analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

paint.net.5.0.3.install.anycpu.web.exe

Full analysis: https://app.any.run/tasks/b18601d7-395d-4360-b9d4-c6cf6e273d17
Verdict: Malicious activity
Analysis date: April 01, 2023, 17:55:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

7E736ACCC204CE002FCEC6B5DC6214DD

SHA1:

420464AB383313994B5534C72F7F2C0F7D509462

SHA256:

AE41189FEC1996AFE1D193C606DDC228F0D24640EA01DF77A626DB75B2C29CB8

SSDEEP:

24576:nLYYYYkv0+qcSSu29odPoagtIC0BuDgtYiY+kM7p1kz6I:nLYYYYkvSSu29oQiDjMMV1e

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • SetupShim.exe (PID: 3636)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • paint.net.5.0.3.install.anycpu.web.exe (PID: 3344)
    • Reads the Internet Settings

      • paint.net.5.0.3.install.anycpu.web.exe (PID: 3344)
  • INFO

    • The process checks LSA protection

      • paint.net.5.0.3.install.anycpu.web.exe (PID: 3344)
    • Checks supported languages

      • paint.net.5.0.3.install.anycpu.web.exe (PID: 3344)
      • SetupShim.exe (PID: 3636)
    • Reads the computer name

      • paint.net.5.0.3.install.anycpu.web.exe (PID: 3344)
    • Create files in a temporary directory

      • paint.net.5.0.3.install.anycpu.web.exe (PID: 3344)
      • SetupShim.exe (PID: 3636)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

ProductVersion: 5.3.8488.42200
ProductName: paint.net
OriginalFileName: SetupSfx.exe
LegalCopyright: Copyright © 2023 dotPDN LLC, Rick Brewster, and contributors. All Rights Reserved.
InternalName: SetupSfx
FileVersion: 5.3.8488.42200
FileDescription: paint.net Setup
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Dynamic link library
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0017
ProductVersionNumber: 5.3.8488.42200
FileVersionNumber: 5.3.8488.42200
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x36e81
UninitializedDataSize: -
InitializedDataSize: 195584
CodeSize: 536576
LinkerVersion: 14.36
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2023:03:29 23:26:50+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 29-Mar-2023 23:26:50
Detected languages:
  • English - United States
Debug artifacts:
  • D:\src\pdn\src\SetupSfx\Release\SetupSfx.pdb
FileDescription: paint.net Setup
FileVersion: 5.3.8488.42200
InternalName: SetupSfx
LegalCopyright: Copyright © 2023 dotPDN LLC, Rick Brewster, and contributors. All Rights Reserved.
OriginalFilename: SetupSfx.exe
ProductName: paint.net
ProductVersion: 5.3.8488.42200

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000108

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 29-Mar-2023 23:26:50
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00082E16
0x00083000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.56606
.rdata
0x00084000
0x00011DA2
0x00011E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.67597
.data
0x00096000
0x00004AE0
0x00001600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.09667
.rsrc
0x0009B000
0x00014048
0x00014200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.55704
.reloc
0x000B0000
0x00004F98
0x00005000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.61561

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.19756
2218
UNKNOWN
English - United States
RT_MANIFEST
2
3.51765
296
UNKNOWN
English - United States
RT_ICON
3
6.11854
2216
UNKNOWN
English - United States
RT_ICON
4
3.7619
1384
UNKNOWN
English - United States
RT_ICON
5
7.99141
57804
UNKNOWN
English - United States
RT_ICON
6
5.14231
9640
UNKNOWN
English - United States
RT_ICON
7
5.27285
4264
UNKNOWN
English - United States
RT_ICON
8
5.09884
1128
UNKNOWN
English - United States
RT_ICON
97
3.20396
242
UNKNOWN
English - United States
RT_DIALOG
188
2.17822
84
UNKNOWN
English - United States
RT_STRING

Imports

ADVAPI32.dll
COMCTL32.dll
KERNEL32.dll
OLEAUT32.dll
SHELL32.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start paint.net.5.0.3.install.anycpu.web.exe no specs paint.net.5.0.3.install.anycpu.web.exe setupshim.exe

Process information

PID
CMD
Path
Indicators
Parent process
2824"C:\Users\admin\AppData\Local\Temp\paint.net.5.0.3.install.anycpu.web.exe" C:\Users\admin\AppData\Local\Temp\paint.net.5.0.3.install.anycpu.web.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
paint.net Setup
Exit code:
3221226540
Version:
5.3.8488.42200
Modules
Images
c:\users\admin\appdata\local\temp\paint.net.5.0.3.install.anycpu.web.exe
c:\windows\system32\ntdll.dll
3344"C:\Users\admin\AppData\Local\Temp\paint.net.5.0.3.install.anycpu.web.exe" C:\Users\admin\AppData\Local\Temp\paint.net.5.0.3.install.anycpu.web.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
paint.net Setup
Exit code:
1
Version:
5.3.8488.42200
Modules
Images
c:\users\admin\appdata\local\temp\paint.net.5.0.3.install.anycpu.web.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\usp10.dll
3636"C:\Users\admin\AppData\Local\Temp\7zS01D9F8D4\SetupShim.exe" /suppressRebootC:\Users\admin\AppData\Local\Temp\7zS01D9F8D4\SetupShim.exe
paint.net.5.0.3.install.anycpu.web.exe
User:
admin
Integrity Level:
HIGH
Description:
paint.net Setup Bootstrapper
Exit code:
1
Version:
5.3.8488.42200
Modules
Images
c:\users\admin\appdata\local\temp\7zs01d9f8d4\setupshim.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
Total events
1 478
Read events
1 462
Write events
16
Delete events
0

