5d606065d3ed64d11a44fe5e2e68a4ade147e9e29a3239366c1c63a8e115ead1

Resubmissions

09/08/2026, 10:43

260809-mr94fszsev1

09/08/2026, 10:33

260809-mln9sswdla1

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
attachment (60).eml
Size 81KB
Sample260809-mln9sswdla
SHA256 5d606065d3ed64d11a44fe5e2e68a4ade147e9e29a3239366c1c63a8e115ead1
MD5 0881ccd2573d13586f527c28cb08336a
SHA1 b701983964ec48ffcde00f4bf2de74f31310829a
SHA512 841a3b686d37ca67ac6d6a1db27df6a7e24122f9283e58ac87e4cdbb1ed422edbe698f11b1c22dc707ea5923ad11463a39d19863d45a4d0a7b37b38ef5f9453c
SSDEEP 1536:47/abZ/vK+U1GHhyIjejhsvQD42x26s+Aq+GJmw6xzaddnqZUqlj5GnqlMlPC25C:47ybZ3K+RB9jCiI164qZNj5MC6e
TLSH
T11D83D07205471291DEB305809C28BF1B6D31BE4B71BBC082AEADD2DF52C25BF7E65825
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware spyware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies registry class 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3716	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE
3716	OUTLOOK.EXE

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\attachment (60).eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3716-0-0x00007FFB419F0000-0x00007FFB41A00000-memory.dmp

Download

memory/3716-3-0x00007FFB81A0D000-0x00007FFB81A0E000-memory.dmp

Download

memory/3716-4-0x00007FFB419F0000-0x00007FFB41A00000-memory.dmp

Download

memory/3716-2-0x00007FFB419F0000-0x00007FFB41A00000-memory.dmp

Download

memory/3716-1-0x00007FFB419F0000-0x00007FFB41A00000-memory.dmp

Download

memory/3716-5-0x00007FFB419F0000-0x00007FFB41A00000-memory.dmp

Download

memory/3716-7-0x00007FFB81970000-0x00007FFB81B65000-memory.dmp

Download

memory/3716-6-0x00007FFB81970000-0x00007FFB81B65000-memory.dmp

Download

memory/3716-8-0x00007FFB81970000-0x00007FFB81B65000-memory.dmp

Download

memory/3716-9-0x00007FFB81970000-0x00007FFB81B65000-memory.dmp

Download

memory/3716-10-0x00007FFB3F090000-0x00007FFB3F0A0000-memory.dmp

Download

memory/3716-11-0x00007FFB3F090000-0x00007FFB3F0A0000-memory.dmp

Download

memory/3716-30-0x00007FFB81970000-0x00007FFB81B65000-memory.dmp

Download