Overview
overview
4Static
static
1phish_aler...1).eml
windows10-2004-x64
1phish_aler...1).eml
windows11-21h2-x64
102140f2a-e...a4.png
windows10-2004-x64
102140f2a-e...a4.png
windows11-21h2-x64
40d002d8-3...95.png
windows10-2004-x64
140d002d8-3...95.png
windows11-21h2-x64
9a892bbd-0...7e.png
windows10-2004-x64
19a892bbd-0...7e.png
windows11-21h2-x64
e08636e4-b...f7.png
windows10-2004-x64
1e08636e4-b...f7.png
windows11-21h2-x64
email-html-1.html
windows10-2004-x64
4email-html-1.html
windows11-21h2-x64
4Analysis
- max time kernel
149s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/05/2026, 19:56
Static task
static1
Behavioral task
behavioral1
Sample
phish_alert_sp2_2.0.0.0 (1).eml
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
phish_alert_sp2_2.0.0.0 (1).eml
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
02140f2a-ef83-418d-9d3f-45d2111841a4.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
02140f2a-ef83-418d-9d3f-45d2111841a4.png
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
40d002d8-3240-4147-a04a-4332b1fae395.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
40d002d8-3240-4147-a04a-4332b1fae395.png
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
9a892bbd-03f3-41eb-832e-d3bf452f817e.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
9a892bbd-03f3-41eb-832e-d3bf452f817e.png
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
e08636e4-b917-4b33-8d68-591e846b95f7.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
e08636e4-b917-4b33-8d68-591e846b95f7.png
Resource
win11-20260513-en
Behavioral task
behavioral11
Sample
email-html-1.html
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
email-html-1.html
Resource
win11-20260513-en
General
- Target e08636e4-b917-4b33-8d68-591e846b95f7.png
- Size 8KB
- Sample260527-ynswjsa191
- SHA256 33818570245758bb821c56548389b02c1c4e4937da600c485f05a86ec689adab
- MD5 d73e51851b0a6e6c832c7a4cfa170379
- SHA1 d46147919fb94f0e6398ea4a99b534e19754c3e6
- SHA512 ca491fdadc4b25b0ad26943bfb6051e1f673001520d1b6306ef88dd9e8985ce74acdfde3a954d285a1e0a989570e9fac9fd8e7b609f1c92ea08701eed7876eda
- SSDEEP 192:m9iodW262qFfAWs6TkH/Y14Fj+X2STgqCt9VjFXPOa54:gqFfm77j+XbC1jFX/4
- TLSH T11E02B0C2318723C0D60BD5F1EF8B57AA63C7623609FD8554403E90DDE9057944513BD7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1020 mspaint.exe 1020 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1020 mspaint.exe 1020 mspaint.exe 1020 mspaint.exe 1020 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\e08636e4-b917-4b33-8d68-591e846b95f7.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1020
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:2664