Analysis
- user interaction
yes - max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 02:05
Static task
static1
Behavioral task
behavioral1
Sample
26_10_KCJH3_55067.bmp
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
26_10_KCJH3_55067.bmp
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 26_10_KCJH3_55067.bmp
- Size 17.2MB
- Sample261027-ch8txsax9q
- SHA256 76283788894d2ac72e0233323d3e924e7d1d4dd116730ee9606c55576f7dfbc2
- MD5 b969c893233604912a4a548330521506
- SHA1 faaa2a6ca0c7a0a1d1666f8f138d0cf00f556776
- SHA512 26a95c6ff5c75b79505034761024ac1701abe0c8ef607c53f82ea42568d2d973aa6e90e9ef318a4f09a85c3faec0942a84796fc1c1a5466e1764409c43ecd892
- SSDEEP 6144:iJSvSf5mk3fqhh8i+bJ5fz55ls0ndWGh6iVEfUvl:iKSfdfqhh8i+b7WGh08d
- TLSH T19A07B49A2124C41E862379E5FD1DEB656E9E3D5F8328954D3B93BC1AB4B2347040FA0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2496 mspaint.exe 2496 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2496 mspaint.exe 2496 mspaint.exe 2496 mspaint.exe 2496 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\26_10_KCJH3_55067.bmp"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2496
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4244