Analysis
- user interaction
yes - max time kernel
20s - max time network
13s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 16:10
Static task
static1
Behavioral task
behavioral1
Sample
images.jpg
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
images.jpg
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target images.jpg
- Size 29KB
- Sample260925-tmpqaa118q
- SHA256 92630cc2ba54a844156e5c07fcbb6a944e5a11d6cb325aafbe645100f3822516
- MD5 f16076a526a6c82f4ee1822366efbef9
- SHA1 43f7da7252824b43ec2aa7daafb009d4a5a99cf3
- SHA512 02e528851e1f44c56131e446aac981ad2af5ab64b80bdc3896356293be693f95bab379156e89b3302b06167d1e4e46d88e78feb96f076211210ee5f0f1a28a29
- SSDEEP 768:bx+y78pckwogFQZJHcr/iRGs9B+ZsCq8/bM:NXwlCFQZJA/fs9QZrqcbM
- TLSH T175D2F14D9FC1C9EA49C95025E4B4E8102A1BC43FDCA615A8A6E5B0779CB8F285F34FC6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4984 mspaint.exe 4984 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4984 mspaint.exe 4984 mspaint.exe 4984 mspaint.exe 4984 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\images.jpg"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4984
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:1780
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3360