Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 04:49
Static task
static1
Behavioral task
behavioral1
Sample
image008.png
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
image008.png
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target image008.png
- Size 167KB
- Sample260804-ff2vdav1hs
- SHA256 69e90c7425648e938bcf4332f8580924c65b38ba982e2e4b1bbcb42d6ab87942
- MD5 917165d4f75d396d9d541ca7dc53e3a7
- SHA1 81cd1d1d7802b1f71a524b8e13c057e33358dd6c
- SHA512 dcd45450cc13a8707af833207aba522ed945e3e02688e45d4275d86477e4be648ddaa7be466ea2cd87adc61c5587682b0acb344fc5c5ee920612f92d4ca8c767
- SSDEEP 3072:EDitl/zWlC24IFPKfB6AD4HptMhxGltbEuNLJUPGWcL76/ko37Mw0jxQImZ:aY1WAI5KJ6m4Hp2hkfbKPGWcLmXwwyAZ
- TLSH T1C0F3CF976CB430E35843C8EF354D9D82FFBF390196847F26EF6A909CA14B164AC8655C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 940 mspaint.exe 940 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 940 mspaint.exe 940 mspaint.exe 940 mspaint.exe 940 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\image008.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:940
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:2040