Overview
overview
1Static
static
1d41e6b01-5...9d.eml
windows10-2004-x64
1d41e6b01-5...9d.eml
windows11-ltsc_2024-x64
120260724_154058.jpg
windows10-2004-x64
120260724_154058.jpg
windows11-ltsc_2024-x64
120260724_154117.jpg
windows10-2004-x64
120260724_154117.jpg
windows11-ltsc_2024-x64
120260724_154131.jpg
windows10-2004-x64
120260724_154131.jpg
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/07/2026, 12:40
Static task
static1
Behavioral task
behavioral1
Sample
d41e6b01-58da-403c-961e-08dee9896826/cb7bb9bb-06b1-d487-0544-305ee06c3f9d.eml
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
d41e6b01-58da-403c-961e-08dee9896826/cb7bb9bb-06b1-d487-0544-305ee06c3f9d.eml
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
20260724_154058.jpg
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
20260724_154058.jpg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
20260724_154117.jpg
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
20260724_154117.jpg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
20260724_154131.jpg
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
20260724_154131.jpg
Resource
win11ltsc2024-20260709-en
General
- Target 20260724_154131.jpg
- Size 1.4MB
- Sample260727-pv7tlseq9z
- SHA256 8aa2b3b2a87e0325cc97597fa7bf67f9bde3a64afa5e4c2737e50a9bb76846b5
- MD5 fd7d0ac6789741fa63ef0095e1964fc4
- SHA1 2469dad8c52f8a52e85218a038ffa4af9080da2f
- SHA512 f52e5cea9bc2c574cde021baa9d37b21d28a329bc6b14d518e0c6a5c93f82d12e00d8a73e325298816213b5567e1a4da1ae634bdcc0027857b8c61dfd038b63f
- SSDEEP 24576:6f6zEi4IC+Ql3Pe4fYoox3h7M0seloFRZVGxAg59cVB97aqVGgv+cUczCN5:6fO4SK79ox3h7M0sVFRZU8VT75ggdUae
- TLSH T1036533007D8FB39AD3E492F235425B611E39650312E88975DB147A1837BED62B9CE33B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1888 mspaint.exe 1888 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1888 mspaint.exe 1888 mspaint.exe 1888 mspaint.exe 1888 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\20260724_154131.jpg"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1888
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4860