Overview
overview
3Static
static
1Fraude.eml
windows10-2004-x64
1Fraude.eml
windows11-ltsc_2024-x64
131117.jpg
windows10-2004-x64
131117.jpg
windows11-ltsc_2024-x64
1email-html-2.html
windows10-2004-x64
3email-html-2.html
windows11-ltsc_2024-x64
3email-plain-1.txt
windows10-2004-x64
1email-plain-1.txt
windows11-ltsc_2024-x64
1Analysis
- max time kernel
899s - max time network
391s - platform
windows10-2004_x64 - resource
win10v2004-20260513-es - resource tags
arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows - submitted
10/08/2026, 05:58
Static task
static1
Behavioral task
behavioral1
Sample
Fraude.eml
Resource
win10v2004-20260513-es
Behavioral task
behavioral2
Sample
Fraude.eml
Resource
win11ltsc2024-20260709-es
Behavioral task
behavioral3
Sample
31117.jpg
Resource
win10v2004-20260513-es
Behavioral task
behavioral4
Sample
31117.jpg
Resource
win11ltsc2024-20260709-es
Behavioral task
behavioral5
Sample
email-html-2.html
Resource
win10v2004-20260513-es
Behavioral task
behavioral6
Sample
email-html-2.html
Resource
win11ltsc2024-20260709-es
Behavioral task
behavioral7
Sample
email-plain-1.txt
Resource
win10v2004-20260513-es
Behavioral task
behavioral8
Sample
email-plain-1.txt
Resource
win11ltsc2024-20260709-es
General
- Target 31117.jpg
- Size 385KB
- Sample260810-gn844ack51
- SHA256 99eeaa795deea0e7387e390725cfaf9c2d02617ad89b4e47ff10cdcd4b0f1119
- MD5 c483bd4668d39335a0d7314435bbc76e
- SHA1 88bfee3fd654bf9e96bfc37e16e6330cd254ddb3
- SHA512 b2ab613f09409e4f98deb9a118e082c773d1ab5371206319afda62a242fbec1b61170b6b082337c85e8da96f1e5059b1d676a14b380add67a7114216db05f786
- SSDEEP 6144:GmIAIOMET6HOj2JHuc28st5KPS0m0lCjO2Nq55oYEDFYarFlhFjA5GQp+T897FXK:GhAQjic2rCPM6uqsFuarFlPQo8K
- TLSH T1128422E686E57545C7984BBB89C8031ED017012DEE49926D3B0B37A8ECF52D1ED21E78
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4960 mspaint.exe 4960 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4960 mspaint.exe 4960 mspaint.exe 4960 mspaint.exe 4960 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\31117.jpg"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4960
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4572