1544c9625239549071e09d6fd7ee5a3bc5f5d2acf9d52c53000262604b2246e6

Analysis

user interaction
yes
max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Message.eml
Size 56KB
Sample260722-sr8taaxfpf
SHA256 1544c9625239549071e09d6fd7ee5a3bc5f5d2acf9d52c53000262604b2246e6
MD5 a12b6070dce3d102fdbc3e4b55d59c1e
SHA1 3cac95493bd4fa430af5cf564d1896833bd1e49b
SHA512 71e02f8faa1dcc87ffbc6d1fd8ba6bfd6944bf703d0491c367a592ed39183d30c2ad3f6df868d09c6cb8e00bfe18e531d6d03fc8b82ddf6414a431f7d580ce66
SSDEEP 768:eMt2hxwk7LVCr9zPvzTm9jIhBxRxwf0rzVLNjQFW0f0UPZqTzFInl:eMt2hxwk70vzTnB80r5LNcB0UkfFyl
TLSH
T1B54341F2D661D8EE8A04F1FA8C2C13910DD14632A93EBFF0E9BE7751740A68D76D9910
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware spyware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\BY8UVBG5\mavs.uta approving.docx:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\BY8UVBG5\mavs.uta approving (002).docx\:Zone.Identifier:$DATA	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
2888	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5840	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 44 IoCs

pid	Process
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
5840	OUTLOOK.EXE
2888	WINWORD.EXE
2888	WINWORD.EXE
2888	WINWORD.EXE
2888	WINWORD.EXE
2888	WINWORD.EXE
2888	WINWORD.EXE
2888	WINWORD.EXE
2888	WINWORD.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5840 wrote to memory of 2888	5840	OUTLOOK.EXE	91

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Message.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5840
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\BY8UVBG5\mavs.uta approving.docx" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8A7891822FCFF127E4EADADE9757112B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A7891822FCFF127E4EADADE9757112B
Size 2KB
SHA256 b816b9fc8fd16d4a0285698733b2a4ffc491008e09df0eee22cac4d8f46b30d0
MD5 2d5a73d055fea1e28df492a29b3365a0
SHA1 10c3efac419d1bc96e0e3bfa190879ad582a49a3
SHA512 56dfc170d0192a0622611e82eb52998260baa9fc6b2f045bc00ddd68d83ef91bc05739d4c6448bdc93db1ed133c3dccd265bf02c23e526b7c8afd18b14160e0f
TLSH
T16141232C1E4C34A7B0592E74E8D6AE838CF291611BC0949EC5588E865531FCE9FDE4F3
MD5 SHA1 SHA512 TLSH

Submit Download

B54B00CE250A47F2A29BFE4A70858A02

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B54B00CE250A47F2A29BFE4A70858A02
Size 1KB
SHA256 c102d88cd5b72f2a10c0758ec8defd19b58762f4237ea7b6ab43b172e54b1553
MD5 b56cd9ce0f8b622c4b5033fb933f0f3c
SHA1 177c6483a31a3b5472dc4a5883a89f85dfd8f786
SHA512 2f602d35c57f76b304a1726b5652664c61691ae083bbbbf3571575257cf2bf17879ac5e180872dd23e701ffe721d637e0e7792c2b078b2b54ae0111b542dac82
TLSH
T14C11C02212296501FE623D70DECDFEC6EC2571A32AC0CCEF8891594C141DFA16BD5686
MD5 SHA1 SHA512 TLSH

Submit Download

8A7891822FCFF127E4EADADE9757112B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B
Size 246B
SHA256 e6ebb6221600b8f1aa54e426965d3a994eb5075b25aba7b5a1eca160a3a93ddd
MD5 48eaee020c5bfc3d8421ee01b2408373
SHA1 384ca6131443e1aae4f1401893517284f3e7d6f2
SHA512 d888074173bcc90cc781e22b53d5948c560a30a9ef0f05bc6c9687f7426c415fe79b4f079ae759021a2a17979786ad6fb42ff2676d98a4fca291a6f78b24a9f3
TLSH
T1C3D0C92063765316F596163EAD7162D1BB285A51A4478F050AE2038C4869B901D66B2F
MD5 SHA1 SHA512 TLSH

Submit Download

B54B00CE250A47F2A29BFE4A70858A02

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B54B00CE250A47F2A29BFE4A70858A02
Size 266B
SHA256 56ebd94adfd7ae1565f499ba7e19f54433fb7b67f77ebbb25f06a37b58930341
MD5 4cbf258d83eb01689001b04cdb9cf169
SHA1 668a8d6b01c9fa349a1a20243ca89e4938896a04
SHA512 a7e7c0fdbcf31e7618aa00c075636272864639b40db080f61f4fbb214f19cc351423467606500b4c620ab5693f0b6fc042566fa6423981dd684adda5166dcff1
TLSH
T17BD0C958B3B88222F4519B3E1DD10927DA3A0D159901D3121BF08349B53CDA27C31797
MD5 SHA1 SHA512 TLSH

