Overview

overview

6

Static

static

1

Setup for ...it.exe

windows10-2004-x64

6

Setup for ...it.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 02:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Setup for Outlook 64-bit.exe
  • Size 43.0MB
  • Sample260804-c4rsja1ajb
  • SHA256 4b652ddd782fdb192229f69f35af66c953516029ab6887815007bb370f84ddf6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 25 IoCs
  • Loads dropped DLL 26 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup for Outlook 64-bit.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup for Outlook 64-bit.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4104
    • C:\Windows\SysWOW64\MSIEXEC.EXE
      MSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\{E122FBEC-AD97-43B2-BD0E-3132E9689056}\Mail Merge Toolkit (x64).msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\{E122FBEC-AD97-43B2-BD0E-3132E9689056}\1033.MST" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:5028
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5952
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 9F8F222D1CDB71D9048B1790CA36DF1E C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2848
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding B0D098D6951FB4E5A49EF5F126CE0C38 C
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:3008
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:5676
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding D3EDB6BE6115E521E1EA6E7A61594084
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2580
        • C:\Windows\System32\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\MAPILab Ltd\Mail Merge Toolkit\MMTProg.dll"
          3⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:2696
        • C:\Windows\System32\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\MAPILab Ltd\Mail Merge Toolkit\OutlookSenderAddin.dll"
          3⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:1456
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding CA675AC127219FD36F0971BBD21B34D2
        2⤵
        • Drops file in Program Files directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3832
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:5544

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5ab50b.rbs
          • Path C:\Config.Msi\e5ab50b.rbs
          • Size 134KB
          • SHA256 dcc114a2940d2b96e23dad52d5c037b4f0c90253af3159c3e29875b8bccfd810
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          secman.dll
          • Path C:\Program Files (x86)\Common Files\Outlook Security Manager\secman.dll
          • Size 158KB
          • SHA256 4aae1e9c22ec110daa0a6febab94bd5c930d281a24a436f49fcb27b1b6a0afc1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MMTProg.dll
          • Path C:\Program Files\MAPILab Ltd\Mail Merge Toolkit\MMTProg.dll
          • Size 11.5MB
          • SHA256 4a14fa0bc51f4c70b8d0c24f81d6b5d84b3a7426c1d84b567f345e3d398254c1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OutlookSenderAddin.dll
          • Path C:\Program Files\MAPILab Ltd\Mail Merge Toolkit\OutlookSenderAddin.dll
          • Size 1.8MB
          • SHA256 ec330234652c2a89e681841dfd5a8926e56ad9d096d7deb99643d2c0b43acec9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI9d400.LOG
          • Path C:\Users\Admin\AppData\Local\Temp\MSI9d400.LOG
          • Size 129KB
          • SHA256 b26ffa2a8b03d64fd418ae948bf54d653a06e3f89d05aa88dcf326d8d19f8984
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSIE1FA.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSIE1FA.tmp
          • Size 62KB
          • SHA256 cd05434124848ef9e7a20863350445b60b09dc1c065d2b083aa5f9e4ee46df61
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSIF498.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSIF498.tmp
          • Size 1.0MB
          • SHA256 f87e4cb06f40f729cfac5914cea9817e96f95b2ca4363fb21e903044b81f7592
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSIF69D.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSIF69D.tmp
          • Size 94KB
          • SHA256 2118aed32903188abab59d4cd7846fef4723a520d485e71245bd1243681988ae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nethost.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{B008D66F-B796-4C06-B707-932F0B225531}\nethost.dll
          • Size 112KB
          • SHA256 3f6e7235f827139174ae950913918fdf8b28c3c3953732e5ef76fd78c4349297
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          0x0409.ini
          • Path C:\Users\Admin\AppData\Local\Temp\{E122FBEC-AD97-43B2-BD0E-3132E9689056}\0x0409.ini
          • Size 5KB
          • SHA256 57e020c41ad0566fb55415a40167a0c3da89584bc4e5f961d8e8c646f80c5590
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          1033.MST
          • Path C:\Users\Admin\AppData\Local\Temp\{E122FBEC-AD97-43B2-BD0E-3132E9689056}\1033.MST
          • Size 32KB
          • SHA256 6321f36710a887e9a14bb33cda339266dbd0de4c21b789368ecca63ee128179e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Mail Merge Toolkit (x64).msi
          • Path C:\Users\Admin\AppData\Local\Temp\{E122FBEC-AD97-43B2-BD0E-3132E9689056}\Mail Merge Toolkit (x64).msi
          • Size 42.6MB
          • SHA256 26d40f53402cfb58915c3311f1304d512918b4e9d41ac746509767ab76e914e5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Setup.INI
          • Path C:\Users\Admin\AppData\Local\Temp\{E122FBEC-AD97-43B2-BD0E-3132E9689056}\Setup.INI
          • Size 1KB
          • SHA256 70fd0b077032615c99585546b3120c03dcc11fb87be96b0cf014f4f9c31348f1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _ISMSIDEL.INI
          • Path C:\Users\Admin\AppData\Local\Temp\{E122FBEC-AD97-43B2-BD0E-3132E9689056}\_ISMSIDEL.INI
          • Size 11B
          • SHA256 17ad78845c9c6a8e97a5bd14be56700a51ee85867c979ed6cf538e1fed82cf7c
          • MD5 SHA1 SHA512
          Submit Download

          ~C5D2.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\~C5D2.tmp
          • Size 271B
          • SHA256 e3c18af15d7498d2c0feaf61d71ca024d78effd98986c9b3e55145ba99a4f917
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ~C5D2.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\~C5D2.tmp
          • Size 265B
          • SHA256 417d9e5337d4437855ba412dd3eb8fc2c97505fdc68b733782240241691c7e13
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ~C5D2.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\~C5D2.tmp
          • Size 276B
          • SHA256 bd3f58ae38a85645c545d4caa90bd933b6494731cb866e8f92dc5d2d71fa8552
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSIC596.tmp
          • Path C:\Windows\Installer\MSIC596.tmp
          • Size 118KB
          • SHA256 fab187857de52df182df5994a9f9c92436efbbb6ec612a08e4db7b5cda9aacca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 6a6aea6e33e4a07f2c37aca4cf1cec14557634a462c9e40f69cfe866d6c603c1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {9653a475-e460-4377-8c1e-6a92cf722b1a}_OnDiskSnapshotProp
          • Path \??\Volume{cb1876cb-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{9653a475-e460-4377-8c1e-6a92cf722b1a}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 ba4d0f4fa962ef501c9f45dabef07bff27d99b543a0554e389ee32492d51f8e3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3832-342-0x0000000002740000-0x0000000002766000-memory.dmp
          Download

          memory/5952-337-0x000002BC32B70000-0x000002BC32D3A000-memory.dmp
          Download

          memory/5952-234-0x000002BC32040000-0x000002BC329E4000-memory.dmp
          Download