Overview
overview
3Static
static
3@cheatmygames (1).zip
windows10-2004-x64
1@cheatmygames (1).zip
windows11-21h2-x64
1Zenox.wex
windows10-2004-x64
3Zenox.wex
windows11-21h2-x64
3krampus-128x-1.16.zip
windows10-2004-x64
1krampus-128x-1.16.zip
windows11-21h2-x64
1assets/min.../0.png
windows10-2004-x64
1assets/min.../0.png
windows11-21h2-x64
assets/min.../1.png
windows10-2004-x64
1assets/min.../1.png
windows11-21h2-x64
assets/min...10.png
windows10-2004-x64
1assets/min...10.png
windows11-21h2-x64
assets/min...11.png
windows10-2004-x64
1assets/min...11.png
windows11-21h2-x64
assets/min...12.png
windows10-2004-x64
1assets/min...12.png
windows11-21h2-x64
assets/min...13.png
windows10-2004-x64
1assets/min...13.png
windows11-21h2-x64
assets/min...14.png
windows10-2004-x64
1assets/min...14.png
windows11-21h2-x64
assets/min...15.png
windows10-2004-x64
1assets/min...15.png
windows11-21h2-x64
assets/min...16.png
windows10-2004-x64
1assets/min...16.png
windows11-21h2-x64
assets/min...17.png
windows10-2004-x64
1assets/min...17.png
windows11-21h2-x64
assets/min...18.png
windows10-2004-x64
1assets/min...18.png
windows11-21h2-x64
assets/min...19.png
windows10-2004-x64
1assets/min...19.png
windows11-21h2-x64
assets/min.../2.png
windows10-2004-x64
1assets/min.../2.png
windows11-21h2-x64
Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/06/2026, 12:27
Static task
static1
Behavioral task
behavioral1
Sample
@cheatmygames (1).zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
@cheatmygames (1).zip
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
Zenox.wex
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Zenox.wex
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
krampus-128x-1.16.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
krampus-128x-1.16.zip
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
assets/minecraft/optifine/ctm/glass/0.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
assets/minecraft/optifine/ctm/glass/0.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
assets/minecraft/optifine/ctm/glass/1.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
assets/minecraft/optifine/ctm/glass/1.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
assets/minecraft/optifine/ctm/glass/10.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
assets/minecraft/optifine/ctm/glass/10.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
assets/minecraft/optifine/ctm/glass/11.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
assets/minecraft/optifine/ctm/glass/11.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
assets/minecraft/optifine/ctm/glass/12.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
assets/minecraft/optifine/ctm/glass/12.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
assets/minecraft/optifine/ctm/glass/13.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
assets/minecraft/optifine/ctm/glass/13.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
assets/minecraft/optifine/ctm/glass/14.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
assets/minecraft/optifine/ctm/glass/14.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
assets/minecraft/optifine/ctm/glass/15.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
assets/minecraft/optifine/ctm/glass/15.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
assets/minecraft/optifine/ctm/glass/16.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
assets/minecraft/optifine/ctm/glass/16.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
assets/minecraft/optifine/ctm/glass/17.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
assets/minecraft/optifine/ctm/glass/17.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
assets/minecraft/optifine/ctm/glass/18.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
assets/minecraft/optifine/ctm/glass/18.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
assets/minecraft/optifine/ctm/glass/19.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
assets/minecraft/optifine/ctm/glass/19.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
assets/minecraft/optifine/ctm/glass/2.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
assets/minecraft/optifine/ctm/glass/2.png
Resource
win11-20260513-en
windows11-21h2-x64
General
- Target assets/minecraft/optifine/ctm/glass/0.png
- Size 14KB
- Sample260602-pmt8jsds4t
- SHA256 1fb618ee077dd5a609375c45959900fc597959729b1fd27dc123ff8410ba11ec
- MD5 ede53d5dc5959cd15c601fc7b6009e81
- SHA1 166cd508f816ec16860b6cb1746373a702d75502
- SHA512 fca71a74504f3f36fc5c1a1d810e7692767b32abcfa2e1e74e3ff56df3a96c254b8d6a9cade7995cef648e06eeea11eda203235e2ecfe2818c9da357715c7118
- SSDEEP 48:D/6/pK+k29W8sEvu2xN+Y9ytBC+28sc5jz7bn:DShPkEWRP2xNXV8sc5zbn
- TLSH T148624058BCB17661E489DA325CC12805AD330543CAC0DD46FBDD8C27AF00BEA5C2F283
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4680 mspaint.exe 4680 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4680 mspaint.exe 4680 mspaint.exe 4680 mspaint.exe 4680 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\assets\minecraft\optifine\ctm\glass\0.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4680
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:2420