Analysis
- max time kernel
898s - max time network
473s - platform
windows10-2004_x64 - resource
win10v2004-20260911-es - resource tags
arch:x64arch:x86image:win10v2004-20260911-eslocale:es-esos:windows10-2004-x64systemwindows - submitted
23/09/2026, 14:35
Static task
static1
Behavioral task
behavioral1
Sample
RV NRO. 15001505100320196799680 DESARCHIVO DESPACHO JUDICIAL JUZGADO ADMINISTRATIVO 12 -.msg
Resource
win10v2004-20260911-es
Behavioral task
behavioral2
Sample
RV NRO. 15001505100320196799680 DESARCHIVO DESPACHO JUDICIAL JUZGADO ADMINISTRATIVO 12 -.msg
Resource
win11ltsc2024-20260911-es
Behavioral task
behavioral3
Sample
Re comprobante.duplicado.Tutela-Cierre-Decomiso.xhtml
Resource
win10v2004-20260911-es
Behavioral task
behavioral4
Sample
Re comprobante.duplicado.Tutela-Cierre-Decomiso.xhtml
Resource
win11ltsc2024-20260911-es
Behavioral task
behavioral5
Sample
image001.png
Resource
win10v2004-20260911-es
Behavioral task
behavioral6
Sample
image001.png
Resource
win11ltsc2024-20260911-es
General
- Target image001.png
- Size 6KB
- Sample260923-rybxfswt6p
- SHA256 9803c1a07a66da0cb84e486b2ba4020d046f919101762a3e30be90b34a097e2a
- MD5 9aca27524ac094b7022f44d18cdd8b55
- SHA1 d5d7f9ddab97fbf071c3926da9ecac2d7c8756c5
- SHA512 27f3fc51de57a5ab40a6cddf68fe24007d79bc71117b651d00263a05b23fb487128aae3395da9806ca3154e00f3dd0a45ee3f52b425a2acbc9b62f450d9878e0
- SSDEEP 192:j2Xu9D4/UcEXT0oULdDaEFzGMGcroilklT5GT:j7Dd0ocDaKzdhoiOlT50
- TLSH T155D19D912422D02E973DC527A056B38AB1370F941AB97B08F51EEF1824C59C70FDB8DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1740 mspaint.exe 1740 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1740 mspaint.exe 1740 mspaint.exe 1740 mspaint.exe 1740 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\image001.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1740
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:5696