Analysis
- user interaction
yes - max time kernel
59s - max time network
64s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 03:50
Static task
static1
Behavioral task
behavioral1
Sample
@LinkFilesBot.jpg
Resource
win10v2004-20260513-en
3 signatures
900 seconds
Behavioral task
behavioral2
Sample
@LinkFilesBot.jpg
Resource
win11ltsc2024-20260709-en
14 signatures
900 seconds
General
- Target @LinkFilesBot.jpg
- Size 6.2MB
- Sample260808-ed3s8azcla
- SHA256 7481d0eac1a5677070b16dcdefd80d8b2b22208c85ee7edb00ecfc6b54e74bb9
- MD5 c402bb6a5f409e67d812a7c612c40041
- SHA1 21813942cfe59f776c6f47a35bec289705cfe51b
- SHA512 d38c78a8e1415d774cbbece0d54dffb29a0f21cc06629325435838df4df38cc60692141b6ee4095037ef0d08d91928ae03b3614f72459dff5e2469f52c85b509
- SSDEEP 98304:tO6+Bz5wgBRl33iLZPGnZjOnvdgXgpjcF4tDmQ3mHBeTfrpxitYwx+:t6BlLRsLcntXgWF4tDlmHBAftItBx+
- TLSH T17F5633422E7C30A6D291997108F31284AA34CF31FAF971D7F6066C25DF84B5A961DEE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3840 mspaint.exe 3840 mspaint.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3840 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3840 mspaint.exe 3840 mspaint.exe 3840 mspaint.exe 3840 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\@LinkFilesBot.jpg"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3840
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:3444