d15ea53e82bba39f8e013d0b9df57125694c5e1f69e2dfd812adc054114d16a2

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
peakethe.gif
Size 1.0MB
Sample260818-v1ye1syset
SHA256 d15ea53e82bba39f8e013d0b9df57125694c5e1f69e2dfd812adc054114d16a2
MD5 e821b202cbe8c20d2ba56e78ad545f38
SHA1 815efd4b20b2f7a6f35251152937a21cbb4a39e1
SHA512 f32dd74d7eed662e26bc2a0a3d6f2d234c901f5081d2236ceaca9c94a24c2bb3090d18c30688f5b44feffd50cad158f58d8cfe5d46b0f7fedb6872b5b9f0d915
SSDEEP 24576:y52eU+L9c4w+l9MQTjDe40Swu0y7m7q/U0k1iCwcrIDWC1Mog:y9c4w+l6+jCFBuz7//U0uwX35g
TLSH
T14B3533084F4D7BE7AA8A912C72D3BA705C381DE5BA51A409A755A42DE4C34BC30DCDFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2292	mspaint.exe
2292	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2292	mspaint.exe
2292	mspaint.exe
2292	mspaint.exe
2292	mspaint.exe

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\peakethe.gif"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:3468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads