d953b228db07ed0075ef448b0c7e0a7f381d459c22b911b7425765c5edb12e44

Analysis

user interaction
yes
max time kernel
139s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20261104230234-RV_ Información Centros Comerciales Sankris Mall y Rus Mall para propuesta solar-ncordero.eml
Size 12.6MB
Sample261104-3dxtzad19v
SHA256 d953b228db07ed0075ef448b0c7e0a7f381d459c22b911b7425765c5edb12e44
MD5 654c660069d7ef7e031423c04d90c8f8
SHA1 0ac6eb099dc580daf89ba9ba809c720b2edac5dd
SHA512 d9e8e64cea944118fce90c516df77b92943b9a43595616cb41d1b4c3d65c7559cd84585b3ccd600139ec1ff4d1ba0415592a1043dc91df476fbee7041b7b96e3
SSDEEP 49152:oj9p7n0ahUcxpyqj2ixV7C267KhNr+OMEPGjid5bjlAPDcL+k/J2abTiFoO67Czh:7
TLSH
T11DD62378994927DF0E10E2F6B656B849B9C827C74D82131743BCC6B134E54B8DBA7CB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware spyware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\SCBVGBYW\RUS MALL.zip:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\SCBVGBYW\RUS MALL (002).zip\:Zone.Identifier:$DATA	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\SCBVGBYW\SANKRIS MALL.rar:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\SCBVGBYW\SANKRIS MALL (002).rar\:Zone.Identifier:$DATA	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3132	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3132	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 37 IoCs

pid	Process
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
1236	OpenWith.exe
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE
3132	OUTLOOK.EXE

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\20261104230234-RV_ Información Centros Comerciales Sankris Mall y Rus Mall para propuesta solar-ncordero.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3132

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4324

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RUS MALL.zip

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\SCBVGBYW\RUS MALL.zip
Size 4.4MB
SHA256 a602ef24976d5e6656276f74b7c3cc4b6b283a4e6f9c45e589c4ef75f4e8173a
MD5 30ce71510d347ed956413985c79a7a0b
SHA1 1c1597f43cdbd7911f0d63d8fc60929d537eca7c
SHA512 17edffaed56ba553450248c19153569a145c99343fc99e1558d6c7940caa104f2ab71f5a224137bdd567e4cac9d6ba34e787088c1d5bba3297f0e4de10757877
SSDEEP 98304:rP0YPwwmgcuueFzM33hR56Spij+irHZTXd/8Ty9xTYToohKu2:rn9I1SzARaSpbijVh8TybioO2
TLSH
T1802633D6DB01B690E01DB73C62EA6A11C087C70D56B6DFBBE5C2C54BE3983895F23624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SANKRIS MALL.rar

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\SCBVGBYW\SANKRIS MALL.rar
Size 4.7MB
SHA256 fc3aff929e9f9751e0c7dd95559e805b4c826bd443bcb7c73ac15701fd3f4731
MD5 a455687c37d695f350f5fa33c326d45d
SHA1 d00a5f1b6908c44095ccb1a0c8279bb2edbdc708
SHA512 32479483d7fbd85d42d4cf3fb54412d37e2dede7e5677e2be0ff005b60237a045893cb39bf7aec78a0f63473b16878fa2f82314e163289e794908f30b3cf8098
SSDEEP 98304:mTBoIpvj/PFDgrNhe5hz4qiLLQFfVIzs1FRo02VJ0PRc1:mTBoIr8bevvinQ9VIWT52b0PR4
TLSH
T1213633C99E2CC36DC926FDE4612677116225E9056133AF6B3CF3F9A4ED9CA16CC5008B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SANKRIS MALL.rar:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\SCBVGBYW\SANKRIS MALL.rar:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

memory/3132-8-0x00007FFA13370000-0x00007FFA13565000-memory.dmp

Download

memory/3132-10-0x00007FFA13370000-0x00007FFA13565000-memory.dmp

Download

memory/3132-7-0x00007FFA13370000-0x00007FFA13565000-memory.dmp

Download

memory/3132-6-0x00007FFA13370000-0x00007FFA13565000-memory.dmp

Download

memory/3132-0-0x00007FF9D33F0000-0x00007FF9D3400000-memory.dmp

Download

memory/3132-9-0x00007FFA13370000-0x00007FFA13565000-memory.dmp

Download

memory/3132-11-0x00007FF9D1020000-0x00007FF9D1030000-memory.dmp

Download

memory/3132-5-0x00007FF9D33F0000-0x00007FF9D3400000-memory.dmp

Download

memory/3132-12-0x00007FF9D1020000-0x00007FF9D1030000-memory.dmp

Download

memory/3132-4-0x00007FF9D33F0000-0x00007FF9D3400000-memory.dmp

Download

memory/3132-43-0x00007FFA13370000-0x00007FFA13565000-memory.dmp

Download

memory/3132-3-0x00007FFA1340D000-0x00007FFA1340E000-memory.dmp

Download

memory/3132-1-0x00007FF9D33F0000-0x00007FF9D3400000-memory.dmp

Download

memory/3132-2-0x00007FF9D33F0000-0x00007FF9D3400000-memory.dmp

Download