Analysis
- user interaction
yes - max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
02/05/2026, 14:29
General
- Target image[1].png
- Size 42KB
- Sample260502-rtnqfset8n
- SHA256 0c765c6b48e28ce6c03a318d8cc5d6bc266f97050085be588604c147198f59cc
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\image[1].png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_zxrawl5r.scu.ps1
memory/228-9-0x000001FA20F30000-0x000001FA20F52000-memory.dmp
memory/228-10-0x000001FA212F0000-0x000001FA21334000-memory.dmp
memory/228-11-0x000001FA213C0000-0x000001FA21436000-memory.dmp
memory/228-13-0x000001FA08A60000-0x000001FA08A6C000-memory.dmp
memory/228-12-0x000001FA06AB0000-0x000001FA06C51000-memory.dmp
memory/228-21-0x000001FA06AB0000-0x000001FA06C51000-memory.dmp
memory/228-22-0x000001FA08A60000-0x000001FA08A6C000-memory.dmp