9b438d1eb444bef09dc403252bf4349f0d5b85a536be61fdf78ae78af66f507b | Triage™

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
skybox\sky_dn0001.bmp
Size 12.0MB
Sample260924-bcztdsys2l
SHA256 9b438d1eb444bef09dc403252bf4349f0d5b85a536be61fdf78ae78af66f507b
MD5 72faae3f10518439ac906d6ad4316a2a
SHA1 ef2116a95dc0321a796f095c30f3cea58ade22e7
SHA512 3172994c5caf5784fd5bb8aa68e5c131bef80dacf9092e732fcc568357672e5465eedb88bb0f446b1e3c5f1b28653b7e367ccdabbeaa09c19cc92ee78ea0532e
SSDEEP 3:elbtlllunlllfku3:Rl/8u3
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3388	mspaint.exe
3388	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3388	mspaint.exe
3388	mspaint.exe
3388	mspaint.exe
3388	mspaint.exe

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\skybox\sky_dn0001.bmp"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads