566791b64fa70c0c7e002ce80b300fc99355f2b82df31f7e879deb05cebc32f8

Analysis

user interaction
yes
max time kernel
147s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 19:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Message.eml
Size 34KB
Sample261104-yp8ndsc13y
SHA256 566791b64fa70c0c7e002ce80b300fc99355f2b82df31f7e879deb05cebc32f8
MD5 0eda80287b97540877552e5cc8311f01
SHA1 bed9e521ecd806d15309d53de88b768c6461096a
SHA512 8c895fedf3f6db477851993f2bb8e4e9cf52f1d000aec9ed2a3ba5a6e4007d96d88e2a3a87d4c2e43ad5d188837427546827b814216349c7dd753f3f037df1c8
SSDEEP 384:hzT79caBrh/OUNlKwEQdX301d7F29RofWyKB6uJuG/AiooUp29wH5xpqPAJk:hzT7lBr9LNDEQdiF29RofWyKBY5jk
TLSH
T102F2EC17F3D01842C9BF4860A4033B7D7B795ACA9B725EB0649F3B7D0A8DCC2A6C6255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5524	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3044	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3044	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 35 IoCs

pid	Process
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
3044	OUTLOOK.EXE
2324	notepad.exe
2324	notepad.exe
2324	notepad.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 1220	4712	chrome.exe	93

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Message.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3044

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff0d21c728,0x7fff0d21c734,0x7fff0d21c740
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,9527049296578536074,1089416136492210075,262144 --field-trial-handle=1896,i,16335351308509316557,2867694735869508741,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,8550419898882584300,718908267952445982,524288 --field-trial-handle=1896,i,16335351308509316557,2867694735869508741,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,2518038096113113155,13225471016548679117,524288 --field-trial-handle=1896,i,16335351308509316557,2867694735869508741,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:13
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,4403878810519182351,5440394339521088073,2097152 --field-trial-handle=1896,i,16335351308509316557,2867694735869508741,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3364,i,14137806902768953549,10334618453262492504,2097152 --field-trial-handle=1896,i,16335351308509316557,2867694735869508741,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4544,i,3124258680433699873,17431084614239881714,2097152 --field-trial-handle=1896,i,16335351308509316557,2867694735869508741,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4848,i,6346133812204723842,14142767275456243728,524288 --field-trial-handle=1896,i,16335351308509316557,2867694735869508741,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:4540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7c847ade-af81-4f43-8e56-d64884331e97.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7c847ade-af81-4f43-8e56-d64884331e97.tmp
Size 4KB
SHA256 9c4f4b8e5efaf1b7f6be1465bed730087367d95f64dc527f6b13d24f7e7bd300
MD5 2d1952db50a7333d8973e5825e61c74c
SHA1 507c943f4bd1125b13c99dc2d4b2c6c68f118142
SHA512 b88ed04082a3c9df57300ddb78cf2be6ca6b8bd3d2a7c1bad21c44c4dde7a3314d2d6a0a18fbafc16f2ca8a86567ffe587264c679b7d1ab187ccc5133c54a55f
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUBdyRDotok5Bdp0cDBFB6vGyvtBWG0c6q3bOj:CC0oWqNVVxi+9oP8DUDBX0KB7DeW9c6d
TLSH
T13FA12B31A879997789F6D585B1862E53CF7970AB6521EFD4E8EE1D1C10B30EC0342527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f6ed17d-d55a-4f9e-920e-0a54dc31189a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4f6ed17d-d55a-4f9e-920e-0a54dc31189a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

memory/3044-4-0x00007FFF38BE0000-0x00007FFF38E43000-memory.dmp

Download

memory/3044-6-0x00007FFF38BE0000-0x00007FFF38E43000-memory.dmp

Download

memory/3044-5-0x00007FFEF8D20000-0x00007FFEF8D30000-memory.dmp

Download

memory/3044-7-0x00007FFEF8D20000-0x00007FFEF8D30000-memory.dmp

Download

memory/3044-8-0x00007FFF38BE0000-0x00007FFF38E43000-memory.dmp

Download

memory/3044-9-0x00007FFF38BE0000-0x00007FFF38E43000-memory.dmp

Download

memory/3044-10-0x00007FFEF60A0000-0x00007FFEF60B0000-memory.dmp

Download

memory/3044-11-0x00007FFEF60A0000-0x00007FFEF60B0000-memory.dmp

Download

memory/3044-0-0x00007FFEF8D20000-0x00007FFEF8D30000-memory.dmp

Download

memory/3044-51-0x00007FFF38BE0000-0x00007FFF38E43000-memory.dmp

Download

memory/3044-3-0x00007FFF38D3F000-0x00007FFF38D40000-memory.dmp

Download

memory/3044-1-0x00007FFEF8D20000-0x00007FFEF8D30000-memory.dmp

Download

memory/3044-2-0x00007FFEF8D20000-0x00007FFEF8D30000-memory.dmp

Download