127cfd227e9a4e40d2a623e09e65348eb76ad1e96ac4a65fb9db51d1f9d9d716

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 09:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tr ATTESTATiON DE PAiEMENT-.msg
Size 579KB
Sample260804-k474hsbq31
SHA256 127cfd227e9a4e40d2a623e09e65348eb76ad1e96ac4a65fb9db51d1f9d9d716
MD5 127c9507d4fc23aa6c4ef79a77d2cc8f
SHA1 fc084aa692d5cf3660be0015e8a21fb08f40cae0
SHA512 b40114751e8a23b2656486557a95705e3b61bd8c9e6a7ec031582616d55d8c684e50626357d0440a5f0a125528008d8d1ac4cd2b2a7dc4ada86e5881b36e0a95
SSDEEP 12288:hM1X4UitxJEogITwcOpO68OL+IyRpGarE+:lNVgIbOswL+TJE
TLSH
T1B2C45B1359944F47F035C7B4BF930D9A5B1A7E09E8127AEF305E2F8B2B312115C9A62E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware spyware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\AOL2EB1I\2026-07-29 at 09.11. AM.jpg:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\AOL2EB1I\2026-07-29 at 09.11. AM (002).jpg\:Zone.Identifier:$DATA	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
4940	mspaint.exe
4940	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3792	OpenWith.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3976	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3792	OpenWith.exe
3976	OUTLOOK.EXE
3976	OUTLOOK.EXE
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe
3792	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 4940	3792	OpenWith.exe	99

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\Admin\AppData\Local\Temp\tr ATTESTATiON DE PAiEMENT-.msg"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3976

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\AOL2EB1I\2026-07-29 at 09.11. AM.jpg"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-29 at 09.11. AM.jpg

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\AOL2EB1I\2026-07-29 at 09.11. AM.jpg
Size 445KB
SHA256 1db5993a9aa62a587ba4adbf49c343f4e486a7dfe0dfc6347c23a003dade227d
MD5 91cc1ffaf7dd3b852983d92ff3866b1f
SHA1 ae5598c8c44b656d4ad373630ce7efa223d9cea9
SHA512 351cc4964d282f9e9ef37aaea619db04e826920067024766604a0548679ea553f798f7cfc52e0d3f30edac84105462f111fc945d4ba0d846a9362ad033a45bfa
SSDEEP 6144:QvaU4/YZEo+nITwcI+FZtNupO6KLS6edL+ZOzybdCEfnGapNEyeKa:YxJEogITwcOpO68OL+IyRpGarE+a
TLSH
T19AA42A1399549F47A528D3E9BF530E9C1F0A6B0CE4867AEF312E0ED77B552210D9E02E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-29 at 09.11. AM.jpg:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\AOL2EB1I\2026-07-29 at 09.11. AM.jpg:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

memory/3976-8-0x00007FFA7DFD0000-0x00007FFA7E1C5000-memory.dmp

Download

memory/3976-9-0x00007FFA7DFD0000-0x00007FFA7E1C5000-memory.dmp

Download

memory/3976-7-0x00007FFA7DFD0000-0x00007FFA7E1C5000-memory.dmp

Download

memory/3976-6-0x00007FFA7DFD0000-0x00007FFA7E1C5000-memory.dmp

Download

memory/3976-1-0x00007FFA3E050000-0x00007FFA3E060000-memory.dmp

Download

memory/3976-0-0x00007FFA3E050000-0x00007FFA3E060000-memory.dmp

Download

memory/3976-10-0x00007FFA7DFD0000-0x00007FFA7E1C5000-memory.dmp

Download

memory/3976-2-0x00007FFA3E050000-0x00007FFA3E060000-memory.dmp

Download

memory/3976-11-0x00007FFA3BD30000-0x00007FFA3BD40000-memory.dmp

Download

memory/3976-13-0x00007FFA7DFD0000-0x00007FFA7E1C5000-memory.dmp

Download

memory/3976-12-0x00007FFA7DFD0000-0x00007FFA7E1C5000-memory.dmp

Download

memory/3976-14-0x00007FFA3BD30000-0x00007FFA3BD40000-memory.dmp

Download

memory/3976-3-0x00007FFA7E06D000-0x00007FFA7E06E000-memory.dmp

Download

memory/3976-39-0x00007FFA7DFD0000-0x00007FFA7E1C5000-memory.dmp

Download

memory/3976-4-0x00007FFA3E050000-0x00007FFA3E060000-memory.dmp

Download

memory/3976-5-0x00007FFA3E050000-0x00007FFA3E060000-memory.dmp

Download