8a6e2f21218fd9ea8daa69fc5a1c62d438087718a281524948e9f02a03694eb1

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/09/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Transferencia realizada.eml
Size 351KB
Sample260911-lrszhat1fz
SHA256 8a6e2f21218fd9ea8daa69fc5a1c62d438087718a281524948e9f02a03694eb1
MD5 c360cbe26864b433aeef801e980ef99a
SHA1 3a9056ecf1174a13d212ed0d2f924e9d3538c5aa
SHA512 20308c0e7dfe750812c323df1aa010f544b294ee00bcb72f3d592ff2f03f3a573abcfa5378e8d45575cae0ef764aba79ca6b9fc413728e0ff2e1c14ad9fa8acc
SSDEEP 6144:aR8w10znMgBgZwMVDVLKeSQOpLyZJEVUMOAa7Dl63VMRklULfddFO5a/:aC/znpBgZwMNV+gGLWEmAiU3qRokf7FR
TLSH
T1337423071EDB97CF05227BF1B27B7EC2715ACB81198E5265807AC36BA4C41146E6F1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware ransomware spyware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\KQMS6376\pago -898923-887340450909437-93434.tar:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\KQMS6376\pago -898923-887340450909437-93434 (002).tar\:Zone.Identifier:$DATA	OUTLOOK.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3736	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3368	OpenWith.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4664	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 54 IoCs

pid	Process
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
4664	OUTLOOK.EXE
3368	OpenWith.exe
4664	OUTLOOK.EXE
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe
3368	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 3736	3368	OpenWith.exe	91

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Transferencia realizada.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4664

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\KQMS6376\pago -898923-887340450909437-93434.tar
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pago -898923-887340450909437-93434.tar

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\KQMS6376\pago -898923-887340450909437-93434.tar
Size 249KB
SHA256 33256269f89069122c73e6e4bb0e2af65428cc80bfe19282637c4e6765602629
MD5 0e8e6035525273fdbe044a337aeff61d
SHA1 4c8916f50ee372ba1d46ec5e8d4fbfa41a3711a3
SHA512 95f62559275bb891463ab8b456498aa4c321066047190994001380d2d27f1be7d0b00d9640bd2617a94dcf0c2672956affb26d2898f8c4590732cbc6cbbf5753
SSDEEP 6144:OWWWhZEC8T7VwMa99/qgj+Njv11OOMjjBzefgQp:l9YhU/tydbwsg+
TLSH
T1DB4423E72408C5C2648FE9C1D370E0F7AB5C3D758EE1653AF68B8D557B28AA9CD3A400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pago -898923-887340450909437-93434.tar:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\KQMS6376\pago -898923-887340450909437-93434.tar:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

memory/4664-8-0x00007FFFA6E30000-0x00007FFFA7025000-memory.dmp

Download

memory/4664-9-0x00007FFF64B50000-0x00007FFF64B60000-memory.dmp

Download

memory/4664-4-0x00007FFF66EB0000-0x00007FFF66EC0000-memory.dmp

Download

memory/4664-5-0x00007FFF66EB0000-0x00007FFF66EC0000-memory.dmp

Download

memory/4664-7-0x00007FFFA6E30000-0x00007FFFA7025000-memory.dmp

Download

memory/4664-6-0x00007FFFA6E30000-0x00007FFFA7025000-memory.dmp

Download

memory/4664-0-0x00007FFF66EB0000-0x00007FFF66EC0000-memory.dmp

Download

memory/4664-2-0x00007FFF66EB0000-0x00007FFF66EC0000-memory.dmp

Download

memory/4664-10-0x00007FFF64B50000-0x00007FFF64B60000-memory.dmp

Download

memory/4664-3-0x00007FFF66EB0000-0x00007FFF66EC0000-memory.dmp

Download

memory/4664-59-0x00007FFFA6E30000-0x00007FFFA7025000-memory.dmp

Download

memory/4664-60-0x00007FFFA6ECD000-0x00007FFFA6ECE000-memory.dmp

Download

memory/4664-61-0x00007FFFA6E30000-0x00007FFFA7025000-memory.dmp

Download

memory/4664-63-0x00007FFFA6E30000-0x00007FFFA7025000-memory.dmp

Download

memory/4664-1-0x00007FFFA6ECD000-0x00007FFFA6ECE000-memory.dmp

Download