Analysis
- user interaction
yes - max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/10/2026, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
Screenshot 2026-10-26 9.20.14 AM.png
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Screenshot 2026-10-26 9.20.14 AM.png
Resource
win11ltsc2024-20260911-en
21 signatures
150 seconds
General
- Target Screenshot 2026-10-26 9.20.14 AM.png
- Size 79KB
- Sample261026-srdyxaey21
- SHA256 379fddac0b72e1dafeb380f5f152402c07d669d2c816f91d8518f03085e78e64
- MD5 a947a3340a65e63ef7e691a88117a880
- SHA1 49e6bccadc998d4230e559812ed889aaed52a27f
- SHA512 e4096bab3dbf525d6fa57f729ec2f88021bbb9fe9bc54a9a511b420ec92e5b795d7e587e927d44e8f55a12fa34d3cb86ece2d503240319a4909324d24b19892d
- SSDEEP 1536:qRNFsqntmKzRbHvhJrgVE4MnE0MmE0MnE0gnE0UnFvFAOuCkLFD/KkAzJ:qRv20DvHrgGBE1r1EREIOhKFDikAF
- TLSH T11B83F13EF97DAE54B245F5355A83AC524CE28FCBCAC1330E34F5C59E6A0A26236C4497
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3580 mspaint.exe 3580 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3580 mspaint.exe 3580 mspaint.exe 3580 mspaint.exe 3580 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Screenshot 2026-10-26 9.20.14 AM.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3580
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:3604