Analysis
- max time kernel
150s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
Message.eml
Resource
win10v2004-20260911-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
Message.eml
Resource
win11ltsc2024-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
ba821ae0-29bb-435f-b9c2-b795c79fdbf1.png
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
ba821ae0-29bb-435f-b9c2-b795c79fdbf1.png
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
email-html-1.html
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral6
Sample
email-html-1.html
Resource
win11ltsc2024-20260911-en
9 signatures
150 seconds
General
- Target ba821ae0-29bb-435f-b9c2-b795c79fdbf1.png
- Size 3KB
- Sample261002-s78s8avelf
- SHA256 0a9e89001f52351cfc61df359d569c1a5f730b3a195d70bb0c51c0a4d2800673
- MD5 ef971f0a20d0d378de0740921c43aca9
- SHA1 af6775d1aff8c1ffa484f970b3c5dc6566f20c36
- SHA512 b71c8827776142945aea8602eff3c409675b933cc1d01a6af8b836e622e3c1b76f91e7f7583fe2a9fb6b196ea4b97f01746d81f336cb705f3df177365785e934
- TLSH T10B716EDB3162C0A859C83A3C91EC5A3E435D0B924343035F92FDC96854D5AD26E2975B
- MD5 SHA1 SHA512 TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4668 mspaint.exe 4668 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4668 mspaint.exe 4668 mspaint.exe 4668 mspaint.exe 4668 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\ba821ae0-29bb-435f-b9c2-b795c79fdbf1.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4668
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:3836