Overview
overview
1Static
static
1d41e6b01-5...9d.eml
windows10-2004-x64
1d41e6b01-5...9d.eml
windows11-ltsc_2024-x64
120260724_154058.jpg
windows10-2004-x64
120260724_154058.jpg
windows11-ltsc_2024-x64
120260724_154117.jpg
windows10-2004-x64
120260724_154117.jpg
windows11-ltsc_2024-x64
120260724_154131.jpg
windows10-2004-x64
120260724_154131.jpg
windows11-ltsc_2024-x64
1Analysis
- user interaction
yes - max time kernel
133s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/07/2026, 12:40
Static task
static1
Behavioral task
behavioral1
Sample
d41e6b01-58da-403c-961e-08dee9896826/cb7bb9bb-06b1-d487-0544-305ee06c3f9d.eml
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
d41e6b01-58da-403c-961e-08dee9896826/cb7bb9bb-06b1-d487-0544-305ee06c3f9d.eml
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
20260724_154058.jpg
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
20260724_154058.jpg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
20260724_154117.jpg
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
20260724_154117.jpg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
20260724_154131.jpg
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
20260724_154131.jpg
Resource
win11ltsc2024-20260709-en
General
- Target 20260724_154058.jpg
- Size 1.6MB
- Sample260727-pv7tlseq9z
- SHA256 d41c87417daf76959a644f7b1b44b6379c91bf1da581c40e9f37e182c0bb9d88
- MD5 a0f2c7593daf271083614010bc05b2a9
- SHA1 b8c333e5f995466dc836aac4ca6d3e1247f4bbc5
- SHA512 18a2afda2cd5b62858e4b4669062011b182b2fdf568e216e6856b2b461f7f22e379d9962fbd109f11c93c0b1e31d4cb0af6860518ec72ebc76b790c83c9cc40a
- SSDEEP 49152:lIIkQcUQtF/94mpGUDYSO29gU7Q7EdJ3Ykto:2IUUQn1LPYSB9gYQsLo
- TLSH T18D75335A2FAEB958CDC638B40597F2A6DF251E33975C5E604825430BCCBF089B794A0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4860 mspaint.exe 4860 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4860 mspaint.exe 4860 mspaint.exe 4860 mspaint.exe 4860 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\20260724_154058.jpg"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4860
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:5052