Submit Download

F9FFDAB9-F213-4A7E-9DF0-E752ED5A26F9

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\F9FFDAB9-F213-4A7E-9DF0-E752ED5A26F9
Size 191KB
SHA256 297dc9671ff808b64abf5e02fa9216f905567cd73332b63211a6d140f1c620a5
MD5 02b0872c51a01f90e8a7c6a3436611bf
SHA1 d2e3156d500f9c0e56b14a66633f061b41926bd3
SHA512 285467e895c1f5c55d75f65e29a37e36e2b367b72a8fdd131d8f59f52ffe3a91d37bc5882392e750551a6d62cd458c9e70ca9e3348327dd088d7d39e2031d587
SSDEEP 1536:8rVe3b3yFK13SNzbQxsghElqe7HWsDkjj/mblcAZl1p5ihs7VXXdEKD0aO7qamZp:bbe7HWsDkjj/EXi57cL
TLSH
T1351402A6B2C75C628B33049D5B57A094FE6E12A708D5202873FAF3578FF2E1CB547291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mip_sdk.miplog

Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
Size 14KB
SHA256 f7485960911540aaa3c990e84b8c2767640d226ec8965d3eaaeac0f8376c3313
MD5 f0ff954db3be0190f7a6a04d14db268c
SHA1 1f15451b6bfbbc386d3dc3332482ce81dd46e964
SHA512 9af9f6a7447bde7954c0bfa48abfcf669dba241403aeca02a68b3918204aaea9682aecf92a07c24d0a3cd5beb4d9d4b5cba22c6b1047ff2d89a52a05b8354d3d
SSDEEP 192:L6js6e696eVXYtbzXTzG+VZs4K1DNMj/M1M9BQCQYrLzQJ27Y0Zqzc9vlnjHnxnC:6m/Jn38yr9HzW
TLSH
T1B862EED2C16DC9EBA835BF0253D63B608086B45A26DF74597719034E338A60A8FFF725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mavs.uta approving.docx

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\BY8UVBG5\mavs.uta approving.docx
Size 5KB
SHA256 005bf59cfa4455345875efc2df4c80f5e66703129308aa61eb75cc36341b3fda
MD5 5d6bd8317d8658e7601d68b44fac3b31
SHA1 5fe28e844c73acc6f6bf9c6485500d85384c8d8f
SHA512 58b63b2c774f05d4a2e08f8626af7d82c94df54eeffa57955511895ad8317354a964fc3661cf96f2e7097e057735c228aad70f8b6dd309cb1b9b6b140fec0d6a
SSDEEP 96:80K6VJMenwsDLqj75QUeII1AZ0vlLQLgsQHa5llTJdyh4W:80FJMA8/5QUeG2vWLZQHa5ldXW
TLSH
T1C8C14C1ED98CE430C01101B2D14CB0DCE57D5081D7C69AA9E5EE0AFF9BF17D8272A718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iso690.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD3C52.tmp\iso690.xsl
Size 263KB
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
TLSH
T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

ExcludeDictionaryEN0409.lex

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 1KB
SHA256 c40de3fb4746558f4dbd8fc3bd8877235f860957e295a0595da1ae3b2506eecd
MD5 749b58ee1ee3030eebcd4fb81d0ea2b0
SHA1 ea65c97d083584324017f70247f26709b146f302
SHA512 aedd326ad403ca9d751bb55914ababd1c7ea524e67185cc957bf89401eb7fe7aa1ed8a86bed72e7406dbaa43ab7a11d10865464ac155125e5e7ca30073633ad6
TLSH
T1E421F0011AAF2B4AF1924372173B4718D7717E47B6618A2DA648312BAE70E504E4CA9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5840-4-0x00007FFD59C40000-0x00007FFD59EA3000-memory.dmp

Download

memory/5840-37-0x00007FFD59C40000-0x00007FFD59EA3000-memory.dmp

Download

memory/5840-38-0x00007FFD59C40000-0x00007FFD59EA3000-memory.dmp

Download

memory/5840-10-0x00007FFD176D0000-0x00007FFD176E0000-memory.dmp

Download

memory/5840-9-0x00007FFD176D0000-0x00007FFD176E0000-memory.dmp

Download

memory/5840-8-0x00007FFD59C40000-0x00007FFD59EA3000-memory.dmp

Download

memory/5840-7-0x00007FFD19D80000-0x00007FFD19D90000-memory.dmp

Download

memory/5840-0-0x00007FFD19D80000-0x00007FFD19D90000-memory.dmp

Download

memory/5840-6-0x00007FFD59C40000-0x00007FFD59EA3000-memory.dmp

Download

memory/5840-5-0x00007FFD19D80000-0x00007FFD19D90000-memory.dmp

Download

memory/5840-3-0x00007FFD59D9F000-0x00007FFD59DA0000-memory.dmp

Download

memory/5840-1-0x00007FFD19D80000-0x00007FFD19D90000-memory.dmp

Download

memory/5840-2-0x00007FFD19D80000-0x00007FFD19D90000-memory.dmp

Download