Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/08/2026, 15:18
Static task
static1
Behavioral task
behavioral1
Sample
Message.eml
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Message.eml
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
Copy of Blank timesheet.xlsx
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
Copy of Blank timesheet.xlsx
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target Message.eml
- Size 71KB
- Sample260820-spw2pseb73
- SHA256 8e356ba86a6c492191c136b17f2f060a3e25f9541ce6774d45eae2611ddbbf07
- MD5 f10f6daf0d54b4f4c1695cd6a6dd59c5
- SHA1 cea02d1f3b46f29cb9893e6edb6117d4adf9c4cf
- SHA512 32b8c013b3eb2d1dd8f81c1a45bc00f7f862fef46cad85f4bb0420040fab092ee6184780d87fd0bc21f89471e7ebb7d7a2657a38777b49c561c5af8cb22f22d2
- SSDEEP 1536:+3CCD9cBcS45tfDhGtKL0QiDjtnIOii6b21LVdXQkyLR:NG9p/PLTijFWn2VdLyF
- TLSH T1CB63F0707A040DE65E2075D42866B756BCC8679783AAA0D3768DDAB603E8035CFDDC3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OUTLOOK.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OUTLOOK.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OUTLOOK.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001" OUTLOOK.EXE - Modifies registry class 28 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 OUTLOOK.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags OUTLOOK.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" OUTLOOK.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff OUTLOOK.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 OUTLOOK.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 OUTLOOK.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} OUTLOOK.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots OUTLOOK.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" OUTLOOK.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" OUTLOOK.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" OUTLOOK.EXE - NTFS ADS 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\70M4BY4Z\Copy of Blank timesheet.xlsx:Zone.Identifier OUTLOOK.EXE File created C:\Users\Admin\Documents\Copy of Blank timesheet.xlsx\:Zone.Identifier:$DATA OUTLOOK.EXE File opened for modification C:\Users\Admin\Documents\Copy of Blank timesheet.xlsx:Zone.Identifier OUTLOOK.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4692 OUTLOOK.EXE - Suspicious use of SetWindowsHookEx 36 IoCs
pid Process 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE 4692 OUTLOOK.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Message.eml"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4692
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2564
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\70M4BY4Z\Copy of Blank timesheet.xlsx
- Size 46KB
- SHA256 759bb4ab9ce1d8f73a895cbda95f5f9e0ba21a09daf83df645a1171899e23369
- MD5 f0df30b7a4edf11b7960596bfd3b624c
- SHA1 96ed1fe6ce5bc4f5b2eae9f71bb8c78fa0c4e39e
- SHA512 dbf6790d72cb9b8251d62d35536a87b23e5f7b62fcc8023100b6547e78cfe6bb39c4626b1f310c85db7466c2c9c7885cbac3aee5848b4c48746c553f37d6d0d8
- SSDEEP 768:73OadBB3n1ldoDquQCSpixHsmf+2YATADp7gHj2MfxTSdFib2Cx9+9GSY7/5K4V:KadBR/dfXIHsePYNDpUHj1TMwUC/
- TLSH T1CF23D12CF227AC1CC576ACBAF81C04E5A20E85D1E299E50FB040E6193A171DF878F29D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512