Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
OYY8175H4I4UW7Q1TEI.jpg

Overview

General Information

Sample name:OYY8175H4I4UW7Q1TEI.jpg
Analysis ID:1559715
MD5:06bd02eb4a60871f951dac73e415ed1d
SHA1:d3fa6d94c3918275ad61885257329a58a81f90cb
SHA256:3efbbad3939bed256dde73847c405a8ebf98b85416f514a52c9410f877e44ba1

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:40%

Signatures

Creates files inside the system directory
Queries the volume information (name, serial number etc) of a device

Classification

  • System is w10x64
  • mspaint.exe (PID: 7440 cmdline: mspaint.exe "C:\Users\user\Desktop\OYY8175H4I4UW7Q1TEI.jpg" MD5: 986A191E95952C9E3FE6BE112FB92026)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: mspaint.exe, 00000000.00000002.2618725599.00000000050CB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.w3.or
Source: C:\Windows\SysWOW64\mspaint.exeFile created: C:\Windows\Debug\WIAJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeFile created: C:\Windows\Debug\WIA\wiatrace.logJump to behavior
Source: classification engineClassification label: clean1.winJPG@1/1@0/0
Source: C:\Windows\SysWOW64\mspaint.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: mfc42u.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: winmm.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: msftedit.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: uiribbon.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: xmllite.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: efswrt.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: sti.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: wiatrace.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: atlthunk.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: photometadatahandler.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeFile opened: C:\Windows\SysWOW64\MSFTEDIT.DLLJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\mspaint.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: mspaint.exe, 00000000.00000002.2619131432.0000000006B5B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: C:\Windows\SysWOW64\mspaint.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Windows\SysWOW64\mspaint.exeQueries volume information: C:\Users\user\Desktop\OYY8175H4I4UW7Q1TEI.jpg VolumeInformationJump to behavior
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading
1
DLL Side-Loading
1
Masquerading
OS Credential Dumping1
Security Software Discovery
Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
DLL Side-Loading
LSASS Memory1
Process Discovery
Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account Manager1
File and Directory Discovery
SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDS11
System Information Discovery
Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
http://www.w3.ormspaint.exe, 00000000.00000002.2618725599.00000000050CB000.00000004.00000020.00020000.00000000.sdmpfalse
    high
    No contacted IP infos
    Joe Sandbox version:41.0.0 Charoite
    Analysis ID:1559715
    Start date and time:2024-11-20 21:05:23 +01:00
    Joe Sandbox product:CloudBasic
    Overall analysis duration:0h 4m 0s
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:default.jbs
    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
    Number of analysed new started processes analysed:6
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Sample name:OYY8175H4I4UW7Q1TEI.jpg
    Detection:CLEAN
    Classification:clean1.winJPG@1/1@0/0
    EGA Information:Failed
    HCA Information:
    • Successful, ratio: 100%
    • Number of executed functions: 0
    • Number of non-executed functions: 0
    • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
    • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
