Analysis
- user interaction
yes - max time kernel
12s - max time network
10s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/07/2026, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
ATT32084.png
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ATT32084.png
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target ATT32084.png
- Size 7KB
- Sample260717-vbtersbx2t
- SHA256 4b3418bc361325ba78853174646663a0b9918d176706de3e9a79adef0c6cc2f2
- MD5 b650aa59c4a77015d0ecf99fb6108ebd
- SHA1 0107724726c6b302eb2ab315c2c247e3d2f98e92
- SHA512 014525a925d4b8dee568be28e88465e3becefb795c630211ad962de7d7c280625dff1b4a28d87689d2f2473403c7e2b924203e11a0f4635fb7b28a9df5cf8d61
- SSDEEP 192:/puXPX8LFy+EFajWY8uIWkC3N33Tiy94J+bg9wpPYqc:4f8BydagKHT/94a8wQ
- TLSH T19DF14BE1846EF3B9CC1AF22E0EE1F67873FE8454BE925B25E32467E1012295CC3945A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2872 mspaint.exe 2872 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2872 mspaint.exe 2872 mspaint.exe 2872 mspaint.exe 2872 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\ATT32084.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2872
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:5880