3d1067331b7bed8a818ca2efcec2136667f2a180d0ee716a6f9b475e9df2fd7d | Triage

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2025, 13:37

Sharing

Report Analysis Logs

General

Target

apotekerbevillings.jpg
Size

32KB
MD5

7395345f8f9fa1c2c012f30387fbe6bc
SHA1

e2eca72547487ebc02e2c37a3b997e3b6c318f0e
SHA256

fe0871eb8dc89ceaacdea8439ded372446cc9b7a5c8e4b25530da1b9f69b6e83
SHA512

f4760e97752416734aa323722fff672d85fd23e057d70296de304ccfd7c813aae1e2091006f1acc9758a16acff8b61c00164aee116ae9ac2faaec34e186db7a1
SSDEEP

768:Y3BEzLhyMSuCE5OTO/R+5oEdZ0/EqdZceab:Y2xyM4EfYokZ0pTcTb

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
416	mspaint.exe
416	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
416	mspaint.exe
416	mspaint.exe
416	mspaint.exe
416	mspaint.exe

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\apotekerbevillings.jpg"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads