ed7d4ccd7ff7a68d85182a46ca2c7597983df8a4ad9ee0498495546b45f06528

Analysis

user interaction
yes
max time kernel
268s
max time network
270s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fwd_ Case Ref 1682312 Confidential 2026-07-15T01_55_07+01_00.eml
Size 3.9MB
Sample260715-bat55abt7s
SHA256 ed7d4ccd7ff7a68d85182a46ca2c7597983df8a4ad9ee0498495546b45f06528
MD5 6530e8d0922b06dd82c8830c456718c8
SHA1 f9cd4d411560ddbb721591c9e9d28951b43045c3
SHA512 5aed11d898a09e0d740cc9dee9892b615516f2ee19a0fc198709cca17dd9029d894210adfa83285c841309c16174c48f3a405b06662c703d84935382a7c843f7
SSDEEP 49152:Wxte8BAedNn1oT0wH58hr8Fpds2/2aXqqSfTzqpt:V
TLSH
T113161339EC0A15D65714A0BFF22BBC906C9C7B1B1C8702EAF37D5294B1E857446A2CED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware spyware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DH6JLZJG\image001.png:Zone.Identifier	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DH6JLZJG\image003.png:Zone.Identifier	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DH6JLZJG\image005.png:Zone.Identifier	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DH6JLZJG\image002.png:Zone.Identifier	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4636	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4636	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE
4636	OUTLOOK.EXE

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Fwd_ Case Ref 1682312 Confidential 2026-07-15T01_55_07+01_00.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

image001.png

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DH6JLZJG\image001.png
Size 24KB
SHA256 14e94f7c260f94902bd5f43fc33d02c9b9fb48ac96c01c8c47684613d97c8455
MD5 a0e30449306173d7ac1fe555d6b43066
SHA1 b669f28642d5a9eae4a741bc779dbac861cf727c
SHA512 5f8df0f48ba90921fa7d93665879e653808b94a7fff3c20fbe943ca1a16a9b94655e810deffcab16cad5c2b44a5cf005b8bfdf755719ca6c034b2c71f4fdf446
SSDEEP 768:CsGtyN2JGCWFW+o84Dyki09PmgYOlRhPv:q7PWE84mki/gYcRVv
TLSH
T1FAB2E10AD375216073815324F7D4A8F828B6E6A35F025CBE94891815DC3ECAF2ECC66F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image002.png

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DH6JLZJG\image002.png
Size 164B
SHA256 7a5830e5d19a48807b264972484512e31529852db6320f0da0657d09dd2ffb9b
MD5 f69c70769ae7eb8bf32800b9285e6f40
SHA1 f0011ac85641f6222b24b796b96b7cbb6b68585d
SHA512 0e4aad64317920c6e3286b0874ddb87b1214b20b7d68d1b643891153e822dbd1cdff7ec1330653dcd76b39f1b193d377b146eab3e81d6768e8c74d86d79e486e
TLSH
T1AFC024F341C41C7DCF45413713F35011545515DF51101407DD15D33C54151DCC745743
MD5 SHA1 SHA512 TLSH

Submit Download

image003.png

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DH6JLZJG\image003.png
Size 204B
SHA256 788c43934e997c10901b086c357041eaaf68bb4c9d95412035007b8a8b4454ee
MD5 e4e50f7fc07e376a154bfb16d61cf421
SHA1 59a41f867126c25f54d2269c7026af85f96edc80
SHA512 98bc23bd6b3a1bfea341e20cc13e7d257be75716d64d1f2ed040d86d1d3f348fdfda882ad29086e42bfff7d3bf8e6cc1e539ad34be2933cc6a35be2862679a21
TLSH
T145D022EFF1438E79C2004A3B42A40A42BA7F139BDC195D1C6013E2580E5A99FE4ECA83
MD5 SHA1 SHA512 TLSH

Submit Download

image005.png

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DH6JLZJG\image005.png
Size 1KB
SHA256 621552927e0c6e133bb644838a68e778eec403998130662fc7403633de09c897
MD5 969de082dfbf3454c3466a9164fb1f16
SHA1 aee508d5ade084b984a19090b4403d1e3b5ba577
SHA512 8ef0afd006fb48ecefa3cc546b59d6791c2bb20d67a1bdc6627d53abe6a5c03cf7abb884cd09ad3a7b6cb14f7ae818244439392ab7eb4708d6f6aa58304046eb
TLSH
T14121E9C3624CC2C4D80DE255798CD5418C5668C70961A161C8393BBC8F3C3A602D06E7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4636-5-0x00007FF89B560000-0x00007FF89B570000-memory.dmp

Download

memory/4636-11-0x00007FF899150000-0x00007FF899160000-memory.dmp

Download

memory/4636-6-0x00007FF8DB420000-0x00007FF8DB683000-memory.dmp

Download

memory/4636-7-0x00007FF89B560000-0x00007FF89B570000-memory.dmp

Download

memory/4636-8-0x00007FF8DB420000-0x00007FF8DB683000-memory.dmp

Download

memory/4636-10-0x00007FF8DB420000-0x00007FF8DB683000-memory.dmp

Download

memory/4636-9-0x00007FF8DB420000-0x00007FF8DB683000-memory.dmp

Download

memory/4636-0-0x00007FF89B560000-0x00007FF89B570000-memory.dmp

Download

memory/4636-12-0x00007FF899150000-0x00007FF899160000-memory.dmp

Download

memory/4636-3-0x00007FF8DB57F000-0x00007FF8DB580000-memory.dmp

Download

memory/4636-4-0x00007FF8DB420000-0x00007FF8DB683000-memory.dmp

Download

memory/4636-2-0x00007FF89B560000-0x00007FF89B570000-memory.dmp

Download

memory/4636-1-0x00007FF89B560000-0x00007FF89B570000-memory.dmp

Download

memory/4636-80-0x00007FF8DB420000-0x00007FF8DB683000-memory.dmp

Download

memory/4636-79-0x00007FF8DB420000-0x00007FF8DB683000-memory.dmp

Download

memory/4636-78-0x00007FF8DB420000-0x00007FF8DB683000-memory.dmp

Download