Windows Analysis Report
papercut-hive.exe

Overview

General Information

Sample name: papercut-hive.exe
Analysis ID: 1542234
MD5: 7253bd3220cd819a8c822ebcfbd03ded
SHA1: 6fd8e9384b4a7f1239505c7dcd034be810979ab7
SHA256: dc9a1d2826175fd74c92ad9f842eddc80c9ff593770dbbf7ed4f2d9690f2e70c
Infos:

Detection

Score: 26
Range: 0 - 100
Whitelisted: false
Confidence: 20%

Signatures

Sigma detected: rundll32 run dll from internet
Uses netstat to query active network connections and open ports
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Creates a process in suspended mode (likely to inject code)
Creates files inside the driver directory
Creates files inside the system directory
Deletes files inside the Windows folder
Drops PE files
Drops certificate files (DER)
Enables debug privileges
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
JA3 SSL client fingerprint seen in connection with other malware
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Uses 32bit PE files
Source: papercut-hive.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp File created: C:\Users\user\AppData\Local\Temp\Setup Log 2024-10-25 #001.txt Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe File created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\queue_install.log Jump to behavior
Source: papercut-hive.exe Static PE information: certificate valid
Source: unknown HTTPS traffic detected: 104.119.110.121:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.210.172:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.222.214.120:443 -> 192.168.2.5:56558 version: TLS 1.2
Source: papercut-hive.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\agent\_work\36\s\wix\build\ship\x86\burn.pdb source: vcredist_x64.exe.2.dr
Source: Binary string: C:\agent\_work\36\s\wix\build\ship\x86\burn.pdb4 source: vcredist_x64.exe.2.dr

Networking
barindex
Uses netstat to query active network connections and open ports
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\NETSTAT.EXE "netstat" -anb
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.119.110.121 104.119.110.121
Source: Joe Sandbox View IP Address: 199.232.210.172 199.232.210.172
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /vs/17/release/vc_redist.x64.exe HTTP/1.1Accept: */*User-Agent: InnoDownloadPlugin/1.5Host: aka.msConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /download/pr/368cc6bf-087b-49f9-93e6-ab05b70a58e0/814E9DA5EC5E5D6A8FA701999D1FC3BADDF7F3ADC528E202590E9B1CB73E4A11/VC_redist.x64.exe HTTP/1.1Accept: */*User-Agent: InnoDownloadPlugin/1.5Connection: Keep-AliveCache-Control: no-cacheHost: download.visualstudio.microsoft.com
Source: global traffic HTTP traffic detected: GET /files/open-source/ghost-trap/ghost-trap-installer-1.5.10.03.exe HTTP/1.1Accept: */*User-Agent: InnoDownloadPlugin/1.5Host: cdn1.papercut.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic DNS traffic detected: DNS query: aka.ms
Source: global traffic DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa
Source: global traffic DNS traffic detected: DNS query: 197.87.175.4.in-addr.arpa
Source: global traffic DNS traffic detected: DNS query: cdn1.papercut.com
Source: global traffic DNS traffic detected: DNS query: pmitc.papercut.com
Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://127.0.0.1:9263image:
Source: vcredist_x64.exe.2.dr String found in binary or memory: http://appsyndication.org/2006/appsynapplicationc:
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://bourbon.io
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crt0
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0N
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: pc-print-client.exe.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: pc-print-client.exe, 00000012.00000002.2631688601.000000C000020000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://localhostus-genesisstaginggngkernel32.dllC:
Source: pc-print-client.exe.2.dr String found in binary or memory: http://ocsp.digicert.com0
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://ocsp.digicert.com0W
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://www.bohemiancoding.com/sketch
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: papercut-hive.exe, 00000000.00000003.2707442358.0000000001836000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.00000000030B6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.papercut.com/
Source: papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.papercut.com/0http://www.papercut.com/0http://www.papercut.com/
Source: papercut-hive.tmp, 00000002.00000003.2702866559.00000000030B6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.papercut.com/Yk
Source: pc-print-client.exe, 00000012.00000002.2631688601.000000C000022000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://.papercusoftwarehttp://lus-genestesttstau-stagitemplate
Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: https://127.0.0.1:9266idna:
Source: papercut-hive.tmp, 00000002.00000003.2704291741.0000000001590000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/
Source: papercut-hive.tmp, 00000002.00000003.2704291741.0000000001590000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/YoS(&
Source: papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2707442358.00000000017E3000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2704291741.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003007000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702370361.0000000004230000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2704291741.0000000001590000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x64.exe
Source: papercut-hive.tmp, 00000002.00000002.2705901345.0000000001595000.00000004.00000020.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2704291741.0000000001590000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x64.exe4
Source: papercut-hive.tmp, 00000002.00000003.2698392651.0000000004015000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x64.exe==
Source: papercut-hive.tmp, 00000002.00000002.2705901345.0000000001595000.00000004.00000020.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2704291741.0000000001590000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x64.exeH
Source: papercut-hive.tmp, 00000002.00000003.2698392651.0000000004015000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x64.exet))
Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: https://au-staging.pmitc.papercut.softwareinsufficient
Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: https://au.pmitc.papercut.comhttps://eu.pmitc.papercut.comhttps://uk.pmitc.papercut.cominteger
Source: papercut-hive.tmp, 00000002.00000002.2706959213.0000000006650000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn1.papercut.com/
Source: papercut-hive.tmp, 00000002.00000003.2704291741.00000000015C8000.00000004.00000020.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702370361.0000000004230000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698392651.0000000004015000.00000004.00000020.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://cdn1.papercut.com/files/open-source/ghost-trap/ghost-trap-installer-1.5.10.03.exe
Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: https://fonts.googleapis.com
Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: https://fonts.googleapis.com/css2?family=Barlow:ital
Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: https://fonts.gstatic.com
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: https://fonts.gstatic.com/s/barlow/v12/7cHpv4kjgoGqM7E_DMs8.ttf)
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E30-8s51op.ttf)
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3j-ws51op.ttf)
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v30/u-440qyriQwlOrhSvowK_l5-fCZJ.ttf)
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v30/u-4n0qyriQwlOrhSvowK_l52xwNZWMf_.ttf)
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v22/HI_diYsKILxRpg3hIP6sJ7fM7PqPMcMnZFqUwX28DMyQtMlrSQ.ttf
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v21/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDc.ttf)
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7g.ttf)
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v21/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZY4lCds18E.ttf)
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v21/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdr.ttf)
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v21/6xKydSBYKcSV-LCoeQqfX1RYOo3i94_wlxdr.ttf)
Source: papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2707442358.00000000017E3000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003007000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702370361.000000000428D000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000002FEA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/PaperCutSoftware/GhostTrap
Source: papercut-hive.tmp, 00000002.00000003.2702866559.0000000002FEA000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/PaperCutSoftware/GhostTrapn;
Source: papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2707442358.00000000017E3000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003007000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702370361.000000000423A000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://installer-downloader-dot-pc-pmitc.appspot.com/public/installer-downloader/upload-installer-l
Source: papercut-hive.exe String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: pc-print-client.exe, 00000012.00000002.2631688601.000000C0000FF000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2631688601.000000C0000CC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://multiverse.papercut.com
Source: pc-print-client.exe, 00000012.00000002.2631688601.000000C0000FF000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2631688601.000000C0000CC000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://multiverse.papercut.software
Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: https://pc-pmitc.appspot.com//print-client/secure/printclient-gateway/org/%s/upload-support-logs/v1c
Source: pc-print-client.exe, 00000012.00000002.2631688601.000000C000022000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://pmitc.papercut.com/
Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr String found in binary or memory: https://protobuf.dev/reference/go/faq#namespace-conflictin
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F0DB000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000000.2094710725.0000000000B01000.00000020.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.innosetup.com/
Source: papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2707442358.00000000017E3000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003007000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702370361.000000000429C000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.papercut.com/kb/PaperCutPocketHive/PrinterInstallerIssue#portconflict
Source: papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2707442358.00000000017E3000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003007000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003064000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.papercut.com/kb/PaperCutPocketHive/PrinterInstallerIssue#services
Source: papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2707442358.00000000017E3000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003007000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003064000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.papercut.com/kb/PaperCutPocketHive/PrinterInstallerIssue#win
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F0DB000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000000.2094710725.0000000000B01000.00000020.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.remobjects.com/ps
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56617
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56558
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56558 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56617 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown HTTPS traffic detected: 104.119.110.121:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.210.172:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.222.214.120:443 -> 192.168.2.5:56558 version: TLS 1.2
Installs a raw input device (often for capturing keystrokes)
Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Server 2008 R2 Server 2012 R2 is unavailable not a function()<>@,;:\"/[]?=(Get-Resources),M3.2.0,M11.1.0/manual-link/v10601021504Z0700400 Bad Request476837158203125: cannot parse : no frame (sp=<invalid Value>ASCII_Hex_DigitAccept-EncodingAccept-LanguageAcknowledge-JobAddDllDirectoryCLSIDFromStringCallWindowProcWCancel-DocumentCardinality(%d)ClientAuthType(ContainingOneofCreateHardLinkWCreatePopupMenuCreateWindowExWDelete-DocumentDeviceIoControlDiacriticalDot;DialogBoxParamWDisable-PrinterDoubleRightTee;DownLeftVector;DragAcceptFilesDrawThemeTextExDuplicateHandleExcludeClipRectExtensionRangesFailed to find Failed to load FindNextVolumeWFindVolumeCloseFlushViewOfFileGateway TimeoutGdiplusShutdownGetActiveWindowGetAdaptersInfoGetCommTimeoutsGetCommandLineWGetDpiForWindowGetEnhMetaFileWGetModuleHandleGetMonitorInfoWGetProcessTimesGetRawInputDataGetSecurityInfoGetStartupInfoWGetTextMetricsWGetThreadLocaleGreaterGreater;HalfClosedLocalHanifi_RohingyaHorizontalLine;Idempotency-KeyImpersonateSelfInsertMenuItemWInvisibleComma;InvisibleTimes;IsWindowEnabledIsWindowUnicodeIsWindowVisibleIsWow64Process2LeftDownVector;LeftRightArrow;Leftrightarrow;Length RequiredLessSlantEqual;LongRightArrow;Longrightarrow;LowerLeftArrow;MoveToEx failedNTSTATUS 0x%08xNestedLessLess;Not ImplementedNotGreaterLess;NotLessGreater;NotSubsetEqual;NotTrueTypeFontNotVerticalBar;OleUninitializeOpEnablePrinterOpFetchDocumentOpResumePrinterOpenCurlyQuote;OpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512PaperCut PocketPartial ContentPlayEnhMetaFilePolyline failedPostQuitMessageProcess32FirstWProfileNotFoundPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRegisterClassExRequest TimeoutRequiredNumbersRestart-PrinterReverseElement;RightTeeVector;RightVectorBar;RtlDefaultNpAclSetActiveWindowSetCommTimeoutsSetSecurityInfoSetVolumeLabelWSetWinEventHookShortDownArrow;ShortLeftArrow;SquareSuperset;Startup-PrinterStatusErrorBusyStatusErrorGoneStringFromGUID2TildeFullEqual;TrackMouseEventTrigger backoffUnknown name=%qUnmapViewOfFileUpperLeftArrow;WTSConnectQueryWTSDisconnectedWindowFromPointX-Forwarded-ForX-Frame-OptionsZeroWidthSpace;] memstr_f5122bf8-8
Drops certificate files (DER)
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp File created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\pcglobal.cat Jump to dropped file
