345e496333688a54950d882c87d7b69890a173c39d829ed0d030818896416417

Analysis

user interaction
yes
max time kernel
34s
max time network
37s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 14:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Message.eml
Size 43KB
Sample260723-rvzjcaek9v
SHA256 345e496333688a54950d882c87d7b69890a173c39d829ed0d030818896416417
MD5 f47ad05accd46eb64b9a321f9fc97971
SHA1 ca1d51a2110d18721ec79e76ff2b751cba7d669f
SHA512 55eb9dd9111e204408bdf36c65baf6ccc833cd032bb96823950968359309249470d9702e6cdfd0632972f0e19b7378e22ad15811e89f5f929b9d85f8917e9d2c
SSDEEP 768:NJjDwV795YLwInFB4zmzYYZnJqeAQnKS95GTCp2hHnrPzhOr2v7RT1Fw8FsxDv/L:NJjDU795Y5KbS98PhzZ1Fw9p/BzYe
TLSH
T1DF13BE11C90CAD1349F2F1F590023755C6A2A91EC312E0A2E2FFB4EE1ADDC95AB5F794
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware spyware

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\T2VTF3KT\TCEQ.png:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\T2VTF3KT\TCEQ (002).png\:Zone.Identifier:$DATA	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
2708	mspaint.exe
2708	mspaint.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4876	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
4876	OUTLOOK.EXE
2708	mspaint.exe
2708	mspaint.exe
2708	mspaint.exe
2708	mspaint.exe
4876	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 2708	4876	OUTLOOK.EXE	89

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Message.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\T2VTF3KT\TCEQ (002).png"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TCEQ.png

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\T2VTF3KT\TCEQ.png
Size 21KB
SHA256 c2f947c7a925f4fb580a287c6d6bab7376b86d5f5fa4e950b9e1525f11aef3f0
MD5 1b611254def8618daa1c9f4806166d9f
SHA1 c5727b1d0e793864bd6c40e92c6a5ad3adceaa3b
SHA512 5c2815be259b799538b830d26150b83fc609c925675fb0078a394319908cb6053078785611a1b1013fb8831978abb32c271ac405dcf93fb95cbe6bc9ca29b2fa
SSDEEP 384:ntPVbneeTx1HAKeQ4AE1BZGm4M/HpfDGKeeeeZDE9eyz9jnnJuE57Gnoeeweee7f:n3eeTAKetrSm5JfDGKeeeepE9eyz9jn7
TLSH
T1E5A2B0B63BBDE3C80CF74690C02DFF334A57F21432884DB6C5A1D6588A78934B5201BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4876-9-0x00007FF9397E0000-0x00007FF939A43000-memory.dmp

Download

memory/4876-8-0x00007FF9397E0000-0x00007FF939A43000-memory.dmp

Download

memory/4876-6-0x00007FF9397E0000-0x00007FF939A43000-memory.dmp

Download

memory/4876-5-0x00007FF9397E0000-0x00007FF939A43000-memory.dmp

Download

memory/4876-4-0x00007FF8F9920000-0x00007FF8F9930000-memory.dmp

Download

memory/4876-0-0x00007FF8F9920000-0x00007FF8F9930000-memory.dmp

Download

memory/4876-3-0x00007FF93993F000-0x00007FF939940000-memory.dmp

Download

memory/4876-7-0x00007FF8F9920000-0x00007FF8F9930000-memory.dmp

Download

memory/4876-10-0x00007FF9397E0000-0x00007FF939A43000-memory.dmp

Download

memory/4876-2-0x00007FF8F9920000-0x00007FF8F9930000-memory.dmp

Download

memory/4876-11-0x00007FF9397E0000-0x00007FF939A43000-memory.dmp

Download

memory/4876-12-0x00007FF9397E0000-0x00007FF939A43000-memory.dmp

Download

memory/4876-13-0x00007FF8F6F00000-0x00007FF8F6F10000-memory.dmp

Download

memory/4876-14-0x00007FF8F6F00000-0x00007FF8F6F10000-memory.dmp

Download

memory/4876-1-0x00007FF8F9920000-0x00007FF8F9930000-memory.dmp

Download

memory/4876-51-0x00007FF9397E0000-0x00007FF939A43000-memory.dmp

Download