Analysis
- max time kernel
898s - max time network
741s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/05/2026, 03:53
Static task
static1
Behavioral task
behavioral1
Sample
Screenshot 2026-05-16 124726.png
Resource
win10v2004-20260513-en
2 signatures
900 seconds
Behavioral task
behavioral2
Sample
Screenshot 2026-05-16 124726.png
Resource
win11-20260513-en
0 signatures
900 seconds
General
- Target Screenshot 2026-05-16 124726.png
- Size 2.8MB
- Sample260518-efppdafx6w
- SHA256 68a3a2f2b162f0e5b8642dffb9e45bef8cb907f1f7ea124354accc114c29e5c3
- MD5 c356fa19b131b6c7daabe55e765894f8
- SHA1 39da8ee34591a1f84db8a5d95ac09cac44c7f4a9
- SHA512 ad6f9da9b18bf5bdc8e4e7ceda22ca86b0c600dc78ab635e11717932009e94e756e1dda5030430e3389d1bb2e15bc97980521a1f09be92061f20342d6d47e30b
- SSDEEP 49152:eR9+iXfZE9zuPvZcwyi4Um2fe6fPPVLuxiokkb2e8qZJN2sjyKX/f8t8RFRkJCFM:sEiXhE9z8h1ZbfDPVkCkT2iyKXHi8DRO
- TLSH T16DD533699A3407F408EF34DDB8752987EB320F453408736D9492750EA7BEEEDE30562A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3864 mspaint.exe 3864 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3864 mspaint.exe 3864 mspaint.exe 3864 mspaint.exe 3864 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Screenshot 2026-05-16 124726.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3864
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4712