f4e8bc9aa8a5952ec8a70a4fe51e8e1ad05290f741021ec14f17de8a8d6fb40c

Resubmissions

08/08/2026, 15:27

260808-svx6yszapd8

08/08/2026, 15:24

260808-stan9sttbw3

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
image.png
Size 5.1MB
Sample260808-stan9sttbw
SHA256 f4e8bc9aa8a5952ec8a70a4fe51e8e1ad05290f741021ec14f17de8a8d6fb40c
MD5 762a4d53d3225e3e5246d951d6d737e0
SHA1 733472c248ff7c792dd6acc3877663289634d9c2
SHA512 bc2cc57a74d4766d1e83dd4c5205367c4fd168ddd2e3e2a12e6b6cf30de7bd3e84e7ebf773492d7e1c4a65cac663c37220b96a5c5dc3a04d377c7b08ce7a8352
SSDEEP 98304:XplMIKfmUkofm6W5JqEvbOKonaBCH9u8OVpNWv1332TaL24btFN2:XMZf4v6W5JPKai9u8OPNS3pDw
TLSH
T14F363368F1E64FF8D14B1B6FBA233A4C04E454B56B924B18473EE06CA27B7424D1BF58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3356	mspaint.exe
3356	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3356	mspaint.exe
3356	mspaint.exe
3356	mspaint.exe
3356	mspaint.exe

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\image.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:3128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3356-0-0x00000156A4A20000-0x00000156A4E36000-memory.dmp

Download