df14a5f2562c402a7edbad2f045a5a84210846a30eeb9e26961b7fb7eadb266f

Resubmissions

03/07/2026, 04:03

260703-emtxnsbs8z1

02/07/2026, 03:41

02/07/2026, 03:37

02/07/2026, 03:36

02/07/2026, 03:32

Analysis

user interaction
yes
max time kernel
298s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 03:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
message (29).eml
Size 3.6MB
Sample260702-d6hs3sbv8x
SHA256 df14a5f2562c402a7edbad2f045a5a84210846a30eeb9e26961b7fb7eadb266f
MD5 739f4189becaa7bde66bf336cc6d44b9
SHA1 acd0d78466bc4dbb96075c79401de6293e053e48
SHA512 c2370fd83e40dc890c36bf18e825b1844053d59e34c7b2458a82d6cb14a19b61b945284429f1996d9022c172cd2bd141f0387319ff8da32cd64366e5e68a8449
SSDEEP 49152:X6VqAF0fVEYNH0dN/AFq/FE/t0dOO9x6OjAfSwpIjf:o
TLSH
T17C0623784EC73FE90B219AF5B60DFD857C5823C705425692436CC9A438F9878DB92CBA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware spyware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\KQ2QOTCS\IMG_4830.PNG:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\KQ2QOTCS\IMG_4830 (002).PNG\:Zone.Identifier:$DATA	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 38 IoCs

pid	Process
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE
2204	OUTLOOK.EXE

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\message (29).eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IMG_4830.PNG

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\KQ2QOTCS\IMG_4830.PNG
Size 515KB
SHA256 e9bb0cde176656638d5cec122861481408596e075dc7ab9fac8e45dbdf69d4fa
MD5 99160ac963e8aedb64403705d3472781
SHA1 4d0c6cf898e3111d07da429e48b47eee4c215e13
SHA512 13038d8b392489d260debbb99f0b11af857c1e254b0c94b83efb80d56bdf34c73f8f404988dfb6ee7933a7af6ac35306b915747d077558003c0fb6ef865bfa9b
SSDEEP 12288:Veml3tEsG6iMNzA3eN8nLLdWlIv/qA/wuRfXtz3QAWLsLYMa0gDO:Veml3tYIU3eNWLdWlkq/xAcMafDO
TLSH
T1C5B42312E291250F4F65832CC1DEFF87DBAA15F1B946403D3C6C9E5A7A2C242FC1A75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NormalEmail.dotm

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm
Size 18KB
SHA256 cebe6dd7f9b3d01dbee641808393883e3fdb4af04ac7c4c308c4a1e0e85fd244
MD5 1011de01897bf021e567c06872b05ad4
SHA1 25dbd5160084bad46185d92e7530e7dc77ab5359
SHA512 dcce0ae8d2dd40b8201f2e1349e2d81d404e2011ddef0a58ad827cd76612d427756f259379bcd090b542afdc7d4c70b8dbaafc37cc8d6cb517221088f691fe05
SSDEEP 384:Jmk+xRLymSajQ7ffEHMCNbuJdkOw0sZxMJGG2e/jdJXPZLbvEheF:2wGQ70HMCVuiuGO/BCeF
TLSH
T1A4829D3ED60074A9C2F2C67D90A852F2F6580C57F724626B685A77CCCE4898B6353AC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2204-12-0x00007FFD7D360000-0x00007FFD7D5C3000-memory.dmp

Download

memory/2204-11-0x00007FFD7D360000-0x00007FFD7D5C3000-memory.dmp

Download

memory/2204-4-0x00007FFD3D4A0000-0x00007FFD3D4B0000-memory.dmp

Download

memory/2204-6-0x00007FFD3D4A0000-0x00007FFD3D4B0000-memory.dmp

Download

memory/2204-7-0x00007FFD7D360000-0x00007FFD7D5C3000-memory.dmp

Download

memory/2204-5-0x00007FFD7D360000-0x00007FFD7D5C3000-memory.dmp

Download

memory/2204-8-0x00007FFD7D360000-0x00007FFD7D5C3000-memory.dmp

Download

memory/2204-10-0x00007FFD7D360000-0x00007FFD7D5C3000-memory.dmp

Download

memory/2204-0-0x00007FFD3D4A0000-0x00007FFD3D4B0000-memory.dmp

Download

memory/2204-2-0x00007FFD3D4A0000-0x00007FFD3D4B0000-memory.dmp

Download

memory/2204-9-0x00007FFD7D360000-0x00007FFD7D5C3000-memory.dmp

Download

memory/2204-13-0x00007FFD7D360000-0x00007FFD7D5C3000-memory.dmp

Download

memory/2204-14-0x00007FFD7D360000-0x00007FFD7D5C3000-memory.dmp

Download

memory/2204-15-0x00007FFD3AA40000-0x00007FFD3AA50000-memory.dmp

Download

memory/2204-16-0x00007FFD3AA40000-0x00007FFD3AA50000-memory.dmp

Download

memory/2204-3-0x00007FFD7D4BF000-0x00007FFD7D4C0000-memory.dmp

Download

memory/2204-62-0x00007FFD7D360000-0x00007FFD7D5C3000-memory.dmp

Download

memory/2204-1-0x00007FFD3D4A0000-0x00007FFD3D4B0000-memory.dmp

Download

memory/2204-128-0x00007FFD7D360000-0x00007FFD7D5C3000-memory.dmp

Download