6d1d9fc1328fc62646a4999edd29c7acaab8df0fb8ea3b3a8d08919fcf2a1bbf

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 00:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
phish_alert_sp2_2.0.0.0 (1).eml
Size 194KB
Sample260507-ablppsgs4q
SHA256 6d1d9fc1328fc62646a4999edd29c7acaab8df0fb8ea3b3a8d08919fcf2a1bbf
MD5 1d7355b6693893a2eb2a7ae5d46775fe
SHA1 259acc4699be1d81adc2925675f83ca334ad6aa0
SHA512 e7160f141f6e801c304cc188b393a45a518c09260ba9c2ca7e99d3e6cbf37ece0d54aaac4c9833844c3d2a3e630b6e3494acf0e1e7e20de98a9dda50e3911b1f
SSDEEP 3072:lL6kZcCZomEoFXkOmCFEpozYRPz253IEGm/mjx7XuSy+mVGEYG:lL68cCZTEo61CWZFEsXJy3tN
TLSH
T11814D0B3E5C4BC45A2A70DC4904736642D3C2AA386A956F8794D33FC33DDCAD86589BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	cmd.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0 (1).eml:OECustomProperty	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1464	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0 (1).eml"
1⤵
- Modifies registry class
- NTFS ADS
PID:4320

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1464-4-0x00000262515C0000-0x0000026251663000-memory.dmp

Download

memory/4320-3-0x0000025433320000-0x00000254333CF000-memory.dmp