Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/07/2026, 08:29
Static task
static1
Behavioral task
behavioral1
Sample
Message.eml
Resource
win11-20260513-en
windows11-21h2-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
=?iso-8859-1?Q?SOA-T-n=B00792026=5Fsalugen.xls?=
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
email-html-2.html
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
email-plain-1.txt
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
image.png
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target Message.eml
- Size 291KB
- Sample260724-kdkwasfb83
- SHA256 69d46a65ff0146dc46245d93f91a200fc9397ae2045be7e7158e3795c30bc32f
- MD5 91f08939bc324c0c858e3e0d2fcb01cd
- SHA1 8b895f6c71439f1a693b1118bee0bb100b1d05b0
- SHA512 3ed2b62c5e82717c8dbcfc91efa793ba12240143063a002b600ad5ce9de21a1d2ecef92c792680253406cedb4001182da76bb229d895a16a58e8381da5428ae9
- SSDEEP 6144:JnK4sQHcnomgGNWPOBvPJPXDo6Z93JmINmOKNzEHE73rhGwID:JnK4sON4WUJPzo6Z6g0ZGIhfg
- TLSH T1AE54F1320943AFDEA77B149480047FA61DE82D47936E9065FB5D30F22AED134DF6A8B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
description ioc Process Key security queried \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook OUTLOOK.EXE Key queried \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook OUTLOOK.EXE Key enumerated \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook OUTLOOK.EXE Set key security \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook OUTLOOK.EXE Key opened \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook OUTLOOK.EXE - Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OUTLOOK.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OUTLOOK.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OUTLOOK.EXE - Enumerates system info in registry 2 TTPs 9 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OUTLOOK.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001" OUTLOOK.EXE - Modifies registry class 21 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2603762634-1194696512-1467128076-271947267-3280968760-2062302022-2235959577\Children OUTLOOK.EXE Key created \Registry\User\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_24ed\Internet Settings\Cache\Extensible Cache EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_24ed\Internet Settings\Cache\Cookies\CacheVersion = "1" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_24ed\Internet Settings\Cache\Cookies\CacheLimit = "1" EXCEL.EXE Key created \Registry\User\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2603762634-1194696512-1467128076-271947267-3280968760-2062302022-2235959577 OUTLOOK.EXE Key created \Registry\User\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_24ed OUTLOOK.EXE Key created \Registry\User\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_24ed\Children OUTLOOK.EXE Key created \Registry\User\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_24ed\Internet Settings\Cache EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_24ed\Internet Settings\Cache\Content\CachePrefix EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_24ed\Internet Settings\Cache\Content\CacheVersion = "1" EXCEL.EXE Key created \Registry\User\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_24ed\Internet Settings\Cache\Cookies EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_24ed\Internet Settings\Cache\History\CacheVersion = "1" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_24ed\Internet Settings\Cache\Content\CacheLimit = "51200" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_24ed\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_24ed\Internet Settings\Cache\History\CacheLimit = "1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2603762634-1194696512-1467128076-271947267-3280968760-2062302022-2235959577\Moniker = "oice_16_974fa576_32c1d314_24ed" OUTLOOK.EXE Key created \Registry\User\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_24ed\Internet Settings EXCEL.EXE Key created \Registry\User\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_24ed\Internet Settings\Cache\Content EXCEL.EXE Key created \Registry\User\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_24ed\Internet Settings\Cache\History EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\oice_16_974fa576_32c1d314_24ed\Internet Settings\Cache\History\CachePrefix = "Visited:" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2603762634-1194696512-1467128076-271947267-3280968760-2062302022-2235959577\DisplayName = "OICE_16_974FA576_32C1D314_24ED" OUTLOOK.EXE - NTFS ADS 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\LEKQKD1Q\SOA-T-n0792026_salugen.xls:Zone.Identifier OUTLOOK.EXE File created C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\LEKQKD1Q\SOA-T-n0792026_salugen (002).xls\:Zone.Identifier:$DATA OUTLOOK.EXE File created C:\Users\Admin\AppData\Local\Packages\oice_16_974fa576_32c1d314_24ed\AC\Temp\9C74D410.xls\:Zone.Identifier:$DATA OUTLOOK.EXE File opened for modification C:\Users\Admin\AppData\Local\Packages\oice_16_974fa576_32c1d314_24ed\AC\Temp\9C74D410.xls:Zone.Identifier OUTLOOK.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3208 OUTLOOK.EXE - Suspicious use of SetWindowsHookEx 56 IoCs
pid Process 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 1748 EXCEL.EXE 1748 EXCEL.EXE 1748 EXCEL.EXE 1748 EXCEL.EXE 1748 EXCEL.EXE 1748 EXCEL.EXE 1748 EXCEL.EXE 1748 EXCEL.EXE 1748 EXCEL.EXE 1748 EXCEL.EXE 3208 OUTLOOK.EXE 3208 OUTLOOK.EXE 5556 EXCEL.EXE 5556 EXCEL.EXE 5556 EXCEL.EXE 5556 EXCEL.EXE 5556 EXCEL.EXE 5556 EXCEL.EXE 5556 EXCEL.EXE 5556 EXCEL.EXE 5556 EXCEL.EXE 5556 EXCEL.EXE 5556 EXCEL.EXE 5556 EXCEL.EXE 5556 EXCEL.EXE - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3208 wrote to memory of 1748 3208 OUTLOOK.EXE 82 PID 3208 wrote to memory of 5556 3208 OUTLOOK.EXE 88 - outlook_office_path 1 IoCs
description ioc Process Set key security \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook OUTLOOK.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Message.eml"1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
PID:3208 -
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /Embedding2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1748
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\LEKQKD1Q\SOA-T-n0792026_salugen.xls"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:5556
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
- Size 14KB
- SHA256 03feec2d397a705ad764a7567162fdb197ef444c2b3b039b6e5d03375e32f02b
- MD5 b1712535c66c4136315837f7e2025b4a
- SHA1 b1d771624e389686ea69641c027cb0d6b21a0114
- SHA512 91bbe1450b7cb95370d46118a07e5e1e57348a3e0ef97646a21183e7e84c9d3d7fb5bd5cd267a0981bbaae1234bc7c52e63b9a55b0e3e9c6e9f335a407e0fa2c
- SSDEEP 192:bjzt9svz9HZ8cjtL90FzA6ZH8jDp9Abzz1ZWtm+jMy94qznTZkojE+9YyzbnZIe:wvAFpbymzqayD
- TLSH T1AA62149382ADC9EBA8347F1263C637A18005B56F37CB74495B18034E368BB155BFA739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\LEKQKD1Q\SOA-T-n0792026_salugen.xls
- Size 173KB
- SHA256 15691b010940b10d9550f1b37af4f59b215873b442674a0b0a57b5728ee968b3
- MD5 6fa3a29bc749190cd3d939f315dfbced
- SHA1 a0d1cf0896263b5f95c04433e5a181443094b353
- SHA512 835409021e815a1a27b6d216052bfce3fa658f54d994924b0dacb5da375c41df1fb51cbfb4ee1969ecaa8c478fa7a6fe7b80e8f57455459ee236ca05ea8cf74a
- SSDEEP 3072:JSFsv66g3KnF439NKCdcIwqf7hpoVPEWyU0gq3vBvE2Hs6Q4fpfh5qVKdgr+3g01:JSFsv66g3KnF439NKCdcIw+7XoVEU0gW
- TLSH T17304E096BBE5C94CDC5617360AA087756267FC811EDA920BB208F71C1EF0FD24D016E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\oice_16_974fa576_32c1d314_24ed\AC\Temp\9C74D410.xls:Zone.Identifier
- Size 26B
- SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
- MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
- SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
- SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
- Size 1KB
- SHA256 3f8d23d802c107866340535b1c5e2c5c4e9b1881fa65dc6996493bbb89f6ac06
- MD5 a3e2ef2c4b2637a59efcee88870760d6
- SHA1 e270c71440d56b94d62267bf3043e1b986231921
- SHA512 4310de7dd69a403dbc061a6e9c2641e5ac1af38555fd6d831f81d3b7d51500a92c42120b3967796c95e0e4b030f8f1b424b0191e477ee48ae0301b747d01ad46
- TLSH T15C4112060AC74FB6E4684272277E8B7AE761B943E7045D1F7144522E38B5E80F61DB1E
- MD5 SHA1 SHA512 TLSH