Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 14:08
Static task
static1
Behavioral task
behavioral1
Sample
_SUSPECTED SPAM_ ATENCIÓN_ ¡¡¡Notificación de error del servidor de Gsi!!!.msg
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
_SUSPECTED SPAM_ ATENCIÓN_ ¡¡¡Notificación de error del servidor de Gsi!!!.msg
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
6tbMsEzufI3NgRapMqnNl4c2.png
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
6tbMsEzufI3NgRapMqnNl4c2.png
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
image.png
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
image.png
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target image.png
- Size 1.4MB
- Sample260910-rfp2csysgw
- SHA256 49af333822dc9db21bb7d6a2f5df0c48afe42bcb81ad579a844f2079c938d28b
- MD5 a65d43d5a13b2003eb2f72c960cf48db
- SHA1 7dc05ae9f59c109866cc7f27b522959f2baeca96
- SHA512 2d9af31c6e5057d07be79148fc7d25e498ed055239d3f0109289c17a9a3c832443704319c76a596de29f7a7e912ba1173782f393d7aaf8086cd18eaea47b1ed5
- SSDEEP 24576:NBk2TD8+xuGPP0sg6t/V19nR+RIsI6lCUxSQP7ADTxtL3liJ48BYsh84AWsT2fyl:FYWLPP/dVJGIsI6lCqLUDTxDoGsi4AW6
- TLSH T11C653339A867C0C9CCAB393E3E94C87E0B0980675D4A4934761DD519AF0576CA8CEFDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1288 mspaint.exe 1288 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1288 mspaint.exe 1288 mspaint.exe 1288 mspaint.exe 1288 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\image.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1288
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:3372