Analysis
- max time kernel
149s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/09/2026, 13:10
Static task
static1
Behavioral task
behavioral1
Sample
2026-TKLFTLP-35163.msg
Resource
win10v2004-20260513-en
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-TKLFTLP-35163.msg
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
Statement Of Work.docx
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
Statement Of Work.docx
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
image2dc0e5.jpg
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
image2dc0e5.jpg
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target image2dc0e5.jpg
- Size 11KB
- Sample260903-qeskeshd96
- SHA256 8e4f7bac491f2b12c80eebdd3538f8ea33db10aba42132016dd2b64091cb2159
- MD5 3c0621f608d14dcbdabd50a4d8e16c37
- SHA1 308171dfbaa75ef856ae6bc037763151fb4ebd21
- SHA512 3c865bfc24043e182b57a2c4a78cd367622c389d68faa47827326681ab40a276b35ff47e44b3a8fc4aac4d9e29bdbfccac532823ab59a1b59157a60bbc733aad
- SSDEEP 192:ZBJqUk0XIhcTkX6yfjmK4jE6ul6S2nh8Nsws7RcJnFH9yHxJ/ycmKr0AX4fUrnv0:khcTkXlfJ4jEtlCh7dkHyRJ/J5JX4lXb
- TLSH T11D425B122B336E5AD6F20A721705AFEA814C361FD5EB064A6C58C91FF483D9F248FB05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4664 mspaint.exe 4664 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4664 mspaint.exe 4664 mspaint.exe 4664 mspaint.exe 4664 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\image2dc0e5.jpg"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4664
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4732