Overview
overview
8Static
static
1NtXvquxLuT...1Z.eml
windows10-2004-x64
1NtXvquxLuT...1Z.eml
windows11-ltsc_2024-x64
1attachment-3
windows10-2004-x64
3attachment-3
windows11-ltsc_2024-x64
8email-html-2.html
windows10-2004-x64
3email-html-2.html
windows11-ltsc_2024-x64
3email-plain-1.txt
windows10-2004-x64
1email-plain-1.txt
windows11-ltsc_2024-x64
1invite.ics
windows10-2004-x64
1invite.ics
windows11-ltsc_2024-x64
1Analysis
- user interaction
yes - max time kernel
898s - max time network
877s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/07/2026, 08:12
Static task
static1
Behavioral task
behavioral1
Sample
NtXvquxLuTDituQDIq4QSNr9XrXPdOnT_2026-07-20T08_10_34.261Z.eml
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
NtXvquxLuTDituQDIq4QSNr9XrXPdOnT_2026-07-20T08_10_34.261Z.eml
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
attachment-3
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
attachment-3
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
email-html-2.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
email-html-2.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
email-plain-1.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
email-plain-1.txt
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
invite.ics
Resource
win10v2004-20260513-en
windows10-2004-x64
General
- Target invite.ics
- Size 1KB
- Sample260720-j4cryady3x
- SHA256 5e23509c8272bd080a1fd4ed157aaf73c4666cd2718fdd7b5b4a2f1380a640e7
- MD5 10613ca8142fcf03bc8825b4b9289174
- SHA1 bad2cd35871f5c92b999ee0cf65f872c7c1a6be2
- SHA512 89ed58c6c0b6c3b8feaacea9b2fa6b055ecf0d3b669d827a4da783cde42cb405511e3787bd878cb3b4ad3fbd7d37b91e8123b97833d27000f02e22a9ef015ee7
- TLSH T1FA31538B75E403AB83C7DA6C3864B378F57E24DEACC8D95C600176220491C1CD27BC19
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OUTLOOK.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OUTLOOK.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OUTLOOK.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001" OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" OUTLOOK.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5360 OUTLOOK.EXE - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE - Suspicious use of SetWindowsHookEx 58 IoCs
pid Process 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE 5360 OUTLOOK.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /ical "C:\Users\Admin\AppData\Local\Temp\invite.ics"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5360
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4e4 0x3241⤵PID:1116