Analysis
- max time kernel
898s - max time network
490s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
11/10/2026, 11:18
Static task
static1
Behavioral task
behavioral1
Sample
GTAVI_CE_CE_Map_1x1_Finalized_2160noise.png
Resource
win10v2004-20260911-en
40 signatures
900 seconds
Behavioral task
behavioral2
Sample
GTAVI_CE_CE_Map_1x1_Finalized_2160noise.png
Resource
win10ltsc2021-20260911-en
3 signatures
900 seconds
General
- Target GTAVI_CE_CE_Map_1x1_Finalized_2160noise.png
- Size 218KB
- Sample261011-ner8jsts7n
- SHA256 5471b072df127f8417338cb7eb0386c17eeb177771183695e994886fcfd44a05
- MD5 7bd8f0562ddbfaef4bea6e3682d8a3bc
- SHA1 2e2fabb46b50f546710fd4f0d297c3ee71316f27
- SHA512 c8ba0f1e3168d592335a95d76f0c6dff89880801a5924d80424bb7634f915e44b18f5425ce478490205741813b9ca9635f3fa1ee265aab5f6c3b71920a9db5d9
- SSDEEP 6144:JmatmQTU/Oi7xFrZDn19114jijgHITHCZ32zwrI:JmatpTU/Oi7p1z1rCKd
- TLSH T1AD2422F3FB58598ECD4561BC186C96510E99AEB1FBE20EC78E0633004C5E611A7BA1E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1531437071-3039716239-3530695936-1000\{1D21A08E-C935-4C88-A7E0-BD8A975C1770} mspaint.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5052 mspaint.exe 5052 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5052 mspaint.exe 5052 mspaint.exe 5052 mspaint.exe 5052 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\GTAVI_CE_CE_Map_1x1_Finalized_2160noise.png"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5052
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:2528