Overview
overview
10Static
static
10Installer/.ds_store
windows10-2004-x64
3Installer/.ds_store
windows11-ltsc_2024-x64
3Installer/...n.icns
windows10-2004-x64
3Installer/...n.icns
windows11-ltsc_2024-x64
3Installer/...Z8.png
windows10-2004-x64
1Installer/...Z8.png
windows11-ltsc_2024-x64
1Installer/...x:rsrc
windows10-2004-x64
3Installer/...x:rsrc
windows11-ltsc_2024-x64
8Installer/Terminal
windows10-2004-x64
3Installer/Terminal
windows11-ltsc_2024-x64
3Resubmissions
13/09/2026, 12:26
260913-pmpm3ayxcs13/09/2026, 12:24
260913-pk183sgl711013/09/2026, 12:22
260913-pj95laxaje1013/09/2026, 12:22
260913-pj4b2swhrh1013/09/2026, 12:21
260913-pjs63sbb391011/08/2025, 20:38
250811-zevjfst1gy711/08/2025, 20:37
250811-zemhvasjx81Analysis
- max time kernel
898s - max time network
829s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/09/2026, 12:22
Behavioral task
behavioral1
Sample
Installer/.ds_store
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
Installer/.ds_store
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
Installer/.VolumeIcon.icns
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
Installer/.VolumeIcon.icns
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
Installer/.background/qajhnZ8.png
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
Installer/.background/qajhnZ8.png
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
Installer/Installer.wux:rsrc
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
Installer/Installer.wux:rsrc
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
Installer/Terminal
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
Installer/Terminal
Resource
win11ltsc2024-20260911-en
General
- Target Installer/.background/qajhnZ8.png
- Size 14KB
- Sample260913-pj95laxaje
- SHA256 1406aaab759f279c001318862fd65d60198a41fbc537bbc868f3d1b80de08419
- MD5 f74061988e2636f33e583d045043ea3d
- SHA1 bfc215f3cadd167fa7f275c5789fa9cf7d5a0e08
- SHA512 e8cbff036ad5c83f424526a27022382e28cfea386ec70184ee58d03c8ef745ec63d2a754eb9b91836cbc865e3f557fdb078a3e2e82a27c35b4b957d4144e92e5
- SSDEEP 384:Rk+Ng5tjI/Th7AFBpGGF6Bzg72c29Z7T9UL7B5t:/y5tE/TyFBEGg1TVjq7B5t
- TLSH T1C762B6F441BD8109FE66E2F0496D236E94E8073738A28471DB39EA5591F15C3FA7E823
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 628 mspaint.exe 628 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 628 mspaint.exe 628 mspaint.exe 628 mspaint.exe 628 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Installer\.background\qajhnZ8.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:628
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:3852