3d1067331b7bed8a818ca2efcec2136667f2a180d0ee716a6f9b475e9df2fd7d | Triage

Analysis

max time kernel
123s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2025, 13:37

Sharing

Report Analysis Logs

General

Target

normalfordelte.jpg
Size

32KB
MD5

422d904c045d4ac8205ae56d0d413cf9
SHA1

8edd159e33b5feed673eb21561923b6311952d6a
SHA256

896685baa3d8b6c65622f6d6241a3c2121a1e26434875e8f03c544ebe54af56d
SHA512

087b0a02b40aca8792b2e60280b8e7645e086ac19919c55f078530eeacac6aa44fc12e5104c1d7ea25a2b2367e4721bb9cb20de6e65d98756ac8c5395d8ed4e1
SSDEEP

768:Y3BEzLhyMSuCE5OTO/R+5oEdZ0/EqdZceam:Y2xyM4EfYokZ0pTcTm

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4868	mspaint.exe
4868	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4868	mspaint.exe
4868	mspaint.exe
4868	mspaint.exe
4868	mspaint.exe

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\normalfordelte.jpg"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads