Analysis
- user interaction
yes - max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/04/2026, 03:32
Static task
static1
Behavioral task
behavioral1
Sample
P00211.jpg
Resource
win10v2004-20260130-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
P00211.jpg
Resource
win11-20260130-en
0 signatures
150 seconds
General
- Target P00211.jpg
- Size 1.7MB
- Sample260428-d323jsds7z
- SHA256 ebb396c4b76024da9f124f9bca10aff4d56155651ce1ca125de1b96c51ad4c4d
- MD5 92181d649354ca4d10e50479c5bbcf2e
- SHA1 aa8a4d852d6ffb3d31ee8dfaac5808164141c234
- SHA512 d844c87039248266a56b2b1e8d43b70ff4a0ebababe4a9d02d4297f845b7dad68dda413ee3ad04c28bf3f665a286d1eda9435fd507bfba26f03d5d9c5226632e
- SSDEEP 49152:UTzER1GGollla9leHtkRvTMqZNND8q6sP:UTzEu5la9JxRKg
- TLSH T1688523B1F7E7E3A447174B6EA27C7CBF53C549E596C94A0B050B1D116900FB82287ABC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5984 mspaint.exe 5984 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5984 mspaint.exe 5984 mspaint.exe 5984 mspaint.exe 5984 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\P00211.jpg"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5984
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:3260