27f7f8bc80bd66138a741839c13166b716f2325f0c025bec1a9c3e71e641a10f

Analysis

user interaction
yes
max time kernel
20s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20260513-es
resource tags

arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
20/07/2026, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Contestação transações não autorizadas cartão de crédito.eml
Size 2.0MB
Sample260720-tcxcdahs2s
SHA256 27f7f8bc80bd66138a741839c13166b716f2325f0c025bec1a9c3e71e641a10f
MD5 5372d057ace5b4ba8ab25245f4f77b73
SHA1 4a72c29089d8661792db61d098fe4a1b9de19f0f
SHA512 8b26d19dd64506a945381c7c4003b7fd2e4a9a80029e6ce93e5209f38895fed86060c50722ff8fe63062c5ed7fed20e800f94eb98d47ff088e9088ae4dd30a74
SSDEEP 24576:RolJadDzkqpaXJyemTqYQnObR/X8auan/kA4zK36LQ2vm9dXT0J5V3erDmM/1YoY:RKJYz0oN1/t9zo5F+mSuzgcb
TLSH
T1939501359E4C12C4BA208AADE40F687452AB5A03599125ABF3B746D7FD9C3D14323FCE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware spyware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\E7W2Y7FJ\Screenshot_20260720-143200_Messages.jpg:Zone.Identifier	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\E7W2Y7FJ\Screenshot_20260720-143046_Messages.jpg:Zone.Identifier	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\E7W2Y7FJ\Screenshot_20260720-161239_Messages.jpg:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\E7W2Y7FJ\Screenshot_20260720-135913_Messages (002).jpg\:Zone.Identifier:$DATA	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\E7W2Y7FJ\Screenshot_20260720-135913_Messages.jpg:Zone.Identifier	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\E7W2Y7FJ\Screenshot_20260720-135829_Chrome.jpg:Zone.Identifier	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\E7W2Y7FJ\Screenshot_20260720-144206_Messages.jpg:Zone.Identifier	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3884	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3884	OUTLOOK.EXE
3192	OpenWith.exe
3192	OpenWith.exe
3192	OpenWith.exe
3192	OpenWith.exe
3192	OpenWith.exe

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Contestação transações não autorizadas cartão de crédito.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3884

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Screenshot_20260720-135829_Chrome.jpg

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\E7W2Y7FJ\Screenshot_20260720-135829_Chrome.jpg
Size 345KB
SHA256 27efa471c646cb6973bd34f41b47f036cd9e560ba3645700e3dd729381c07d9f
MD5 b55c07053d31a2c83e0653e90f8a727d
SHA1 edab03e12f815deb04ee45a387a1f05b7d51c8a6
SHA512 0816a1b666123ce1342f2fce173ff407754cb10be822691ea4e41ebd5362db20bf33b3696ff1fdeff96a527c11fdc87fe69bcccdac65b3555228712e65e2629d
SSDEEP 6144:Lz5kCfcpVt5g+qLVxpGv9FXV4lqSr6edoIhy4TmNjLxLDcl8jiOwGZ:Lz5vfoxmD8v9RVsqe6eJg4qDcci7y
TLSH
T1FB74F1CD38367B4A514A163D872624CD5BADA3DD6753FE78714FBC64EA00E806227F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Screenshot_20260720-135913_Messages.jpg

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\E7W2Y7FJ\Screenshot_20260720-135913_Messages.jpg
Size 229KB
SHA256 3345a1fa530c979e00242e1042c208057f47563dfb00a701c3d11ec14060eee7
MD5 e5e7fd83af4d5a4f63a6dcd27bc1556d
SHA1 475d34c13f1feec038f84b767ed8b277da44a70e
SHA512 d1d3195656a0a3b5fc08530b6bd6184614ff5bbd105c22c3ee8ff10c9da9b9e407a5e0c551ebede82ef82cf8076af750397f5049332071c2324749a1197ced3b
SSDEEP 6144:MLzG1ETs1qLWmpS46GGSb95zoOoz+1/pxIJyM:Iy+Y4HSipTE+Fp2JyM
TLSH
T18E34D0E48C1E4AB185894E23DB74970B64156139F86AD30F8B270BBBE54FE47D8E58F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Screenshot_20260720-143046_Messages.jpg

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\E7W2Y7FJ\Screenshot_20260720-143046_Messages.jpg
Size 227KB
SHA256 aec63f3d5bc1495a46f4029cbf748231dacdff7db56730ea369f2aa0ee11c653
MD5 8d51923855bae7d941c0e15b68aefe10
SHA1 98aff2338dc34ba60ea048624e8a7beee0156e17
SHA512 6daf6878a84e5c072fdf71d0e1b59365321639301b68e118165767fe128a3039d90bf038d742366a596beef03099a695be5b499fc8064cf8252bd9e8ecc61a52
SSDEEP 6144:0NgtJaDX5Oqhy4Vz7zDysE3Vd3hoE7RUa84O0rW:0NvgqhzDFElgKO0i
TLSH
T10834DFE98C5D4AB1D5908CA7CB30975E6119617AFC6BCB1F8A1207ABE10FC53CC924F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Screenshot_20260720-143046_Messages.jpg:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\E7W2Y7FJ\Screenshot_20260720-143046_Messages.jpg:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

Screenshot_20260720-143200_Messages.jpg

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\E7W2Y7FJ\Screenshot_20260720-143200_Messages.jpg
Size 201KB
SHA256 6c0297b831a58ac441f2088919cc49824f5c6c39cdcc838fc9bb96c80f4c52b2
MD5 cb1d86d71452380deb23df4ab805fb4f
SHA1 94174fed8a99f20aa02450eb3d3abe581468e5a5
SHA512 d01e50a264d69749e9f19b6f896d6e46cd771015268370c4318589a3443379170743f8e7c7a9ca2b83f5baa005f2758e566037505cda7ff73857678bc90fac28
SSDEEP 6144:XnZfw0R7tr5nmR1L/TLV9mHJqMJibCsUWF:pfbpr5nyb3+Y
TLSH
T19714DE7BAD04367D2622895FD50CDF696D0772FCCD9BA8B046B6316F70A4F9B2272006
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Screenshot_20260720-144206_Messages.jpg

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\E7W2Y7FJ\Screenshot_20260720-144206_Messages.jpg
Size 219KB
SHA256 0524ff1deb7d6e3b7f6d0499730b83d2327a8ee5ce044c04d3e9858644d6a2d1
MD5 0d33f3c814154eeb47c46e5f4f793e56
SHA1 bd511ed0815b4b8555f63539e91c859d3bb13a4a
SHA512 bccb3204718893e253e7eb6d51cbc8b16ffd41b703d10158bd2b725e9d7cee5ebb9fc5e189cecd8b659e948503245b705f901cb82dc15e28c5d91dbc02f7eab6
SSDEEP 3072:OW8QXhKHX6b0Kxc0JLPEcHnQK+EHrHIuxTUiwhcH6mB/nxUmqK27571:Pxf0KxLRcEDZx9Ccdxe7571
TLSH
T1A924DF6F1D566A381730980BCA6C9F1E5A0B70AC9E12CDF4037A347FA515FABA277403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Screenshot_20260720-161239_Messages.jpg

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\E7W2Y7FJ\Screenshot_20260720-161239_Messages.jpg
Size 216KB
SHA256 6cef906a7cb5cc9a09161f187e61330b13db552eda6fe79b4a5bb5f277421f3a
MD5 2435e31069eecf22a85126c1dc26bf77
SHA1 5cd967981956b7e55cda2f5f8ff9f2f16baa324c
SHA512 d6139c02a4fc6c1f648bea61c0731909856a588d8725126698deeefb08bf69a4128a9d9cf1ece044844d3eda66da37120612a7b8dc9bcd202585b538beadb7e7
SSDEEP 3072:TeS8+pe1e2DVjrgXTedIhhtXilK4ccJrdVlfzckemzu6lSNCtYOCBVFQkwFQjz:Y4ePZEKWlis5cJ53EmzVSceBXhNH
TLSH
T17D24DF6B2C097679AB31585BCA1C9F18490331FCAD96A8F447B7302FB1A1F9F95B3106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3884-6-0x00007FF963F50000-0x00007FF964145000-memory.dmp

Download

memory/3884-14-0x00007FF9216A0000-0x00007FF9216B0000-memory.dmp

Download

memory/3884-7-0x00007FF963F50000-0x00007FF964145000-memory.dmp

Download

memory/3884-10-0x00007FF963F50000-0x00007FF964145000-memory.dmp

Download

memory/3884-12-0x00007FF963F50000-0x00007FF964145000-memory.dmp

Download

memory/3884-11-0x00007FF963F50000-0x00007FF964145000-memory.dmp

Download

memory/3884-13-0x00007FF9216A0000-0x00007FF9216B0000-memory.dmp

Download

memory/3884-9-0x00007FF963F50000-0x00007FF964145000-memory.dmp

Download

memory/3884-8-0x00007FF923FD0000-0x00007FF923FE0000-memory.dmp

Download

memory/3884-5-0x00007FF963F50000-0x00007FF964145000-memory.dmp

Download

memory/3884-0-0x00007FF923FD0000-0x00007FF923FE0000-memory.dmp

Download

memory/3884-4-0x00007FF923FD0000-0x00007FF923FE0000-memory.dmp

Download

memory/3884-1-0x00007FF923FD0000-0x00007FF923FE0000-memory.dmp

Download

memory/3884-2-0x00007FF923FD0000-0x00007FF923FE0000-memory.dmp

Download

memory/3884-3-0x00007FF963FED000-0x00007FF963FEE000-memory.dmp

Download

memory/3884-88-0x00007FF963F50000-0x00007FF964145000-memory.dmp

Download