Overview
overview
4Static
static
3Microsoft....we.zip
windows10-2004-x64
1Microsoft....we.zip
windows11-21h2-x64
1AppxBlockMap.xml
windows10-2004-x64
3AppxBlockMap.xml
windows11-21h2-x64
4AppxMetada...st.xml
windows10-2004-x64
3AppxMetada...st.xml
windows11-21h2-x64
4AppxMetada...M.appx
windows10-2004-x64
AppxMetada...M.appx
windows11-21h2-x64
AppxMetada...2.appx
windows10-2004-x64
AppxMetada...2.appx
windows11-21h2-x64
AppxMetada...4.appx
windows10-2004-x64
AppxMetada...4.appx
windows11-21h2-x64
AppxSignature.p7x
windows10-2004-x64
3AppxSignature.p7x
windows11-21h2-x64
3PaintStudi...M.appx
windows10-2004-x64
PaintStudi...M.appx
windows11-21h2-x64
Assets/Ima...il.png
windows10-2004-x64
1Assets/Ima...il.png
windows11-21h2-x64
Assets/Ima...il.png
windows10-2004-x64
1Assets/Ima...il.png
windows11-21h2-x64
Assets/Ima...il.png
windows10-2004-x64
1Assets/Ima...il.png
windows11-21h2-x64
Assets/Ima...il.png
windows10-2004-x64
1Assets/Ima...il.png
windows11-21h2-x64
Assets/Ima...on.png
windows10-2004-x64
1Assets/Ima...on.png
windows11-21h2-x64
Assets/Ima...on.png
windows10-2004-x64
1Assets/Ima...on.png
windows11-21h2-x64
Assets/Ima...rd.png
windows10-2004-x64
1Assets/Ima...rd.png
windows11-21h2-x64
Assets/Ima...rk.dxt
windows10-2004-x64
3Assets/Ima...rk.dxt
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/06/2026, 03:58
Static task
static1
Behavioral task
behavioral1
Sample
Microsoft.MSPaint_2024.2405.19017.0_neutral_~_8wekyb3d8bbwe.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Microsoft.MSPaint_2024.2405.19017.0_neutral_~_8wekyb3d8bbwe.zip
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
AppxBlockMap.xml
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
AppxBlockMap.xml
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
AppxMetadata/AppxBundleManifest.xml
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
AppxMetadata/AppxBundleManifest.xml
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
AppxMetadata/Stub/Paint3DStub_1.0.74.0_ARM.appx
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
AppxMetadata/Stub/Paint3DStub_1.0.74.0_ARM.appx
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
AppxMetadata/Stub/Paint3DStub_1.0.74.0_Win32.appx
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
AppxMetadata/Stub/Paint3DStub_1.0.74.0_Win32.appx
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
AppxMetadata/Stub/Paint3DStub_1.0.74.0_x64.appx
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
AppxMetadata/Stub/Paint3DStub_1.0.74.0_x64.appx
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
AppxSignature.p7x
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
AppxSignature.p7x
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
PaintStudio.View_6.2405.19017.0_ARM.appx
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
PaintStudio.View_6.2405.19017.0_ARM.appx
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
Assets/Images/HelpAndFeedback/BlogThumbnail.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Assets/Images/HelpAndFeedback/BlogThumbnail.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
Assets/Images/HelpAndFeedback/FeedbackThumbnail.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Assets/Images/HelpAndFeedback/FeedbackThumbnail.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
Assets/Images/HelpAndFeedback/HelpThumbnail.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Assets/Images/HelpAndFeedback/HelpThumbnail.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
Assets/Images/HelpAndFeedback/VideoThumbnail.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Assets/Images/HelpAndFeedback/VideoThumbnail.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
Assets/Images/SmartSelect/AddStroke_Illustration.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Assets/Images/SmartSelect/AddStroke_Illustration.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
Assets/Images/SmartSelect/RemoveStroke_Illustration.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Assets/Images/SmartSelect/RemoveStroke_Illustration.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
Assets/Images/Stickers/Custom_Sticker_Checkerboard.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Assets/Images/Stickers/Custom_Sticker_Checkerboard.png
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
Assets/Images/Stickers/Sticker_Bark.dxt
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Assets/Images/Stickers/Sticker_Bark.dxt
Resource
win11-20260513-en
windows11-21h2-x64
General
- Target Assets/Images/HelpAndFeedback/VideoThumbnail.png
- Size 17KB
- Sample260604-ejznraax8q
- SHA256 c6d3ef4d20a854e3cea3bee5c8bec037435edee0915f49db1a654e66b781b4ea
- MD5 32c79f7a731fac20ac8e90d5bbf14f4c
- SHA1 3b4b562ca9a31f8a419fabd704480f70267f754b
- SHA512 e5d75963fa2a7a09c60e368906d284eab490d0ced0a0f9e30d5203fba54064181092d1d6771049cc4fdc3e43c4a33bddf204b26dcbbe8f556b8c756e4d97a744
- SSDEEP 384:HbgKJHeytPP2c4valLV/8kkYftHSp+WvzvhK6tgo1JoG/vpvNdXySv:HbN+e2HvwLVHHHSTvzh9vpvv
- TLSH T11382E00CB63F305DD32B25FCA27DD6779E8629A559888DB1FBCA01407974B26EB810C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1388 mspaint.exe 1388 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1388 mspaint.exe 1388 mspaint.exe 1388 mspaint.exe 1388 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Assets\Images\HelpAndFeedback\VideoThumbnail.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1388
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4420