Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/10/2026, 13:51
Static task
static1
Behavioral task
behavioral1
Sample
phish_alert_sp2_2.0.0.0 - 2026-10-23T154307.612.eml
Resource
win10v2004-20260911-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
phish_alert_sp2_2.0.0.0 - 2026-10-23T154307.612.eml
Resource
win11ltsc2024-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
EmailSignature.png
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
EmailSignature.png
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
email-html-1.html
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral6
Sample
email-html-1.html
Resource
win11ltsc2024-20260911-en
9 signatures
150 seconds
General
- Target EmailSignature.png
- Size 251KB
- Sample261023-q54elsda47
- SHA256 16d1067a46d36af11cf54e45a59fef6271d33706e66827dcebe22160ce7db791
- MD5 7c622897f6402656ad455e089373965d
- SHA1 1d9024b2268b77e281b9cc55454dd7e2050c3121
- SHA512 86871e7d7a7f15ab4d45266ba2ef5550fbb822bdb5be5d476140b91998f9a9b226cfb88e68dd4ccf7bdc7a374323c48946a8a2e16958028ce20efa871eae080d
- SSDEEP 6144:UUooX4+UfBHyTq9kO5xJesZTjfauBU/t3ZQnaEHfy47sUgf:UUn8VyT/O5fnfaEU/Wydf
- TLSH T13F4412C9C7B7430FF5BEB44695B3238C6AA26B0148EB6907C35BD76D778A0C2994BC04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3880 mspaint.exe 3880 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3880 mspaint.exe 3880 mspaint.exe 3880 mspaint.exe 3880 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\EmailSignature.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3880
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4024