df14a5f2562c402a7edbad2f045a5a84210846a30eeb9e26961b7fb7eadb266f

Resubmissions

03/07/2026, 04:03

260703-emtxnsbs8z1

02/07/2026, 03:41

02/07/2026, 03:37

02/07/2026, 03:36

02/07/2026, 03:32

Analysis

max time kernel
300s
max time network
247s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 03:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
message (29).eml
Size 3.6MB
Sample260702-d6hs3sbv8x
SHA256 df14a5f2562c402a7edbad2f045a5a84210846a30eeb9e26961b7fb7eadb266f
MD5 739f4189becaa7bde66bf336cc6d44b9
SHA1 acd0d78466bc4dbb96075c79401de6293e053e48
SHA512 c2370fd83e40dc890c36bf18e825b1844053d59e34c7b2458a82d6cb14a19b61b945284429f1996d9022c172cd2bd141f0387319ff8da32cd64366e5e68a8449
SSDEEP 49152:X6VqAF0fVEYNH0dN/AFq/FE/t0dOO9x6OjAfSwpIjf:o
TLSH
T17C0623784EC73FE90B219AF5B60DFD857C5823C705425692436CC9A438F9878DB92CBA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware spyware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\NIUKEC0O\IMG_4830.PNG:Zone.Identifier	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4136	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4136	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE
4136	OUTLOOK.EXE

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\message (29).eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IMG_4830.PNG

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\NIUKEC0O\IMG_4830.PNG
Size 515KB
SHA256 e9bb0cde176656638d5cec122861481408596e075dc7ab9fac8e45dbdf69d4fa
MD5 99160ac963e8aedb64403705d3472781
SHA1 4d0c6cf898e3111d07da429e48b47eee4c215e13
SHA512 13038d8b392489d260debbb99f0b11af857c1e254b0c94b83efb80d56bdf34c73f8f404988dfb6ee7933a7af6ac35306b915747d077558003c0fb6ef865bfa9b
SSDEEP 12288:Veml3tEsG6iMNzA3eN8nLLdWlIv/qA/wuRfXtz3QAWLsLYMa0gDO:Veml3tYIU3eNWLdWlkq/xAcMafDO
TLSH
T1C5B42312E291250F4F65832CC1DEFF87DBAA15F1B946403D3C6C9E5A7A2C242FC1A75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4136-6-0x00007FF837070000-0x00007FF837265000-memory.dmp

Download

memory/4136-9-0x00007FF837070000-0x00007FF837265000-memory.dmp

Download

memory/4136-5-0x00007FF7F70F0000-0x00007FF7F7100000-memory.dmp

Download

memory/4136-4-0x00007FF7F70F0000-0x00007FF7F7100000-memory.dmp

Download

memory/4136-0-0x00007FF7F70F0000-0x00007FF7F7100000-memory.dmp

Download

memory/4136-1-0x00007FF7F70F0000-0x00007FF7F7100000-memory.dmp

Download

memory/4136-7-0x00007FF837070000-0x00007FF837265000-memory.dmp

Download

memory/4136-3-0x00007FF83710D000-0x00007FF83710E000-memory.dmp

Download

memory/4136-10-0x00007FF837070000-0x00007FF837265000-memory.dmp

Download

memory/4136-8-0x00007FF837070000-0x00007FF837265000-memory.dmp

Download

memory/4136-11-0x00007FF7F48D0000-0x00007FF7F48E0000-memory.dmp

Download

memory/4136-12-0x00007FF7F48D0000-0x00007FF7F48E0000-memory.dmp

Download

memory/4136-2-0x00007FF7F70F0000-0x00007FF7F7100000-memory.dmp

Download

memory/4136-60-0x00007FF837070000-0x00007FF837265000-memory.dmp

Download