Overview
overview
7Static
static
3h2_installer.exe
windows10-2004-x64
7$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...er.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3h2.exe
windows10-2004-x64
6Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/08/2026, 04:11
Static task
static1
Behavioral task
behavioral1
Sample
h2_installer.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20260513-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
h2.exe
Resource
win10v2004-20260513-en
General
- Target $PLUGINSDIR/modern-header.bmp
- Size 25KB
- Sample260813-esd4eazvcx
- SHA256 e06379a83e45d87ee9c9494ff8745ca92d519838af655f8e73b444a6697761e0
- MD5 5f9a96b5fa141206c22424640c8a26e2
- SHA1 93ed2869f3840d5096544d0e131a13f6d7a5cdd7
- SHA512 990d7fe21f0d4794adaa7f8be34ecbf987ddb1ead10db66cc7ce95755385515dcc17d1fb013aed41cf4cd446bb096f2ecef1a0e6d43cbff47dbce78afff50c37
- SSDEEP 192:9n0/IQPZ9kanC2KVVOSzW457RGerD9o4VI7E+rSnkhq+N/rwWkdqrXgQhsV0utLr:exBeOS6454WoQOrZOPdqTgQugE
- TLSH T17AC25FE926623D83B8E021F48DFE9D67346CE35319CB8920A575E7FC1240AF680E1D9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3680 mspaint.exe 3680 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3680 mspaint.exe 3680 mspaint.exe 3680 mspaint.exe 3680 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\modern-header.bmp"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3680
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:1132