7a5b1cfb1cbc0a1a92d6b02356c6b98d89e20800c60dc0c0cc52442b5e064a51

Analysis

max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
phish_alert_sp2_2.0.0.0 (1).eml
Size 37KB
Sample260527-ynswjsa191
SHA256 7a5b1cfb1cbc0a1a92d6b02356c6b98d89e20800c60dc0c0cc52442b5e064a51
MD5 1af3b1a8687d9de56de8c0ee1e6c6b2e
SHA1 4feb2a9a5745d50640a9b533abe8592f48f918de
SHA512 9bc684e3d8eff44ac9e209a9090b9517c8a70189cb058ff9ac03e69f4218b0fbebff997b022fe942381c8ae60814892cedaf56f099b53b2a0259524c984b51f5
SSDEEP 768:K+t/dXW2ImAi+Ev0gy6Z/k+kOIkxEU5g1Cmuh3F0MrgUiWKvk6CbCNk+a+p:K+t02ImAi+E8gy6Z/k+kOIkxt5g1CTh8
TLSH
T1EB038EF29380681C95B6817AF1613DCC96A4053F5BF724249E2F12B6E1CA4B10F997FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware spyware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\PKJWYGWO\02140f2a-ef83-418d-9d3f-45d2111841a4.png:Zone.Identifier	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4844	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4844	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE
4844	OUTLOOK.EXE

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0 (1).eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

02140f2a-ef83-418d-9d3f-45d2111841a4.png

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\PKJWYGWO\02140f2a-ef83-418d-9d3f-45d2111841a4.png
Size 812B
SHA256 86dc33f753d461e6cc93aa4c846b3d9d2708171dce9d0bb85163cb40961272c3
MD5 84f31c408e3cf06c02486dbb6bda155c
SHA1 ca98c2d676e88c2e6ab6a7b084f3c8ef958843bd
SHA512 4b36e73c7e47deeef42b7d5a0e5c73d02b491f3d4823eb63533e75775e1bd67020007e469acea5338e27f85abcdaa4a02fd775457415b05393338674b21017d6
TLSH
T15A01C581C6D6DB9BD4B8868CA2A284327445B8B079F247BC2104785A6339088E88D20A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4844-5-0x00007FFCCDA40000-0x00007FFCCDC49000-memory.dmp

Download

memory/4844-2-0x00007FFC8DAD0000-0x00007FFC8DAE0000-memory.dmp

Download

memory/4844-3-0x00007FFCCDAE4000-0x00007FFCCDAE5000-memory.dmp

Download

memory/4844-0-0x00007FFC8DAD0000-0x00007FFC8DAE0000-memory.dmp

Download

memory/4844-6-0x00007FFCCDA40000-0x00007FFCCDC49000-memory.dmp

Download

memory/4844-1-0x00007FFC8DAD0000-0x00007FFC8DAE0000-memory.dmp

Download

memory/4844-7-0x00007FFC8DAD0000-0x00007FFC8DAE0000-memory.dmp

Download

memory/4844-8-0x00007FFCCDA40000-0x00007FFCCDC49000-memory.dmp

Download

memory/4844-9-0x00007FFC8B790000-0x00007FFC8B7A0000-memory.dmp

Download

memory/4844-10-0x00007FFC8B790000-0x00007FFC8B7A0000-memory.dmp

Download

memory/4844-4-0x00007FFC8DAD0000-0x00007FFC8DAE0000-memory.dmp

Download

memory/4844-51-0x00007FFCCDA40000-0x00007FFCCDC49000-memory.dmp

Download