Modification events

(PID) Process:(3344) paint.net.5.0.3.install.anycpu.web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3344) paint.net.5.0.3.install.anycpu.web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3344) paint.net.5.0.3.install.anycpu.web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3344) paint.net.5.0.3.install.anycpu.web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
10
Suspicious files
0
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
3344paint.net.5.0.3.install.anycpu.web.exeC:\Users\admin\AppData\Local\Temp\7zS01D9F8D4\x64\SetupDownloader\SetupDownloader.exeexecutable
MD5:4EC105376265AD264F8AE81F7910697D
SHA256:25B826F01283DE2346ED61F81581FDB7FE34415A5CD97CDA708136701796A87F
3344paint.net.5.0.3.install.anycpu.web.exeC:\Users\admin\AppData\Local\Temp\7zS01D9F8D4\x64\SetupDownloader\Newtonsoft.Json.dllexecutable
MD5:715A1FBEE4665E99E859EDA667FE8034
SHA256:C5C83BBC1741BE6FF4C490C0AEE34C162945423EC577C646538B2D21CE13199E
3344paint.net.5.0.3.install.anycpu.web.exeC:\Users\admin\AppData\Local\Temp\7zS01D9F8D4\arm64\SetupDownloader\SetupDownloader.exe.configxml
MD5:8F692DCBF1E68398B5DAC3EBA59872B0
SHA256:8C422938A58DF86D88F29C61FF27006F0B3C9BB4742B11486BC5A01A6344129B
3344paint.net.5.0.3.install.anycpu.web.exeC:\Users\admin\AppData\Local\Temp\7zS01D9F8D4\arm64\SetupDownloader\SetupDownloader.exeexecutable
MD5:4EC105376265AD264F8AE81F7910697D
SHA256:25B826F01283DE2346ED61F81581FDB7FE34415A5CD97CDA708136701796A87F
3636SetupShim.exeC:\Users\admin\AppData\Local\Temp\pdnSetupShim.logtext
MD5:7ED93C28F1428631ABFFB4AF5A76CE3D
SHA256:8EAC2C4FF890471C8E2DD066BFE79E4E702D92F3079D99D26A9204B34F9C5B44
3344paint.net.5.0.3.install.anycpu.web.exeC:\Users\admin\AppData\Local\Temp\7zS01D9F8D4\arm64\SetupDownloader\Newtonsoft.Json.dllexecutable
MD5:715A1FBEE4665E99E859EDA667FE8034
SHA256:C5C83BBC1741BE6FF4C490C0AEE34C162945423EC577C646538B2D21CE13199E
3344paint.net.5.0.3.install.anycpu.web.exeC:\Users\admin\AppData\Local\Temp\7zS01D9F8D4\x64\SetupDownloader\SetupDownloader.exe.configxml
MD5:8F692DCBF1E68398B5DAC3EBA59872B0
SHA256:8C422938A58DF86D88F29C61FF27006F0B3C9BB4742B11486BC5A01A6344129B
3344paint.net.5.0.3.install.anycpu.web.exeC:\Users\admin\AppData\Local\Temp\7zS01D9F8D4\x64\SetupDownloader\SetupDownloader.Configuration.jsontext
MD5:8CA6779446E31E219589A08769448DA2
SHA256:2B23A17E993B7837A89365CDD328541F58DDFD4AB2B45285058284EEE5733613
3344paint.net.5.0.3.install.anycpu.web.exeC:\Users\admin\AppData\Local\Temp\7zS01D9F8D4\SetupShim.exeexecutable
MD5:E2B8F4221931E23F65DCDB2FD051BE8D
SHA256:621499BDF212EB1AAF80B3D2C7BEFFFCAA5FB2804B301D14690A236667A7908A
3344paint.net.5.0.3.install.anycpu.web.exeC:\Users\admin\AppData\Local\Temp\7zS01D9F8D4\arm64\SetupDownloader\SetupDownloader.Configuration.jsontext
MD5:8CA6779446E31E219589A08769448DA2
SHA256:2B23A17E993B7837A89365CDD328541F58DDFD4AB2B45285058284EEE5733613
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
SetupShim.exe
--- paint.net SetupShim starting, lpCmdLine='/suppressReboot', nCmdShow=1
SetupShim.exe
SetupShim.exe
CoInitializeEx() returned 0
SetupShim.exe
SetupShim.exe
GetNativePlatformID: GetNativeSystemInfo() returned wProcessorArchitecture=0
SetupShim.exe
SetupShim.exe
GetNativePlatformID() returned x86
SetupShim.exe
SetupShim.exe
Checking OS requirement
SetupShim.exe