Analysis
-
max time kernel
93s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
24/02/2025, 10:48
General
-
Target
Aborning/Porriwiggle193.jpg
-
Size
24KB
-
MD5
685927894a5dde45206a2b2144bfde32
-
SHA1
21fa068a05ae614b2301a65caf08d98c459fa742
-
SHA256
6204ffd93b3768a153b3f36201869e947e04c6a8d02b635be2f4fa3e6c21c1a9
-
SHA512
05159ffb1ba23a1745a7b559c4271971135fb4df3a2f8fef502e946d001aa02f4d1655826c30c3a6252e1684d30924df484d4b6c3c461991e7614f9aeb304674
-
SSDEEP
384:OdRxiy/l25WYBZlUAJ0W9RanPVRObZgFvtCPvFmi3PQ3CM75B83zDf/ecPjWMe6E:Ol2fBZaAYPVRSZgFvtCPFQ3C64LWWK9r
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Aborning\Porriwiggle193.jpg"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