26a3395a4115355e897a7daf04551eba5e62da661d8dbae7c99205a2e74d24ba

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mailpv.exe
Size 110KB
Sample260913-allsfshr5w
SHA256 26a3395a4115355e897a7daf04551eba5e62da661d8dbae7c99205a2e74d24ba
MD5 782dd6152ab52361eba2bafd67771fa0
SHA1 5c5ff30a24a3858a8e9bd531dfef885d0b2a00c7
SHA512 a6d22daa93cf5eb2e57684bc0e3e0c177e4a4fe0cf9e072cab188a99178892eff92241ad6d94b20da487d88ce65f2a3ffc4d6a4dc293bf375d94fbc6b0449f53
SSDEEP 3072:1WSVGdlouHiwfXjObBBDTn991ix689w2KQik:1Wrdl9fzOzTna689V
TLSH
T186B36C4371E04472E5EE0A3035A66F729EF6B9321A358A0BD7B058477DF06E1ED2538B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

collection discovery

Malware Config

Signatures

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	mailpv.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	mailpv.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	mailpv.exe
Key queried	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	mailpv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mailpv.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4928	mailpv.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	mailpv.exe

C:\Users\Admin\AppData\Local\Temp\mailpv.exe
"C:\Users\Admin\AppData\Local\Temp\mailpv.exe"
1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- outlook_office_path
PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads