Overview
overview
8Static
static
317-12-25 I...ta.eml
windows10-2004-x64
117-12-25 I...ta.eml
windows11-ltsc_2024-x64
1Evidence bundle.pdf
windows10-2004-x64
3Evidence bundle.pdf
windows11-ltsc_2024-x64
3WhatsApp I...PM.jpg
windows10-2004-x64
1WhatsApp I...PM.jpg
windows11-ltsc_2024-x64
8email-html-2.html
windows10-2004-x64
3email-html-2.html
windows11-ltsc_2024-x64
3email-plain-1.txt
windows10-2004-x64
1email-plain-1.txt
windows11-ltsc_2024-x64
1Analysis
- max time kernel
898s - max time network
451s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 02:53
Behavioral task
behavioral1
Sample
17-12-25 Invitation- header data.eml
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
17-12-25 Invitation- header data.eml
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
Evidence bundle.pdf
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Evidence bundle.pdf
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
WhatsApp Image 2025-12-18 at 1.54.28 PM.jpg
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
WhatsApp Image 2025-12-18 at 1.54.28 PM.jpg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
email-html-2.html
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
email-html-2.html
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
email-plain-1.txt
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
email-plain-1.txt
Resource
win11ltsc2024-20260709-en
General
- Target WhatsApp Image 2025-12-18 at 1.54.28 PM.jpg
- Size 223KB
- Sample260803-ddhydabb98
- SHA256 9e9aeebcf3b63a9775ca287cc297f5ee8dc7c55dc9ff23a797fa245799fc4b8d
- MD5 e6a04b82492b1f194ba5d12dc6759b48
- SHA1 93470980057a5c394f2538dee74bd798ab909a95
- SHA512 491fd3ffbce206a5036234064bb2f9bce91cf4f6890f5150e49f8b96defd2ac5a30befaa89ca7284b7d2fba78b8ac15be6ca6835cb8d947bf43adac38c756814
- SSDEEP 6144:rXDhGmr4Hr7L7Su0jusy2csRkGBUuhIMZN0BM7fJJuagnjzkw70yc:rXTKr7L7wiReBWLMaaxJKfc
- TLSH T1F52423C51F742E91D6480375E48C12FA3E473C8ABDA362E76DC45870245EBA09E7867F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4668 mspaint.exe 4668 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4668 mspaint.exe 4668 mspaint.exe 4668 mspaint.exe 4668 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\WhatsApp Image 2025-12-18 at 1.54.28 PM.jpg"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4668
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4732