Overview
overview
3Static
static
1A0TOFHD.pages
macos-10.15-amd64
1QuickLook/...il.png
windows10-2004-x64
1QuickLook/...il.png
windows11-ltsc_2024-x64
1buildVersi...ry.xml
windows10-2004-x64
3buildVersi...ry.xml
windows11-ltsc_2024-x64
1bullet_gbu...ay.png
windows10-2004-x64
1bullet_gbu...ay.png
windows11-ltsc_2024-x64
1index.xml
windows10-2004-x64
3index.xml
windows11-ltsc_2024-x64
1Analysis
- user interaction
yes - max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/07/2026, 01:31
Static task
static1
Behavioral task
behavioral1
Sample
A0TOFHD.pages
Resource
macos-20250619-en
Behavioral task
behavioral2
Sample
QuickLook/Thumbnail.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral3
Sample
QuickLook/Thumbnail.png
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral4
Sample
buildVersionHistory.xml
Resource
win10v2004-20260513-en
Behavioral task
behavioral5
Sample
buildVersionHistory.xml
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral6
Sample
bullet_gbutton_gray.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral7
Sample
bullet_gbutton_gray.png
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral8
Sample
index.xml
Resource
win10v2004-20260513-en
Behavioral task
behavioral9
Sample
index.xml
Resource
win11ltsc2024-20260709-en
General
- Target QuickLook/Thumbnail.png
- Size 31KB
- Sample260710-bxcvcsby5m
- SHA256 6caa43efe6af16d7b5a948e75b5b52ec62c76152e2004eb7ae36735c7db36424
- MD5 4bbfc1bd696683be403d1930e913a482
- SHA1 e6d08c108bcf75c39ff8da2ee3a4fecf6299063d
- SHA512 701305ee006c3f9af25d00d49ff47d5451bdec78c18dc0cf6c99bd43201c31b516d6205202e044e987cd7fcd7720c6a179a9b8e8f4d359b22f0f075eb8ce860c
- SSDEEP 384:5SlBjfKuzu9U0vks8L+wKYv9UK6IJkTn7KLDn0VzU8XfdddddddddddddddddddE:5SvCuz2U078L+Yv76sK7in0VQ7
- TLSH T122E2F692E349C637736C6154B9A6114319442EBB31C8CE6548E7720F43B3FF16DBAEA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 8 mspaint.exe 8 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 8 mspaint.exe 8 mspaint.exe 8 mspaint.exe 8 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\QuickLook\Thumbnail.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:8
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4880