Analysis
- user interaction
yes - max time kernel
298s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 18:56
Static task
static1
Behavioral task
behavioral1
Sample
WhatsApp Image 2026-09-25 at 11.48.12 AM.jpg
Resource
win10v2004-20260911-en
2 signatures
300 seconds
Behavioral task
behavioral2
Sample
WhatsApp Image 2026-09-25 at 11.48.12 AM.jpg
Resource
win11ltsc2024-20260911-en
3 signatures
300 seconds
General
- Target WhatsApp Image 2026-09-25 at 11.48.12 AM.jpg
- Size 216KB
- Sample260925-xlcacathpg
- SHA256 4f38ebeaae6c566416a2661a825a11a12079ff826809907990d3c636da2689cc
- MD5 20e114550b890fe52a27dd781de46770
- SHA1 93f4cbb9f131b119c97b460a6e12c3752a9d8576
- SHA512 b0e6c713d01560e16050349be685d1789ca40ee6a02d8d14ec5f95ec148d078ba0c375a74bbabd0b417d5d17381184fb1d8a0b1cdcf6f235a3617269f095e458
- SSDEEP 6144:uoD9S9lB0+jSQwYMaJVVXr9y6hL4Lxt1Yi:HhMjSlahg1Lj
- TLSH T11324122DDEE4CCCCF68FA631648EE39D546B089A16B6478FC15076E4FACE0429C356E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 360 mspaint.exe 360 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 360 mspaint.exe 360 mspaint.exe 360 mspaint.exe 360 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\WhatsApp Image 2026-09-25 at 11.48.12 AM.jpg"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:360
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4608