Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 22:33
Static task
static1
2 signatures
150 seconds
3 signatures
150 seconds
General
- Target [email protected]
- Size 415KB
- Sample260730-2gp3vsgm3y
- SHA256 aef09267a46326c4588d6d6b053621979a616ac6637c92179dae509d89ece259
- MD5 ce38bf6b8e53dc0aafa93d2ed413222d
- SHA1 b4957c0314728873eabb40167049ec675ba548e6
- SHA512 49de634b359f73857ebdc1d37d0e05685d48f220466d05c33b5495e3f1808a7cb70fea78bb5aba97024eb02cff5bf6bbe2ad61d8cf8c34a1f3c169554a5db184
- SSDEEP 12288:SvL6xOdbwXE9LsCoG9ZyCqi21bZHCyYPt9J6QB7r:SoOdbwU6aZmi2GhJ6+r
- TLSH T1F4942381EFBCCFB6E8B67A365D03EC900E4C98936D4EA5A87DFCC45B6B853340960255
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4916 mspaint.exe 4916 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4916 mspaint.exe 4916 mspaint.exe 4916 mspaint.exe 4916 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4916
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:3584