Source: C:\Windows\System32\drvinst.exe File created: C:\Windows\System32\DriverStore\Temp\{db7c9079-64f3-cb4a-9c36-b79a3d2cd1fb}\pcglobal.cat (copy) Jump to dropped file
Source: C:\Windows\System32\drvinst.exe File created: C:\Windows\System32\DriverStore\Temp\{db7c9079-64f3-cb4a-9c36-b79a3d2cd1fb}\SETF9EB.tmp Jump to dropped file
Creates files inside the driver directory
Source: C:\Windows\System32\drvinst.exe File created: C:\Windows\System32\DriverStore\Temp\{db7c9079-64f3-cb4a-9c36-b79a3d2cd1fb} Jump to behavior
Creates files inside the system directory
Source: C:\Windows\System32\drvinst.exe File created: C:\Windows\System32\DriverStore\FileRepository\pcglobal.inf_amd64_c520b12f50e0cc2f Jump to behavior
Source: C:\Windows\System32\drvinst.exe File created: C:\Windows\System32\DriverStore\drvstore.tmp Jump to behavior
Source: C:\Windows\System32\drvinst.exe File created: C:\Windows\inf\oem4.inf Jump to behavior
Source: C:\Windows\System32\PrintIsolationHost.exe File created: C:\Windows\system32\spool\DRIVERS\x64\3\pcntns.BPD Jump to behavior
Deletes files inside the Windows folder
Source: C:\Windows\System32\drvinst.exe File deleted: C:\Windows\System32\DriverStore\Temp\{db7c9079-64f3-cb4a-9c36-b79a3d2cd1fb}\SETF9DB.tmp Jump to behavior
PE file contains executable resources (Code or Archives)
Source: papercut-hive.tmp.0.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
PE file contains more sections than normal
Source: papercut-hive.tmp.0.dr Static PE information: Number of sections : 11 > 10
Source: papercut-hive.exe Static PE information: Number of sections : 11 > 10
Source: ghost-trap-installer-1.5.10.03.exe.2.dr Static PE information: Number of sections : 11 > 10
Sample file is different than original file name gathered from version info
Source: papercut-hive.exe, 00000000.00000000.2090959358.0000000000589000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFileName vs papercut-hive.exe
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFileName vs papercut-hive.exe
Source: papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFileName vs papercut-hive.exe
Source: papercut-hive.exe Binary or memory string: OriginalFileName vs papercut-hive.exe
Uses 32bit PE files
Source: papercut-hive.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: sus26.troj.evad.winEXE@36/40@5/5
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4204:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1048:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:528:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6776:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6544:120:WilError_03
Source: C:\Users\user\Desktop\papercut-hive.exe File created: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe File opened: C:\Windows\system32\510ddcc02339e45e163cfab24ac57aa1131fc43941a0fcdf5aeac7654ae0ddfcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Jump to behavior
Source: C:\Users\user\Desktop\papercut-hive.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\papercut-hive.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Windows\System32\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;pc-print-client-service.exe&quot;)
Source: C:\Windows\System32\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;pc-print-client.exe&quot;)
Source: C:\Users\user\Desktop\papercut-hive.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /ia /m "PaperCut Global PostScript - NTNS" /f C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\PCGlobal.inf /u
Source: taskkill.exe, 0000000D.00000002.2553023259.0000020158625000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "pc-print-client.exe");
Source: papercut-hive.exe String found in binary or memory: /LOADINF="filename"
Source: C:\Users\user\Desktop\papercut-hive.exe File read: C:\Users\user\Desktop\papercut-hive.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\papercut-hive.exe "C:\Users\user\Desktop\papercut-hive.exe"
Source: C:\Users\user\Desktop\papercut-hive.exe Process created: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp "C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp" /SL5="$1047A,31229352,845824,C:\Users\user\Desktop\papercut-hive.exe"
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""netstat" -anb > "C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\~execwithresult.txt""
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\NETSTAT.EXE "netstat" -anb
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get * /value > "C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\antivirus-info.log" 2>&1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get * /value
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process created: C:\Windows\System32\taskkill.exe "taskkill.exe" /f /im "pc-print-client-service.exe"
Source: C:\Windows\System32\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process created: C:\Windows\System32\taskkill.exe "taskkill.exe" /f /im "pc-print-client.exe"
