0ea46f8f83d8f96ff8b60afe2fddf03dc3c784947a29e5255f2fb47b21e2147e

Analysis

max time kernel
148s
max time network
78s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
faab602177ce7ce170217e9b860a141881cc6654d55fdf7f4c92052fa02a774f_comment-insertion.jpg
Size 64KB
Sample260913-rertkaztdy
SHA256 0ea46f8f83d8f96ff8b60afe2fddf03dc3c784947a29e5255f2fb47b21e2147e
MD5 6dde4a1d82d1c6785e0c5f7cb3a17ff9
SHA1 d42fe2caef09a5457347b518d264690ddbd57be0
SHA512 301e77db9cd462c4f64fe94824239ddc7f7c34c055f1f7e32809a434c635aa3ac11ccd073075d9682d29350959b8cf9432d032f3deb22492b456820076f97169
SSDEEP 1536:Boy2txMlDJ6z2robMsHdwZeQew/ayJXX3iDKKk:Boy2txe/robHdwZeQeNmyDKKk
TLSH
T12C5312046FE3AA7A007B4C12173ACD2B080A1D62964DB35B17BF95E8D87C937DE26D4C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4200	mspaint.exe
4200	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4200	mspaint.exe
4200	mspaint.exe
4200	mspaint.exe
4200	mspaint.exe

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\faab602177ce7ce170217e9b860a141881cc6654d55fdf7f4c92052fa02a774f_comment-insertion.jpg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4200-1-0x000002C7F3330000-0x000002C7F3746000-memory.dmp

Download