Overview
overview
7Static
static
3h2_installer.exe
windows10-2004-x64
7$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...er.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3h2.exe
windows10-2004-x64
6Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/08/2026, 04:11
Static task
static1
Behavioral task
behavioral1
Sample
h2_installer.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20260513-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
h2.exe
Resource
win10v2004-20260513-en
General
- Target $PLUGINSDIR/modern-wizard.bmp
- Size 150KB
- Sample260813-esd4eazvcx
- SHA256 bb8ede461fd600fe8bff3e66df478790bd5eae1167ef78962bc50c0b2eb194fb
- MD5 6b9ccc8413c709409984b9830abc72ee
- SHA1 c93b1ab423e14c90123e2a3bd9cf261ed75ceac6
- SHA512 4d879ae1dbe3464af01186927236b67fb85173ad525aac2d63029ab1a5b16a4a93b904962ecc2660d973f00344bc99fb38c4a4e68aaddc977ba0e10108347dbd
- SSDEEP 3072:x65FFAVKFFFFZDnfhFSJjGZxaybEW+tJ+7bVi:8npFoaZUNWho
- TLSH T1B8E3091369C8D50EE4BE8433D2EBCA1DF352EE82AABD5E5615517AF6C114B0D3D3A0C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2488 mspaint.exe 2488 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2488 mspaint.exe 2488 mspaint.exe 2488 mspaint.exe 2488 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\modern-wizard.bmp"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2488
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:544