Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/08/2026, 18:10
Static task
static1
Behavioral task
behavioral1
Sample
phish_alert_sp2_2.0.0.0 (1).eml
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
phish_alert_sp2_2.0.0.0 (1).eml
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
email-html-1.html
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral4
Sample
email-html-1.html
Resource
win11ltsc2024-20260710-en
10 signatures
150 seconds
Behavioral task
behavioral5
Sample
row_99_10.png
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
row_99_10.png
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target row_99_10.png
- Size 3.2MB
- Sample260805-wsavesdb38
- SHA256 15cdc1c04dce784905a0e68f47c5e6b589c62de695ea7c922d83ad9aa1e21ee8
- MD5 5d20583b6bb00a85d95fafa2bf4ca4c1
- SHA1 d9501fc6fededf5ccb282ae2b35a85f0c773bf49
- SHA512 4009622465c7d82530d796fa16642a5f92fea89226bffafe03fdea5a3dcfb1b5c6385d9e3327291809e5b48642d9c7770ef68a609f011f9f9ec1bbeb88679af5
- SSDEEP 49152:DNnUAjT4pile1jz1pledUVDQpQJdAH7x6eE+7vpbCBZ4BEqLFC8yV:DNnUAjsp2Iz1a4DhWbFDgBK6msxV
- TLSH T1F1F533EFE0B6A8B58D2CEABAC663BF04E79C561574527000B05447E92A074E2DED74CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4072 mspaint.exe 4072 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4072 mspaint.exe 4072 mspaint.exe 4072 mspaint.exe 4072 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\row_99_10.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4072
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4068