Overview
overview
8Static
static
1§8§lSmal...ir.zip
windows10-2004-x64
1§8§lSmal...ir.zip
windows11-ltsc_2024-x64
1assets/min...ir.png
windows10-2004-x64
1assets/min...ir.png
windows11-ltsc_2024-x64
1pack.mcmeta
windows10-2004-x64
3pack.mcmeta
windows11-ltsc_2024-x64
8pack.png
windows10-2004-x64
1pack.png
windows11-ltsc_2024-x64
8Analysis
- max time kernel
149s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/07/2026, 15:30
Static task
static1
Behavioral task
behavioral1
Sample
§8§lSmall crosshair.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
§8§lSmall crosshair.zip
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral3
Sample
assets/minecraft/textures/gui/sprites/hud/crosshair.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
assets/minecraft/textures/gui/sprites/hud/crosshair.png
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral5
Sample
pack.mcmeta
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
pack.mcmeta
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral7
Sample
pack.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
pack.png
Resource
win11ltsc2024-20260629-en
General
- Target pack.png
- Size 733B
- Sample260705-sxrf7agy6n
- SHA256 a5ed25dc577b4fc3e8ce5e0b47e22be601d2fb7a12ab8388c3868fa01ef2f23e
- MD5 bf0d68edcaeec0b4f4ba453d2c7117a0
- SHA1 7268a114ec40428b293859de9eff001c8fd2df7e
- SHA512 6dd8c4652706e88255cdef6657f775d652e38aca1b3afd2688a712be1ce5e6a53ed21fe3eb67f397bf52a9f65aeea5cda3e7552dd5ebb11bec6ada2b4ef93c7b
- TLSH T18501655DAC9119C0CA4D9C3390FE21D1E4351B0843507419FAD6E8D72D040E95A5B1C3
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3576 mspaint.exe 3576 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3576 mspaint.exe 3576 mspaint.exe 3576 mspaint.exe 3576 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\pack.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3576
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4392