Analysis
- user interaction
yes - max time kernel
153s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/08/2026, 12:27
Behavioral task
behavioral1
Sample
Ihre Unterlagen AS-9311002026 163945284.msg
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Ihre Unterlagen AS-9311002026 163945284.msg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
Versicherungsschein_AS-9311002026_163945284_Ausstellungsdatum_26-08-2026_seekirchen@frigologo.at.pdf
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Versicherungsschein_AS-9311002026_163945284_Ausstellungsdatum_26-08-2026_seekirchen@frigologo.at.pdf
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral5
Sample
logo.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
logo.png
Resource
win11ltsc2024-20260709-en
General
- Target logo.png
- Size 13KB
- Sample260826-pmxnnsyfqa
- SHA256 8fdf844076fd4a01b22fe8ea8eea9e375ffc4035fc8bd3bb87de756c700ada5c
- MD5 076738d1aa02b52d30831fd789cf9ccf
- SHA1 3a19413f3c94b76c187575ed490df126f87ebc47
- SHA512 f9a981a4aaa638676d92a56e6f89a5b1c37e3f9159dcfc5f44c7dc6a3506ffc7b03f067c3242b20a8c104df6b3f4f8f78f06d75af67ffba0875c9fd26e2bbe1c
- SSDEEP 384:zj7x9GWn/wqqYqNG4RjY+vjz90YYs+KD9e2YIRY:zj7xMWnYqqNRjjuYd+WNe
- TLSH T15B52B090E970CCE5C41AA13728DCDDFB6631BB2A06D743DE6F766F407C6342B590A054
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4812 mspaint.exe 4812 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4812 mspaint.exe 4812 mspaint.exe 4812 mspaint.exe 4812 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\logo.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4812
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4000