Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/07/2026, 23:38
General
- Target Re_ Catch Phish Phishing Report - Ticket Update from SWK Managed Cloud Services [ID_0062688] (1).eml
- Size 57KB
- Sample260709-3m57psay5m
- SHA256 c0305d4e8562c8566ddb8fc5ca916c6588f0ce06b4f19833d1b67fd8309acdc6
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 31 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Re_ Catch Phish Phishing Report - Ticket Update from SWK Managed Cloud Services [ID_0062688] (1).eml"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
warning[2].png
yelllow_mail[3].png
memory/2868-9-0x00007FF9E67A0000-0x00007FF9E6A03000-memory.dmp
memory/2868-10-0x00007FF9E67A0000-0x00007FF9E6A03000-memory.dmp
memory/2868-3-0x00007FF9E68FF000-0x00007FF9E6900000-memory.dmp
memory/2868-5-0x00007FF9E67A0000-0x00007FF9E6A03000-memory.dmp
memory/2868-7-0x00007FF9E67A0000-0x00007FF9E6A03000-memory.dmp
memory/2868-6-0x00007FF9A68E0000-0x00007FF9A68F0000-memory.dmp
memory/2868-0-0x00007FF9A68E0000-0x00007FF9A68F0000-memory.dmp
memory/2868-4-0x00007FF9A68E0000-0x00007FF9A68F0000-memory.dmp
memory/2868-11-0x00007FF9E67A0000-0x00007FF9E6A03000-memory.dmp
memory/2868-8-0x00007FF9E67A0000-0x00007FF9E6A03000-memory.dmp
memory/2868-12-0x00007FF9A3BB0000-0x00007FF9A3BC0000-memory.dmp
memory/2868-13-0x00007FF9A3BB0000-0x00007FF9A3BC0000-memory.dmp
memory/2868-2-0x00007FF9A68E0000-0x00007FF9A68F0000-memory.dmp
memory/2868-1-0x00007FF9A68E0000-0x00007FF9A68F0000-memory.dmp
memory/2868-107-0x00007FF9E67A0000-0x00007FF9E6A03000-memory.dmp