332999664c7212ade817feb244c883e8488675e1388707b0534f051d96de0643

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
48446e8f-139c-46d4-89c0-08deee814cb5/940f8159-b11a-da28-91aa-a00881b95c19.eml
Size 105KB
Sample260804-2ms2pszvd1
SHA256 332999664c7212ade817feb244c883e8488675e1388707b0534f051d96de0643
MD5 6fd667b9e1de37c0bb659008af1913c4
SHA1 8253564beb3dff1ca085f206c5a352ca9f1e15a7
SHA512 4f51dbe66bda41c106d8cff9ae195944563377abf61c1e30e92483542c9a73712ea8b971224839f31d1b2e515af89982d8707f6574c74a8a380e536322576c7f
SSDEEP 3072:bFVklQKRmFpklPuxrNCu5WFzvMa7SQe2586TRPlH1qH:bFVk+KRmFpkZwrNCu8Rd+J2W6TRPqH
TLSH
T1B1B35C1242071827DBA212465E553D0A92A17D84F43B61803AAFA57F12CF47FBF3ED9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware ransomware spyware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\CG6GVJC1\details.txt:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\CG6GVJC1\details (002).txt\:Zone.Identifier:$DATA	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\CG6GVJC1\Undelivered Message Headers.txt:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\CG6GVJC1\Undelivered Message Headers (002).txt\:Zone.Identifier:$DATA	OUTLOOK.EXE

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
3800	NOTEPAD.EXE
2556	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1712	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 55 IoCs

pid	Process
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE
1712	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 3800	1712	OUTLOOK.EXE	94
PID 1712 wrote to memory of 2556	1712	OUTLOOK.EXE	95

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\48446e8f-139c-46d4-89c0-08deee814cb5\940f8159-b11a-da28-91aa-a00881b95c19.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\CG6GVJC1\details.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3800
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\CG6GVJC1\Undelivered Message Headers.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Undelivered Message Headers.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\CG6GVJC1\Undelivered Message Headers.txt
Size 18KB
SHA256 b3be799c267aba2ed716152d248a912075266707e79aa73855bd32f3fdf532d1
MD5 3fc8f8fb03480afaf024d5ae83fbc127
SHA1 d735f88f37c82972fcb859e3c3e842b4b3c6eed9
SHA512 70f470a20a7506527b3f693651961a87c31c5a8f2c5aea6b8ea55ecf6b6a59a6e29c3dc57906b69ca8fedc594b96590e966e7b81ff82bc59b111830c41ab4b15
SSDEEP 384:rQRFp3Uzmka8mh/LBpVi2bEL/fMbvBj6sqEC7e0kjz1fK13YBvyiCfc12:rQRF5Uzmt88Ri+Y/fMbvBE37eHn1f9Bq
TLSH
T13B821901119D38252AB211467BEB7A43A38509507477E1F472EBDBA236CF4C7AF4D8EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Undelivered Message Headers.txt:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\CG6GVJC1\Undelivered Message Headers.txt:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

details.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\CG6GVJC1\details.txt
Size 520B
SHA256 941080dbe3a0b151610a8a46a5bea750c0924a3cb84a51d5278ed029f43ffdb2
MD5 36741d8fdd9f89cfcc16a4954e5f1f77
SHA1 859d61fe505fe71980ef744e2a7a33dfb21a0192
SHA512 d3ba7db756381327f4a9e7bf5a397b3a9b821f73e13c6da46c76a9a679aff2ffe47cf5359168b4d4a9762faae8c48c4f64aec0b78422f515d6eccd09f604ba04
TLSH
T1F2F00551676F10105935CE90B2F22E16D3461D5C60F1C3E0300DE39B47CB42AD65FC9D
MD5 SHA1 SHA512 TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1712-3-0x00007FFDE4EED000-0x00007FFDE4EEE000-memory.dmp

Download

memory/1712-11-0x00007FFDA2B50000-0x00007FFDA2B60000-memory.dmp

Download

memory/1712-5-0x00007FFDE4E50000-0x00007FFDE5045000-memory.dmp

Download

memory/1712-7-0x00007FFDE4E50000-0x00007FFDE5045000-memory.dmp

Download

memory/1712-8-0x00007FFDE4E50000-0x00007FFDE5045000-memory.dmp

Download

memory/1712-10-0x00007FFDA2B50000-0x00007FFDA2B60000-memory.dmp

Download

memory/1712-9-0x00007FFDE4E50000-0x00007FFDE5045000-memory.dmp

Download

memory/1712-6-0x00007FFDA4ED0000-0x00007FFDA4EE0000-memory.dmp

Download

memory/1712-0-0x00007FFDA4ED0000-0x00007FFDA4EE0000-memory.dmp

Download

memory/1712-39-0x00007FFDE4E50000-0x00007FFDE5045000-memory.dmp

Download

memory/1712-40-0x00007FFDE4E50000-0x00007FFDE5045000-memory.dmp

Download

memory/1712-1-0x00007FFDA4ED0000-0x00007FFDA4EE0000-memory.dmp

Download

memory/1712-4-0x00007FFDA4ED0000-0x00007FFDA4EE0000-memory.dmp

Download

memory/1712-2-0x00007FFDA4ED0000-0x00007FFDA4EE0000-memory.dmp

Download