Overview
overview
4Static
static
1phish_aler...1).eml
windows10-2004-x64
1phish_aler...1).eml
windows11-21h2-x64
102140f2a-e...a4.png
windows10-2004-x64
102140f2a-e...a4.png
windows11-21h2-x64
40d002d8-3...95.png
windows10-2004-x64
140d002d8-3...95.png
windows11-21h2-x64
9a892bbd-0...7e.png
windows10-2004-x64
19a892bbd-0...7e.png
windows11-21h2-x64
e08636e4-b...f7.png
windows10-2004-x64
1e08636e4-b...f7.png
windows11-21h2-x64
email-html-1.html
windows10-2004-x64
4email-html-1.html
windows11-21h2-x64
4Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/05/2026, 19:56
Static task
static1
Behavioral task
behavioral1
Sample
phish_alert_sp2_2.0.0.0 (1).eml
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
phish_alert_sp2_2.0.0.0 (1).eml
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
02140f2a-ef83-418d-9d3f-45d2111841a4.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
02140f2a-ef83-418d-9d3f-45d2111841a4.png
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
40d002d8-3240-4147-a04a-4332b1fae395.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
40d002d8-3240-4147-a04a-4332b1fae395.png
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
9a892bbd-03f3-41eb-832e-d3bf452f817e.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
9a892bbd-03f3-41eb-832e-d3bf452f817e.png
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
e08636e4-b917-4b33-8d68-591e846b95f7.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
e08636e4-b917-4b33-8d68-591e846b95f7.png
Resource
win11-20260513-en
Behavioral task
behavioral11
Sample
email-html-1.html
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
email-html-1.html
Resource
win11-20260513-en
General
- Target 40d002d8-3240-4147-a04a-4332b1fae395.png
- Size 4KB
- Sample260527-ynswjsa191
- SHA256 cffe7a6b0ff892ff7bf29d8f84760df0a4aa82a00e4f5f5be84ca45705316d4e
- MD5 1a5375d43a6f15fe83f723051cf37b16
- SHA1 2956dd49752be1b0e2be9e399436543a5ad8b4f6
- SHA512 b84869a1aa58dad866b6b1dedab16b726aa4a26ef66225c59074eee38c700cfcbf71ebb63b02e897022c002e732cc8f6d26b327dcca1f72e20b3b04479db2f9a
- SSDEEP 96:fv6knZl+b+49eeT1x9z/E0LyjrU2a61Dl+8aKVU0dGNi+au+XHt8EbGwEOxbz:fCknZl+b+o7zs0so2LDU8TVq/lKN8Ebn
- TLSH T178A16C0CC6D16C811230C90C78E6892A89E148928AE1FD51FDDE6CB7EB399C1A9A7353
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3728 mspaint.exe 3728 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3728 mspaint.exe 3728 mspaint.exe 3728 mspaint.exe 3728 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\40d002d8-3240-4147-a04a-4332b1fae395.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3728
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:2628