Source: C:\Windows\System32\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process created: C:\Windows\System32\net.exe "net.exe" start spooler
Source: C:\Windows\System32\net.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\net.exe Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start spooler
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe "C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe" -installPrintQueue -printerId="PaperCut Printer" -printerName="PaperCut Printer" "-driverFilePath=C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\PCGlobal.inf" -logFile="C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\queue_install.log"
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /ia /m "PaperCut Global PostScript - NTNS" /f C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\PCGlobal.inf /u
Source: unknown Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{4744f51b-c3b4-8c45-9965-84928136fda2}\pcglobal.inf" "9" "48fde5adf" "000000000000015C" "WinSta0\Default" "0000000000000144" "208" "c:\users\user\appdata\local\temp\is-b2r1d.tmp\client\pc-global-print-driver"
Source: unknown Process created: C:\Windows\System32\PrintIsolationHost.exe C:\Windows\system32\PrintIsolationHost.exe -Embedding
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /y /if /b "PaperCut Printer" /x /n "PaperCut Printer" /m "PaperCut Global PostScript - NTNS" /r http://localhost:9265/printers/papercutpocket /u /q
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /q /y /n "PaperCut Printer"
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /q /Sr /n "PaperCut Printer" /a C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\printer-settings.bin p h i r g u d c 2
Source: C:\Users\user\Desktop\papercut-hive.exe Process created: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp "C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp" /SL5="$1047A,31229352,845824,C:\Users\user\Desktop\papercut-hive.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""netstat" -anb > "C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\~execwithresult.txt"" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get * /value > "C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\antivirus-info.log" 2>&1 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process created: C:\Windows\System32\taskkill.exe "taskkill.exe" /f /im "pc-print-client-service.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process created: C:\Windows\System32\taskkill.exe "taskkill.exe" /f /im "pc-print-client.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process created: C:\Windows\System32\net.exe "net.exe" start spooler Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe "C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe" -installPrintQueue -printerId="PaperCut Printer" -printerName="PaperCut Printer" "-driverFilePath=C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\PCGlobal.inf" -logFile="C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\queue_install.log" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\NETSTAT.EXE "netstat" -anb Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get * /value Jump to behavior
Source: C:\Windows\System32\net.exe Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start spooler Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /ia /m "PaperCut Global PostScript - NTNS" /f C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\PCGlobal.inf /u Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /y /if /b "PaperCut Printer" /x /n "PaperCut Printer" /m "PaperCut Global PostScript - NTNS" /r http://localhost:9265/printers/papercutpocket /u /q Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /q /y /n "PaperCut Printer" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /q /Sr /n "PaperCut Printer" /a C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\printer-settings.bin p h i r g u d c 2 Jump to behavior
Source: C:\Users\user\Desktop\papercut-hive.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\papercut-hive.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: msftedit.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: windows.globalization.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: bcp47mrm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: globinputhost.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: windows.ui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: windowmanagementapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: inputhost.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Section loaded: explorerframe.dll Jump to behavior
Source: C:\Windows\System32\NETSTAT.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\NETSTAT.EXE Section loaded: snmpapi.dll Jump to behavior
Source: C:\Windows\System32\NETSTAT.EXE Section loaded: inetmib1.dll Jump to behavior
