Overview
overview
4Static
static
1Message.eml
windows10-2004-x64
1Message.eml
windows11-21h2-x64
1AKGK7SAP1XDA.bmp
windows10-2004-x64
1AKGK7SAP1XDA.bmp
windows11-21h2-x64
email-html-2.html
windows10-2004-x64
4email-html-2.html
windows11-21h2-x64
4email-plain-1.txt
windows10-2004-x64
1email-plain-1.txt
windows11-21h2-x64
3Analysis
- user interaction
yes - max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/06/2026, 18:06
Static task
static1
Behavioral task
behavioral1
Sample
Message.eml
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Message.eml
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
AKGK7SAP1XDA.bmp
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
AKGK7SAP1XDA.bmp
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
email-html-2.html
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
email-html-2.html
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
email-plain-1.txt
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
email-plain-1.txt
Resource
win11-20260513-en
General
- Target AKGK7SAP1XDA.bmp
- Size 4.5MB
- Sample260604-wp9jkscs5p
- SHA256 d2493c8b39e9a59301d19b632e6bfecbb238d2f477ae19912f33b19148f2e320
- MD5 28e85a15103f86d1a6f45f205497a2b2
- SHA1 e1b0a11d1d06ebe192bb968872b9cb02d2a6083b
- SHA512 6d0fa5d91e50c95462763e3df6ea44e73011cc71327fb257305e1113325182fb6ebf2f4f08c98ec998327142fb4a9c289c82d27629986f88f1b7b83a99f8cb1f
- SSDEEP 49152:Nh/B/EVkXLmp56ahkELsPBkoXvvc1rmGkQ:hE
- TLSH T1D2266156867D431360F52D3F116B0D74ABABEE9B2918F2754C14F05EEE7A2D2E08CC26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2596 mspaint.exe 2596 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2596 mspaint.exe 2596 mspaint.exe 2596 mspaint.exe 2596 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\AKGK7SAP1XDA.bmp"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2596
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:2608