d7d057da0b662635671e4cd165ad2e0d30a3d2a43950b47dd60c26c1bbbe049418f815850e571b8d93e4c8b8cbbd686abc3cf7926ba719c2
TLSH
T12F519CEB0003BD5826FF95057133F52FF48FE096548856DB98C1E8BFE6A9064B29A028
MD5 SHA1 SHA512 TLSH

Submit Download

cqrd.jpeg

Path C:\Users\Admin\Desktop\cqrd.jpeg
Size 25KB
SHA256 76a4228219817a9208e6796622492e3feae64b40142a146807bec2710bcba96e
MD5 61444753280b0c39bbf045684e323180
SHA1 4a9f66536d0246aeed04a17e1c6792514345937f
SHA512 fba6a036bf5546bb10510e36329e81b38c9df3be572dd4a84b2b50957e522a09b973a9695a21e18989657364932a374970f6831b3c580641ef526a606ee49262
SSDEEP 384:yPwDG9nsLNoNQgqKRBRx95w5J/Hru8lhN5gC1s9ktk1gNRtI:yoiUoN/jeJ/HrrlTJs9kWiI
TLSH
T180C2F18FE8910CD17F2FAA51D4518D5B78CAAD61F995632176BC203CE338F3819EC1A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DSS.log

Path C:\Windows\System32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log
Size 64KB
SHA256 9826c217881098285a5e3e7e918eed82a848aeec48598e155bc05a9cdf79f62c
MD5 5d9751849ef6ee7595462060e658ad30
SHA1 12724faecf67f52e2393ed63cc4c498ae6aa3052
SHA512 ba8808940ab45fa7d1ecc8cb3a283945c05378b2a4ac595236df10db8111276dfd09c23555fa29bb3f6637abbb074b092345723bc9056adb2b8f7ce58bdbe981
SSDEEP 6:d1Mo6D/5NhYDhP5c23qC59hYDhP5c23qC5FotUilO+B:dKo2BN6Ph6CX6Ph6CwVlOW
TLSH
T1F9535E4392670AF2CC35CC799E4B6720873AF405319843A14089E099DEC121B3FB1CF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4100-20-0x00007FFFF6DD5000-0x00007FFFF6DD6000-memory.dmp

Download

memory/4100-26-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4100-9-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4100-10-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4100-11-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4100-12-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4100-13-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4100-14-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4100-15-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4100-16-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4100-17-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4100-18-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4100-19-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4100-0-0x00007FFFF6DD5000-0x00007FFFF6DD6000-memory.dmp

Download

memory/4100-21-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4100-22-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4100-23-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4100-8-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4100-2-0x000000001C5C0000-0x000000001CA8E000-memory.dmp

Download

memory/4100-3-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4100-7-0x00000000018E0000-0x00000000018E8000-memory.dmp

Download

memory/4100-1-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4100-4-0x000000001C000000-0x000000001C09C000-memory.dmp

Download

memory/4100-5-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4100-6-0x00007FFFF6B20000-0x00007FFFF74C1000-memory.dmp

Download

memory/4748-45-0x0000022819AE0000-0x0000022819AE1000-memory.dmp

Download

memory/4748-46-0x0000022819AF0000-0x0000022819AF1000-memory.dmp

Download

memory/4748-49-0x0000022819AF0000-0x0000022819AF1000-memory.dmp

Download

memory/4748-44-0x0000022819AE0000-0x0000022819AE1000-memory.dmp

Download

memory/4748-43-0x0000022819A50000-0x0000022819A51000-memory.dmp

Download

memory/4748-41-0x0000022819A50000-0x0000022819A51000-memory.dmp

Download

memory/4748-39-0x00000228199D0000-0x00000228199D1000-memory.dmp

Download

memory/4748-27-0x0000022808D40000-0x0000022808D50000-memory.dmp

Download

memory/4748-31-0x0000022808D80000-0x0000022808D90000-memory.dmp

Download