Source: C:\Windows\System32\NETSTAT.EXE Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: msxml6.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\taskkill.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\net.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\net.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\net.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\net.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\System32\net.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\net.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\net1.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\System32\net1.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\net1.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Windows\System32\net1.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\net1.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\net1.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\System32\net1.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\drvinst.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\drvinst.exe Section loaded: devrtl.dll Jump to behavior
Source: C:\Windows\System32\drvinst.exe Section loaded: drvstore.dll Jump to behavior
Source: C:\Windows\System32\drvinst.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\drvinst.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\drvinst.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\drvinst.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\drvinst.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\drvinst.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\PrintIsolationHost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\PrintIsolationHost.exe Section loaded: printisolationproxy.dll Jump to behavior
Source: C:\Windows\System32\PrintIsolationHost.exe Section loaded: spoolss.dll Jump to behavior
Source: C:\Windows\System32\PrintIsolationHost.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\PrintIsolationHost.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Windows\System32\PrintIsolationHost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\PrintIsolationHost.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Window found: window name: TMainForm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: papercut-hive.exe Static PE information: certificate valid
Source: papercut-hive.exe Static file information: File size 32219600 > 1048576
Source: papercut-hive.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\agent\_work\36\s\wix\build\ship\x86\burn.pdb source: vcredist_x64.exe.2.dr
Source: Binary string: C:\agent\_work\36\s\wix\build\ship\x86\burn.pdb4 source: vcredist_x64.exe.2.dr
PE file contains sections with non-standard names
Source: papercut-hive.exe Static PE information: section name: .didata
Source: papercut-hive.tmp.0.dr Static PE information: section name: .didata
Source: vcredist_x64.exe.2.dr Static PE information: section name: .wixburn
Source: ghost-trap-installer-1.5.10.03.exe.2.dr Static PE information: section name: .didata
Source: pc-print-client.exe.2.dr Static PE information: section name: .symtab
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Code function: 2_3_01580459 push es; iretd 2_3_01580474
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Code function: 2_3_0157C451 push es; iretd 2_3_0157C46C
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Code function: 2_3_01580455 push es; ret 2_3_01580458
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Code function: 2_3_0157C44D push es; ret 2_3_0157C450
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Code function: 2_3_01580505 push es; ret 2_3_01580508
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Code function: 2_3_0157C4FD push es; ret 2_3_0157C500
Drops PE files
Source: C:\Users\user\Desktop\papercut-hive.exe File created: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp File created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\ghost-trap-installer-1.5.10.03.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp File created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\vcredist_x64.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp File created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp File created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp File created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\idp.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp File created: C:\Users\user\AppData\Local\Temp\Setup Log 2024-10-25 #001.txt Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe File created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\queue_install.log Jump to behavior
Source: C:\Users\user\Desktop\papercut-hive.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\PrintIsolationHost.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\ghost-trap-installer-1.5.10.03.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\vcredist_x64.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\idp.dll Jump to dropped file
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: papercut-hive.tmp, 00000002.00000003.2704291741.00000000015D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW9
