Overview
overview
7Static
static
7BleachBit-...up.exe
windows10-2004-x64
7BleachBit-...up.exe
windows11-ltsc_2024-x64
5$PLUGINSDI...er.bmp
windows10-2004-x64
1$PLUGINSDI...er.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows11-ltsc_2024-x64
1COPYING
windows10-2004-x64
3COPYING
windows11-ltsc_2024-x64
3cacert.pem
windows10-2004-x64
3cacert.pem
windows11-ltsc_2024-x64
3etc/fonts/...ht.xml
windows10-2004-x64
3etc/fonts/...ht.xml
windows11-ltsc_2024-x64
1etc/fonts/...ts.xml
windows10-2004-x64
3etc/fonts/...ts.xml
windows11-ltsc_2024-x64
1etc/fonts/...ne.xml
windows10-2004-x64
3etc/fonts/...ne.xml
windows11-ltsc_2024-x64
1etc/fonts/...as.xml
windows10-2004-x64
3etc/fonts/...as.xml
windows11-ltsc_2024-x64
1etc/fonts/...lt.xml
windows10-2004-x64
3etc/fonts/...lt.xml
windows11-ltsc_2024-x64
1etc/fonts/...ra.xml
windows10-2004-x64
3etc/fonts/...ra.xml
windows11-ltsc_2024-x64
1etc/fonts/...es.xml
windows10-2004-x64
3etc/fonts/...es.xml
windows11-ltsc_2024-x64
1etc/fonts/...in.xml
windows10-2004-x64
3etc/fonts/...in.xml
windows11-ltsc_2024-x64
1etc/fonts/...ic.xml
windows10-2004-x64
3etc/fonts/...ic.xml
windows11-ltsc_2024-x64
1etc/fonts/...in.xml
windows10-2004-x64
3etc/fonts/...in.xml
windows11-ltsc_2024-x64
1etc/fonts/...ng.xml
windows10-2004-x64
3etc/fonts/...ng.xml
windows11-ltsc_2024-x64
1Analysis
- max time kernel
899s - max time network
563s - platform
windows10-2004_x64 - resource
win10v2004-20260513-uk - resource tags
arch:x64arch:x86image:win10v2004-20260513-uklocale:uk-uaos:windows10-2004-x64systemwindows - submitted
04/08/2026, 12:36
Behavioral task
behavioral1
Sample
BleachBit-6.0.2-setup.exe
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral2
Sample
BleachBit-6.0.2-setup.exe
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11ltsc2024-20260710-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
COPYING
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral8
Sample
COPYING
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
cacert.pem
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral10
Sample
cacert.pem
Resource
win11ltsc2024-20260710-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
etc/fonts/conf.d/10-hinting-slight.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral12
Sample
etc/fonts/conf.d/10-hinting-slight.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
etc/fonts/conf.d/10-scale-bitmap-fonts.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral14
Sample
etc/fonts/conf.d/10-scale-bitmap-fonts.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
etc/fonts/conf.d/10-sub-pixel-none.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral16
Sample
etc/fonts/conf.d/10-sub-pixel-none.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
etc/fonts/conf.d/10-yes-antialias.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral18
Sample
etc/fonts/conf.d/10-yes-antialias.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
etc/fonts/conf.d/11-lcdfilter-default.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral20
Sample
etc/fonts/conf.d/11-lcdfilter-default.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
etc/fonts/conf.d/20-unhint-small-vera.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral22
Sample
etc/fonts/conf.d/20-unhint-small-vera.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
etc/fonts/conf.d/30-metric-aliases.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral24
Sample
etc/fonts/conf.d/30-metric-aliases.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
etc/fonts/conf.d/40-nonlatin.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral26
Sample
etc/fonts/conf.d/40-nonlatin.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
etc/fonts/conf.d/45-generic.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral28
Sample
etc/fonts/conf.d/45-generic.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
etc/fonts/conf.d/45-latin.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral30
Sample
etc/fonts/conf.d/45-latin.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
etc/fonts/conf.d/48-spacing.xml
Resource
win10v2004-20260513-uk
windows10-2004-x64
Behavioral task
behavioral32
Sample
etc/fonts/conf.d/48-spacing.xml
Resource
win11ltsc2024-20260709-uk
windows11-ltsc_2024-x64
General
- Target $PLUGINSDIR/modern-wizard.bmp
- Size 150KB
- Sample260804-ps7e3a1bjb
- SHA256 947580be382ddf446f9548ea7e2e9402e32aae2ff65af4699e9a9dc55855491f
- MD5 013d31e76b08b61f2ca73e9b7ff32170
- SHA1 b36ca27e188e93b006d9fb5905e9b39365a52a68
- SHA512 6355ca62a03e86152ea5f461aaf23bf79d3b376c13ab5fd3f33beb0e9c7545d98bc3dbb01134b0665589dd984be81d71564fe1e3ab1d3aaa492559c8aa66d19b
- SSDEEP 768:5bGLTaEFntGN++/CQwJrt9kIWtuHLeoCxxe:eFn7Qw5otM
- TLSH T1D5E30BF490B884CFF6F726793D027160B8D754E623889689B083AED03D67365389DE5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1804 mspaint.exe 1804 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1804 mspaint.exe 1804 mspaint.exe 1804 mspaint.exe 1804 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\modern-wizard.bmp"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1804
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4384