Overview
overview
6Static
static
12026101215...ar.zip
windows10-2004-x64
12026101215...ar.zip
windows11-ltsc_2024-x64
12026101218...ar.eml
windows10-2004-x64
62026101218...ar.eml
windows11-ltsc_2024-x64
6Comprobant...A,.png
windows10-2004-x64
1Comprobant...A,.png
windows11-ltsc_2024-x64
1email-html-2.html
windows10-2004-x64
6email-html-2.html
windows11-ltsc_2024-x64
6email-plain-1.txt
windows10-2004-x64
1email-plain-1.txt
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/10/2026, 21:29
Static task
static1
Behavioral task
behavioral1
Sample
202610121528_COMPROBANTE DE PAGO 9 DE OCTUBRE 2026_jaguilar.zip
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
202610121528_COMPROBANTE DE PAGO 9 DE OCTUBRE 2026_jaguilar.zip
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
20261012185130-COMPROBANTE DE PAGO 9 DE OCTUBRE 2026-jaguilar.eml
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
20261012185130-COMPROBANTE DE PAGO 9 DE OCTUBRE 2026-jaguilar.eml
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
Comprobante ACH-AET- POLY FIBRAS, S,A,.png
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
Comprobante ACH-AET- POLY FIBRAS, S,A,.png
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
email-html-2.html
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
email-html-2.html
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
email-plain-1.txt
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
email-plain-1.txt
Resource
win11ltsc2024-20260911-en
General
- Target Comprobante ACH-AET- POLY FIBRAS, S,A,.png
- Size 169KB
- Sample261012-1bv69aeg64
- SHA256 9a68a6277295896caffab39157542dfe5e2effb578c4e3982555240e5d392d5a
- MD5 e40e7dd6d5d3d4b8caec9312fe508eed
- SHA1 db5855af799dbb016efc21fad9217c0fe4dd016c
- SHA512 13509df61c4105778584cbc756235c7ded001f092d4ccd895b73ae237ad40fc3c6fcd8de8a1affd59ee6d53c45ba073f422ed472ec3163b4507f907253abd862
- SSDEEP 3072:NpKQZrVSt1+YiI/n1GULQ50kcr9r9Y3cEF1N2ZwUcuS7+zvoBdJKXGmbx9nAISj:NpKQDC1GwnBZusEPNLUc/7+6sbx9Yj
- TLSH T11F04F107DC7960FB7D470B94689A0116F9294AC0028DB6BEBF7616DE530A4B3DEA374C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3468 mspaint.exe 3468 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3468 mspaint.exe 3468 mspaint.exe 3468 mspaint.exe 3468 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Comprobante ACH-AET- POLY FIBRAS, S,A,.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:3404