Source: NETSTAT.EXE, 00000005.00000002.2099596498.000002242FBD9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll%
Source: papercut-hive.tmp, papercut-hive.tmp, 00000002.00000003.2704291741.00000000015D0000.00000004.00000020.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2704291741.0000000001590000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: pc-print-client.exe, 00000012.00000002.2644780329.0000016A8896C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\System32\wbem\WMIC.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Windows\System32\NETSTAT.EXE Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\NETSTAT.EXE Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\taskkill.exe Process token adjusted: Debug Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\NETSTAT.EXE "netstat" -anb Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get * /value Jump to behavior
Source: C:\Windows\System32\net.exe Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start spooler Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /ia /m "PaperCut Global PostScript - NTNS" /f C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\PCGlobal.inf /u Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /y /if /b "PaperCut Printer" /x /n "PaperCut Printer" /m "PaperCut Global PostScript - NTNS" /r http://localhost:9265/printers/papercutpocket /u /q Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /q /y /n "PaperCut Printer" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /q /Sr /n "PaperCut Printer" /a C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\printer-settings.bin p h i r g u d c 2 Jump to behavior
Uses taskkill to terminate processes
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process created: C:\Windows\System32\taskkill.exe "taskkill.exe" /f /im "pc-print-client-service.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process created: C:\Windows\System32\taskkill.exe "taskkill.exe" /f /im "pc-print-client.exe" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe "c:\users\user\appdata\local\temp\is-b2r1d.tmp\client\pc-print-client.exe" -installprintqueue -printerid="papercut printer" -printername="papercut printer" "-driverfilepath=c:\users\user\appdata\local\temp\is-b2r1d.tmp\client\pc-global-print-driver\pcglobal.inf" -logfile="c:\users\user\appdata\local\temp\is-b2r1d.tmp\queue_install.log"
Source: unknown Process created: C:\Windows\System32\drvinst.exe drvinst.exe "4" "0" "c:\users\user\appdata\local\temp\{4744f51b-c3b4-8c45-9965-84928136fda2}\pcglobal.inf" "9" "48fde5adf" "000000000000015c" "winsta0\default" "0000000000000144" "208" "c:\users\user\appdata\local\temp\is-b2r1d.tmp\client\pc-global-print-driver"
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp Process created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe "c:\users\user\appdata\local\temp\is-b2r1d.tmp\client\pc-print-client.exe" -installprintqueue -printerid="papercut printer" -printername="papercut printer" "-driverfilepath=c:\users\user\appdata\local\temp\is-b2r1d.tmp\client\pc-global-print-driver\pcglobal.inf" -logfile="c:\users\user\appdata\local\temp\is-b2r1d.tmp\queue_install.log" Jump to behavior
Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr Binary or memory string: %s, gp->status=, not pointer-byte block (3814697265625403 Forbidden: unknown pc <unknown: %T>Accept-RangesAnimateWindowAuthorizationBrowserSearchCLIENT_RANDOMCONNECT_ERRORCUPS-Get-PPDsCUPS-Move-JobCache-ControlCertOpenStoreCoTaskMemFreeContent-RangeCreateActCtxWCreateRectRgnDeleteServiceDestroyWindowDownArrowBar;DownTeeArrow;DrawFocusRectECDSAWithSHA1EndDocPrinterEnumPrintersWEnumProcessesExitWindowsExExponentialE;FQDN too longFindFirstFileFindNextFileWFindResourceWFreeAddrInfoWGC sweep waitGet-DocumentsGetClassNameWGetClientRectGetDeviceCapsGetDriveTypeWGetScrollInfoGetSystemMenuGetThemeColorGetWindowLongGetWindowRectGreaterEqual;GreaterTilde;Gunjala_GondiHanja / KanjiHilbertSpace;Hold-New-JobsHumpDownHump;If-None-MatchImageList_AddIntersection;IsPlaceholderJWS holds JWEKana / HangulLast-ModifiedLeftArrowBar;LeftTeeArrow;LeftTriangle;LeftUpVector;LineTo failedLoop DetectedMapViewOfFileMasaram_GondiMende_KikakuiModule32NextWNotCongruent;NotHumpEqual;NotLessEqual;NotLessTilde;Old_HungarianOleInitializeOpCupsGetPpdsOpCupsMoveJobOpHoldNewJobsOpResubmitJobOpValidateJobOpenClipboardOpenThemeDataPKCS1WithSHA1PaperCut HivePause-PrinterPdhCloseQueryPrinterID: %qProportional;RegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWReprocess-JobReservedNamesReset ContentRightCeiling;RoundImplies;RtlGetVersionRtlInitStringRtlMoveMemorySHA256-RSAPSSSHA384-RSAPSSSHA512-RSAPSSSTREAM_CLOSEDSend-DocumentSetBrushOrgExSetScrollInfoSetWindowLongShellExecuteWShell_TrayWndShortUpArrow;SquareSubset;StartServiceWSysFreeStringThread32FirstUnderBracket;Unknown panicUsage of %s:
