Overview
overview
7Static
static
7BleachBit-...up.exe
windows10-2004-x64
7BleachBit-...up.exe
windows11-ltsc_2024-x64
5$PLUGINSDI...er.bmp
windows10-2004-x64
1$PLUGINSDI...er.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows11-ltsc_2024-x64
1COPYING
windows10-2004-x64
3COPYING
windows11-ltsc_2024-x64
3cacert.pem
windows10-2004-x64
3cacert.pem
windows11-ltsc_2024-x64
3etc/fonts/...ht.xml
windows10-2004-x64
3etc/fonts/...ht.xml
windows11-ltsc_2024-x64
1etc/fonts/...ts.xml
windows10-2004-x64
3etc/fonts/...ts.xml
windows11-ltsc_2024-x64
1etc/fonts/...ne.xml
windows10-2004-x64
3etc/fonts/...ne.xml
windows11-ltsc_2024-x64
1etc/fonts/...as.xml
windows10-2004-x64
3etc/fonts/...as.xml
windows11-ltsc_2024-x64
1etc/fonts/...lt.xml
windows10-2004-x64
3etc/fonts/...lt.xml
windows11-ltsc_2024-x64
1etc/fonts/...ra.xml
windows10-2004-x64
3etc/fonts/...ra.xml
windows11-ltsc_2024-x64
1etc/fonts/...es.xml
windows10-2004-x64
3etc/fonts/...es.xml
windows11-ltsc_2024-x64
1etc/fonts/...in.xml
windows10-2004-x64
3etc/fonts/...in.xml
windows11-ltsc_2024-x64
1etc/fonts/...ic.xml
windows10-2004-x64
3etc/fonts/...ic.xml
windows11-ltsc_2024-x64
1etc/fonts/...in.xml
windows10-2004-x64
3etc/fonts/...in.xml
windows11-ltsc_2024-x64
1etc/fonts/...ng.xml
windows10-2004-x64
3etc/fonts/...ng.xml
windows11-ltsc_2024-x64
1Analysis
- max time kernel
899s - max time network
570s - platform
windows10-2004_x64 - resource
win10v2004-20260513-uk - resource tags
arch:x64arch:x86image:win10v2004-20260513-uklocale:uk-uaos:windows10-2004-x64systemwindows - submitted
04/08/2026, 12:36
Behavioral task
behavioral1
Sample
BleachBit-6.0.2-setup.exe
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral2
Sample
BleachBit-6.0.2-setup.exe
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11ltsc2024-20260710-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
COPYING
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral8
Sample
COPYING
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
cacert.pem
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral10
Sample
cacert.pem
Resource
win11ltsc2024-20260710-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
etc/fonts/conf.d/10-hinting-slight.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral12
Sample
etc/fonts/conf.d/10-hinting-slight.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
etc/fonts/conf.d/10-scale-bitmap-fonts.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral14
Sample
etc/fonts/conf.d/10-scale-bitmap-fonts.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
etc/fonts/conf.d/10-sub-pixel-none.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral16
Sample
etc/fonts/conf.d/10-sub-pixel-none.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
etc/fonts/conf.d/10-yes-antialias.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral18
Sample
etc/fonts/conf.d/10-yes-antialias.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
etc/fonts/conf.d/11-lcdfilter-default.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral20
Sample
etc/fonts/conf.d/11-lcdfilter-default.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
etc/fonts/conf.d/20-unhint-small-vera.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral22
Sample
etc/fonts/conf.d/20-unhint-small-vera.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
etc/fonts/conf.d/30-metric-aliases.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral24
Sample
etc/fonts/conf.d/30-metric-aliases.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
etc/fonts/conf.d/40-nonlatin.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral26
Sample
etc/fonts/conf.d/40-nonlatin.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
etc/fonts/conf.d/45-generic.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral28
Sample
etc/fonts/conf.d/45-generic.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
etc/fonts/conf.d/45-latin.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral30
Sample
etc/fonts/conf.d/45-latin.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
etc/fonts/conf.d/48-spacing.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral32
Sample
etc/fonts/conf.d/48-spacing.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
General
- Target $PLUGINSDIR/modern-header.bmp
- Size 25KB
- Sample260804-ps7e3a1bjb
- SHA256 e44bfda2eb8eef9c72cb7fef16ce2f5c101f65ffe6e78ba2b8d9de8180dbb7fc
- MD5 f8d708785ed8811670399e2c003cb28b
- SHA1 972578017e49a6d5f70e8aacf82b3698981da0d2
- SHA512 a31afe31c0c17e13262389ef91f9aa93b55932a1f87e26a2b97d8837a24f0e9a486156b6dc25afd5252944aad3858e6d9f05892392aa108edc7a924dfc8c76e2
- SSDEEP 96:9KxmKN3J4z9b0iaeYj/LOggkKjCWvGzldO6a0Dr7+d:9K8k4x3vYj/LOg7TlzlYJ07+
- TLSH T10BC284F4E47A85DFE651A1BEED666404BDDA40E249882A4CF0079B70394B275217F88E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5420 mspaint.exe 5420 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5420 mspaint.exe 5420 mspaint.exe 5420 mspaint.exe 5420 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\modern-header.bmp"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5420
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:6000