Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 19:34
Static task
static1
Behavioral task
behavioral1
Sample
images.jpg
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
images.jpg
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target images.jpg
- Size 37KB
- Sample260808-yaa4kstcnd
- SHA256 fe05b687581dcbf82988459f4657ce5ab61c1fdf24660d5be8cf48503a90b9e5
- MD5 1a0982148d89b0b00bafb585ba80c817
- SHA1 064664d1950b97dbc9038eef1ff7522ddf34bc33
- SHA512 e1d1d2fb02386e02839588d9a09708dcf57c352c2cd3f3fde249e0eda9fe2f94eeaa2570c479484f18607642ccd8b7bac77dc9886a3349ef339f01bd4bb7c7cc
- SSDEEP 768:kQs1yXaarYYRWQdrAb+l0+5xqCzhrlmi/hL9QqMx/82kqwf262a5VEhz9567m:kQdaakmFrAbEv5AClrlmi/hKDx/zklf2
- TLSH T1FA03E131C9766F98BF9C162FE07519990B5383989179B2CC27A73F05DA2FE04D60D2D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4356 mspaint.exe 4356 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4356 mspaint.exe 4356 mspaint.exe 4356 mspaint.exe 4356 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\images.jpg"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4356
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4492
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2612