630a984809bc626a46ff5aab9866303f6312b3e9fa23f45c1c72cd14f373d87e

Analysis

max time kernel
270s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 16:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uploads_2fd77bd8-9c49-4f06-8eaf-a3e8cf4852ae.eml
Size 69KB
Sample260916-tz73dsshne
SHA256 630a984809bc626a46ff5aab9866303f6312b3e9fa23f45c1c72cd14f373d87e
MD5 ec215b6884505b7b2fa0dcb00939d025
SHA1 5f3fc310700797e4b207810486403b080e3a0081
SHA512 ed7c6e03355989db36e48117067b97a04f3d4bc39b1fb529201875710e0b768daeb23ba59caa0fd018eb8fdc13190c442652885a4454ce227275c08d3fd69807
SSDEEP 1536:wLvtgP4jawL5GHMZ96yPmPUIFXgscm1PFnL7z1jBe:WiP4jagSM9OLPe
TLSH
T14363BFB48A591C16C43331F47C233F0E56621E5FE33771E078BA66B612DE580AF5B2A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware spyware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\05RBXFEN\aG9tZQcHJvdmlzaW9uYWwZXh0cmEbWlja3Jvc29mdA.png:Zone.Identifier	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\05RBXFEN\LocalimageImage.png:Zone.Identifier	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5776	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5776	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE
5776	OUTLOOK.EXE

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\uploads_2fd77bd8-9c49-4f06-8eaf-a3e8cf4852ae.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LocalimageImage.png

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\05RBXFEN\LocalimageImage.png
Size 10KB
SHA256 9bb82a37df7fdfab3a7410870ac0dc37af3719657c77ab8770f37540a7924f76
MD5 a63518f1052ad511106017614fc84354
SHA1 2d51522fe92b6f3a92a9c6bbb40fefaf0a3f26db
SHA512 5a00432b61e9b1be34549817297eb525bbc09e6f0dc5e06c5c1cb3eb9d7e365ecf16d34a5f0dbdd9aa316213a48977ef9a835981ab0f0d5e0f4bed0217fc7083
SSDEEP 192:cLr9nx0BZaTN1fMoyL291OnLWZ4nz6zEslhzo6uxl4UYZcw7ffZeULIqWRY:MgBZaTN9OLo1SW/z9lhruxl4Uw7fg+W6
TLSH
T1E322C01F1203673FC33983BD18C492A1535070F9D0D499157A9836346DFAADAF75179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aG9tZQcHJvdmlzaW9uYWwZXh0cmEbWlja3Jvc29mdA.png

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\05RBXFEN\aG9tZQcHJvdmlzaW9uYWwZXh0cmEbWlja3Jvc29mdA.png
Size 1KB
SHA256 796c018e51da2e92db9ed506ca3f6bd54dd582cea56f144cb28afc2acd95be94
MD5 d2f8af8e59fd307326d4e9c4fa90a05d
SHA1 16d05597b74a7ad7a7afe077c0b959e951cac2b0
SHA512 dae55b3b1cf9b46ed5c52179e7131269c47861bae8b3f01e1e951c21be3e1f5d5e543ca9245b467c125341b2b256e1cbb2bbe631bb0ed7cbbc3ffb185ae65abc
TLSH
T1A6317463BB88EC0D8CEA23D2D69F783BC03083142512DA31D3EC14A334A0A4E3894DE3
MD5 SHA1 SHA512 TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/5776-2-0x00007FFDF1610000-0x00007FFDF1620000-memory.dmp

Download

memory/5776-12-0x00007FFDEF3D0000-0x00007FFDEF3E0000-memory.dmp

Download

memory/5776-0-0x00007FFDF1610000-0x00007FFDF1620000-memory.dmp

Download

memory/5776-6-0x00007FFE31590000-0x00007FFE31785000-memory.dmp

Download

memory/5776-8-0x00007FFE31590000-0x00007FFE31785000-memory.dmp

Download

memory/5776-7-0x00007FFE31590000-0x00007FFE31785000-memory.dmp

Download

memory/5776-9-0x00007FFE31590000-0x00007FFE31785000-memory.dmp

Download

memory/5776-10-0x00007FFE31590000-0x00007FFE31785000-memory.dmp

Download

memory/5776-11-0x00007FFE31590000-0x00007FFE31785000-memory.dmp

Download

memory/5776-4-0x00007FFDF1610000-0x00007FFDF1620000-memory.dmp

Download

memory/5776-13-0x00007FFDEF3D0000-0x00007FFDEF3E0000-memory.dmp

Download

memory/5776-5-0x00007FFDF1610000-0x00007FFDF1620000-memory.dmp

Download

memory/5776-3-0x00007FFDF1610000-0x00007FFDF1620000-memory.dmp

Download

memory/5776-1-0x00007FFE3162D000-0x00007FFE3162E000-memory.dmp

Download

memory/5776-78-0x00007FFE31590000-0x00007FFE31785000-memory.dmp

Download

memory/5776-80-0x00007FFE31590000-0x00007FFE31785000-memory.dmp

Download

memory/5776-79-0x00007FFE3162D000-0x00007FFE3162E000-memory.dmp

Download

memory/5776-81-0x00007FFE31590000-0x00007FFE31785000-memory.dmp

Download