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Queries volume information: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\rundll32.exe Queries volume information: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\pcglobal.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\drvinst.exe Queries volume information: C:\Windows\System32\DriverStore\Temp\{db7c9079-64f3-cb4a-9c36-b79a3d2cd1fb}\pcglobal.cat VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: papercut-hive.tmp, 00000002.00000003.2702866559.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702370361.0000000004229000.00000004.00001000.00020000.00000000.sdmp, WMIC.exe, 00000008.00000003.2110858859.000001E21B9A1000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000003.2111694641.000001E21B803000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000003.2111760335.000001E21B806000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000003.2110642425.000001E21B7F9000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000002.2112382243.000001E21BA9B000.00000004.00000020.00020000.00000000.sdmp, antivirus-info.log.6.dr Binary or memory string: pathToSignedReportingExe=%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: WMIC.exe, 00000008.00000002.2112382243.000001E21BA9B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: gnedReportingExe=%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: WMIC.exe, 00000008.00000002.2112238830.000001E21B7D8000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000002.2112099275.000001E21B7B7000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000003.2110743546.000001E21B7D7000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000003.2110801990.000001E21B7E5000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000003.2111398787.000001E21B97C000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000003.2111773868.000001E21B7B7000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000003.2110642425.000001E21B7B2000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000002.2112263295.000001E21B7E6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\System32\wbem\WMIC.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1542234 Sample: papercut-hive.exe Startdate: 25/10/2024 Architecture: WINDOWS Score: 26 67 pmitc.papercut.com 2->67 69 fg.microsoft.map.fastly.net 2->69 71 5 other IPs or domains 2->71 77 Sigma detected: rundll32 run dll from internet 2->77 9 papercut-hive.exe 2 2->9         started        12 drvinst.exe 14 2->12         started        14 PrintIsolationHost.exe 1 2->14         started        signatures3 process4 file5 59 C:\Users\user\AppData\...\papercut-hive.tmp, PE32 9->59 dropped 16 papercut-hive.tmp 24 9->16         started        process6 dnsIp7 61 fg.microsoft.map.fastly.net 199.232.210.172, 443, 49758, 49766 FASTLYUS United States 16->61 63 d1d4ywpuwg1f9b.cloudfront.net 52.222.214.120 AMAZON-02US United States 16->63 65 aka.ms 104.119.110.121, 443, 49753, 49762 AKAMAI-ASUS United States 16->65 49 C:\Users\user\AppData\...\pc-print-client.exe, PE32+ 16->49 dropped 51 C:\Users\user\AppData\...\vcredist_x64.exe, PE32 16->51 dropped 53 C:\Users\user\AppData\Local\Temp\...\idp.dll, PE32 16->53 dropped 55 2 other files (none is malicious) 16->55 dropped 20 cmd.exe 2 16->20         started        23 pc-print-client.exe 4 16->23         started        27 cmd.exe 2 16->27         started        29 3 other processes 16->29 file8 process9 dnsIp10 79 Uses netstat to query active network connections and open ports 20->79 31 conhost.exe 20->31         started        33 NETSTAT.EXE 1 1 20->33         started        73 pmitc.papercut.com 34.111.87.71 GOOGLEUS United States 23->73 75 127.0.0.1 unknown unknown 23->75 57 C:\Users\user\AppData\...\queue_install.log, ASCII 23->57 dropped 35 rundll32.exe 1 9 23->35         started        37 rundll32.exe 1 23->37         started        39 rundll32.exe 1 1 23->39         started        41 rundll32.exe 1 23->41         started        43 WMIC.exe 1 27->43         started        45 conhost.exe 27->45         started        47 4 other processes 29->47 file11 signatures12 process13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
52.222.214.120
 d1d4ywpuwg1f9b.cloudfront.net United States
16509 AMAZON-02US false
34.111.87.71
 pmitc.papercut.com United States
15169 GOOGLEUS false
104.119.110.121
 aka.ms United States
16625 AKAMAI-ASUS false
199.232.210.172
 fg.microsoft.map.fastly.net United States
54113 FASTLYUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
fg.microsoft.map.fastly.net 199.232.210.172 true
d1d4ywpuwg1f9b.cloudfront.net 52.222.214.120 true
aka.ms 104.119.110.121 true
pmitc.papercut.com 34.111.87.71 true
cdn1.papercut.com unknown unknown
198.187.3.20.in-addr.arpa unknown unknown
197.87.175.4.in-addr.arpa unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://aka.ms/vs/17/release/vc_redist.x64.exe false
    		unknown
    https://cdn1.papercut.com/files/open-source/ghost-trap/ghost-trap-installer-1.5.10.03.exe false
      		unknown