b51270fefe5a60aff177e69cbdb24fe10142f65f683664e3a1f55d227c802031

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RV_ Audiencia De Control De Legalidad - Oficina_ Juzgado Séptimo (Laboral Del Circuito) – - Ref..eml
Size 9.6MB
Sample260929-qy4rss1erd
SHA256 b51270fefe5a60aff177e69cbdb24fe10142f65f683664e3a1f55d227c802031
MD5 6918c3fa24f8c6cfa387bf1aa57038dd
SHA1 82a1d2565daff46fd35995b40d458744cdf6f98c
SHA512 62f22bf892f62252c823fed0162f9faa613ce1eaae658a46fee0099eacfd4dc37e1559107e2982c96795186fe164df13dcf27a8ba42c9d7421049c48ddb9f508
SSDEEP 49152:tzv2KYuyiFGdDVBMGSL9ibBMdeBtvemn0aAEfXaQXdBgCAUBuGjTjeC9IQRD80xc:H
TLSH
T109A64BB323EF6A8E5905376CA44D2A5C0F5FD0615EC3A7D880DB0AD4104F85F6AD4ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware spyware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1544	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1544	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE
1544	OUTLOOK.EXE

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\RV_ Audiencia De Control De Legalidad - Oficina_ Juzgado Séptimo (Laboral Del Circuito) – - Ref..eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-0-0x00007FFB75D00000-0x00007FFB75D10000-memory.dmp

Download

memory/1544-2-0x00007FFB75D00000-0x00007FFB75D10000-memory.dmp

Download

memory/1544-4-0x00007FFB75D00000-0x00007FFB75D10000-memory.dmp

Download

memory/1544-6-0x00007FFBB5BC0000-0x00007FFBB5E23000-memory.dmp

Download

memory/1544-5-0x00007FFBB5BC0000-0x00007FFBB5E23000-memory.dmp

Download

memory/1544-3-0x00007FFBB5D1F000-0x00007FFBB5D20000-memory.dmp

Download

memory/1544-7-0x00007FFBB5BC0000-0x00007FFBB5E23000-memory.dmp

Download

memory/1544-10-0x00007FFBB5BC0000-0x00007FFBB5E23000-memory.dmp

Download

memory/1544-11-0x00007FFBB5BC0000-0x00007FFBB5E23000-memory.dmp

Download

memory/1544-9-0x00007FFBB5BC0000-0x00007FFBB5E23000-memory.dmp

Download

memory/1544-8-0x00007FFB75D00000-0x00007FFB75D10000-memory.dmp

Download

memory/1544-1-0x00007FFB75D00000-0x00007FFB75D10000-memory.dmp

Download

memory/1544-12-0x00007FFB72FD0000-0x00007FFB72FE0000-memory.dmp

Download

memory/1544-13-0x00007FFB72FD0000-0x00007FFB72FE0000-memory.dmp

Download

memory/1544-48-0x00007FFBB5BC0000-0x00007FFBB5E23000-memory.dmp

Download