4c1b5e471a686f4a5250310ff5a62f72f84697ce7dd198ed846599267b6e1969

Analysis

max time kernel
599s
max time network
464s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Invitation to disciplinary hearing - Alleged Serious Misconduct.eml
Size 9.0MB
Sample260724-cp91ka1emb
SHA256 4c1b5e471a686f4a5250310ff5a62f72f84697ce7dd198ed846599267b6e1969
MD5 ca480fba5487cec438c197ff4f9d004e
SHA1 e53d9fecc0eefe224f34e9956c6f794ec8078943
SHA512 6fe5f3f754b95fdf5417895ccf90b26ed12ebf3fe2c8a1abe97b71091d56b83ffdc020ad2225876e3d1c59a7675f8d8834f67bdd267f6a408151d2c92077ed40
SSDEEP 49152:fP6lGBpkWMyMT/SfATMkV9vsiwTeSS86V8tHx5tNnruW0lBTmiZufrDaZzLAyqCx:i
TLSH
T18F960110C6B78EAA098256FF141632D174BCF3E582EC81F7226AAEB3F0E5CB1C759551
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware spyware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2968	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2968	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE
2968	OUTLOOK.EXE

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Invitation to disciplinary hearing - Alleged Serious Misconduct.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

memory/2968-8-0x00007FFBD0F20000-0x00007FFBD1183000-memory.dmp

Download

memory/2968-10-0x00007FFBD0F20000-0x00007FFBD1183000-memory.dmp

Download

memory/2968-5-0x00007FFB91060000-0x00007FFB91070000-memory.dmp

Download

memory/2968-6-0x00007FFB91060000-0x00007FFB91070000-memory.dmp

Download

memory/2968-4-0x00007FFBD0F20000-0x00007FFBD1183000-memory.dmp

Download

memory/2968-3-0x00007FFBD107F000-0x00007FFBD1080000-memory.dmp

Download

memory/2968-0-0x00007FFB91060000-0x00007FFB91070000-memory.dmp

Download

memory/2968-9-0x00007FFBD0F20000-0x00007FFBD1183000-memory.dmp

Download

memory/2968-7-0x00007FFBD0F20000-0x00007FFBD1183000-memory.dmp

Download

memory/2968-11-0x00007FFBD0F20000-0x00007FFBD1183000-memory.dmp

Download

memory/2968-1-0x00007FFB91060000-0x00007FFB91070000-memory.dmp

Download

memory/2968-12-0x00007FFB8E3F0000-0x00007FFB8E400000-memory.dmp

Download

memory/2968-13-0x00007FFB8E3F0000-0x00007FFB8E400000-memory.dmp

Download

memory/2968-2-0x00007FFB91060000-0x00007FFB91070000-memory.dmp

Download

memory/2968-49-0x00007FFBD0F20000-0x00007FFBD1183000-memory.dmp

Download