    • Not all processes where analyzed, report is missing behavior information
    • Report size getting too big, too many NtOpenKeyEx calls found.
    • Report size getting too big, too many NtProtectVirtualMemory calls found.
    • Report size getting too big, too many NtQueryValueKey calls found.
    • VT rate limit hit for: OYY8175H4I4UW7Q1TEI.jpg
    TimeTypeDescription
    15:07:02API Interceptor507x Sleep call for process: mspaint.exe modified
    No context
    No context
    No context
    No context
    No context
    Process:C:\Windows\SysWOW64\mspaint.exe
    File Type:ASCII text, with CRLF, LF line terminators
    Category:dropped
    Size (bytes):1515
    Entropy (8bit):5.245269268202516
    Encrypted:false
    SSDEEP:24:0u//gF02k9YXCFF0qrF0kuqPF0w3OrF0HXd/bXE34hXd/TzLgNYxeemF0HXd/bXP:0u//gSmXoSISkuKSw3yS3RzE34BRTzuK
    MD5:9B0C97708F85C04E07B7B0006B3ACCE2
    SHA1:C9658CEA344F28E1AB4268E6391CB2F1CC6AC060
    SHA-256:589AC4D677BC7B65466C7AC8577091BC09571C59717C78F40536D4F8442208BD
    SHA-512:5DD90F3BA497DC35ED6682637F21CEDCC05A0C7B3AC08752336B82F6B80BD1499C1BE9AE0C4FD69F69D97C039B375BDBC2D49336EBF22A27AB1BBAC34C99FC00
    Malicious:false
    Reputation:low
    Preview:..**************** Started trace for Module: [sti.dll] in Executable [mspaint.exe] ProcessID: [7440] at 2024/11/20 15:06:16:898 ****************..WIA: 7440.7444 0 0 0 [sti.dll] AsyncRPCEventTransport::OpenConnectionToServer, AsyncRPC Connection established to server..WIA: 7440.7444 0 0 0 [sti.dll] AsyncRPCEventTransport::OpenConnectionToServer, Got my context 031E4E50 from server...WIA: 7440.7444 0 0 0 [sti.dll] WiaEventReceiver::Start, WiaEventReceiver Started.....WIA: 7440.7556 0 0 0 [sti.dll] AsyncRPCEventTransport::CloseNotificationChannel, Closing the async notification channel.....WIA: 7440.7556 0 0 0 [sti.dll] AsyncRPCEventTransport::OpenNotificationChannel, Opening the async notification channel.....WIA: 7440.7444 0 0 0 [sti.dll] AsyncRPCEventTransport::SendRegisterUnregisterInfo, Sent RPC Register/Unregister information...WIA: 7440.7444 0 0 0 [sti.dll] WiaEventReceiver::SendRegisterUnregisterInfo, Added new registration:..WIA: 7440.7444 0 0 0 [sti.dll] EventRegistrationInfo::D
    File type:JPEG image data, baseline, precision 8, 841x838, components 3
    Entropy (8bit):7.8546961428948725
    TrID:
    • JPEG Bitmap (3003/1) 75.00%
    • MP3 audio (1001/1) 25.00%
    File name:OYY8175H4I4UW7Q1TEI.jpg
    File size:193'845 bytes
    MD5:06bd02eb4a60871f951dac73e415ed1d
    SHA1:d3fa6d94c3918275ad61885257329a58a81f90cb
    SHA256:3efbbad3939bed256dde73847c405a8ebf98b85416f514a52c9410f877e44ba1
    SHA512:aee1317879333dbd726a0675e0628b74bec24a16c0bc204475072e284f73c98f9b6b03b57a15b79f7a3dfbaa29c05ea9513ca915d2a2df2290cb24ab2a9931d6
    SSDEEP:3072:UMu/pL2Cwc2iKhzxv3FJ+3BABPaiR0XpNFtn5ZYUCW51ro5o5o/tzr:ruRyvBpnl0vfYDW51ro5KWtv
    TLSH:2014E0035D184EA3A55DD379BF074C8E2B05A36CA8873EEF28614ED27F992514D0E1BE
    File Content Preview:.....C....................................................................C.......................................................................F.I.."............................................................}........!1A..Qa."q.2....#B...R..$3br......
    No network behavior found

    Click to jump to process

    Click to jump to process

    Click to dive into process behavior distribution

    Target ID:0
    Start time:15:06:15
    Start date:20/11/2024
    Path:C:\Windows\SysWOW64\mspaint.exe
    Wow64 process (32bit):true
    Commandline:mspaint.exe "C:\Users\user\Desktop\OYY8175H4I4UW7Q1TEI.jpg"
    Imagebase:0x840000
    File size:743'424 bytes
    MD5 hash:986A191E95952C9E3FE6BE112FB92026
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:moderate
    Has exited:false

    No disassembly