Analysis
- user interaction
yes - max time kernel
84s - max time network
69s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/11/2026, 18:52
Static task
static1
Behavioral task
behavioral1
Sample
midnight.png
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
midnight.png
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target midnight.png
- Size 1.8MB
- Sample261110-xjaczaaa58
- SHA256 8ab166d98ca5e1587bb5c603dffb650e463df856a312b6770705ccc48ddc37e9
- MD5 663c061ed5d77899f9b51dcd33e0b932
- SHA1 6842f9f098de2b78005091444a154d30c9d501ae
- SHA512 a5d7250794b9c0c5c22fd4e28a0afc5fa8ab6f3b1f06ab431a48346a5c85094f39e01560999407849095286e94f29eed707279591978202157674e128855ba82
- SSDEEP 49152:gMC7dqH6aJb+gcATdIi/CzOhcX+6FxpNWjkGZz9EgmJM:gboai+gcYdIi/CzOhTIxpip9HmO
- TLSH T19B8533F9AB19490BC99E16F4F8FD0B99F83032EF32050E41583741565266BC4F729ADB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4920 mspaint.exe 4920 mspaint.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4920 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4920 mspaint.exe 4920 mspaint.exe 4920 mspaint.exe 4920 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\midnight.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4920
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:1684