694b7fb3ae0832a1463202b29098f8be7df6e658b0a399b2080f3de68df9ead3 | Triage

Resubmissions

29/01/2025, 16:46

250129-t95p1sskfl 10

29/01/2025, 16:44

250129-t8xb9atjaw 3

29/01/2025, 15:43

250129-s5zsjazrgm 10

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2025, 15:43

Sharing

Report Analysis Logs

General

Target

Pa$$__ 6649.jpg
Size

44KB
MD5

49d51d6b6ae0d2544201f5228766da1d
SHA1

7810aa6f4073a979c32503772187adc0dbc18809
SHA256

fe023e5a763573782c0d36db7d1ec6e82b2feff20096a520a3fc599ad0f48b6a
SHA512

3649af1ddb06ccaaf359763b7c34907c4b87eebb8cee570eeeca8d1b851f0839425193a8ca79e9f7e84177de39788a292e075a6ac66aa041ca3eaf4ccc5a0025
SSDEEP

768:wWxvGt0pwJFq8XZg4nfp5ap5Asu4wC9pbE0:wWxCQ4up5AYwn0

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3092	mspaint.exe
3092	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3092	mspaint.exe
3092	mspaint.exe
3092	mspaint.exe
3092	mspaint.exe

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Pa$$__ 6649.jpg"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads