d7babe6e2a18ace4c431d738e5dc3e6b1b7646c8e18ea9576940fe1ccf7be8c7

Resubmissions

09/10/2026, 16:41

261009-t7capa116l1

09/10/2026, 16:35

261009-t3xe3acf681

09/10/2026, 16:29

261009-tzbdeszzfv1

Analysis

user interaction
yes
max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 16:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Potential Phish - 2026-10-09T132835.260.eml
Size 12KB
Sample261009-t3xe3acf68
SHA256 d7babe6e2a18ace4c431d738e5dc3e6b1b7646c8e18ea9576940fe1ccf7be8c7
MD5 9b7a7d3f7829722f6007cecc34077558
SHA1 b74b8fa803ee32cbfd141da0bc6e90075bc7b03b
SHA512 4d0fa2d890bf1f12701581b0bf7ac482798b290cabe1a8e73d555ff5495c7c7eab6eb1d1f6670ef7929412c829601497fd533b7f80f20da43eafe4d867b692de
SSDEEP 192:/0UvmoDOEVXS1meyd3/z94pPaao6vpO4WsaT1aVvC4p2HEc1Dgoeqy8Grgi8zP:7eoDzSxc3b949a9QDWZT89C+YDzK8D
TLSH
T12C425C51200188629EB651D27604BF1677B33989CAF2D8D27FCF2AE0119B644FF9F64B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware ransomware spyware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\GPOFDLPI\text_0.txt:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\GPOFDLPI\text_0 (002).txt\:Zone.Identifier:$DATA	OUTLOOK.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2632	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2948	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE
2948	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2632	2948	OUTLOOK.EXE	91

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Potential Phish - 2026-10-09T132835.260.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\GPOFDLPI\text_0.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

text_0.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\GPOFDLPI\text_0.txt
Size 87B
SHA256 53e17a39c2e6ca23daebeaf55896758a67d1b04784e2b1663d25ee43c8118450
MD5 305af37244010c403b9272e35b4a75b3
SHA1 2b61c06f6c82a1201b9378b24cfbe7df65486ac1
SHA512 10663c80e3e4ec213a7727bd4e9226d27e2bce07b144c8cf44d9845a19375a7fba2a6f0942f675237eb01fbc5da98820df0710282e4684d743b14d140c46a4b6
TLSH
T176B0121362040652A0001244D8060584293042AC81E456208C28542F027950507A05C4
MD5 SHA1 SHA512 TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

memory/2948-8-0x00007FFE9C840000-0x00007FFE9CAA3000-memory.dmp

Download

memory/2948-11-0x00007FFE9C840000-0x00007FFE9CAA3000-memory.dmp

Download

memory/2948-4-0x00007FFE9C840000-0x00007FFE9CAA3000-memory.dmp

Download

memory/2948-3-0x00007FFE9C99F000-0x00007FFE9C9A0000-memory.dmp

Download

memory/2948-6-0x00007FFE9C840000-0x00007FFE9CAA3000-memory.dmp

Download

memory/2948-7-0x00007FFE5C980000-0x00007FFE5C990000-memory.dmp

Download

memory/2948-0-0x00007FFE5C980000-0x00007FFE5C990000-memory.dmp

Download

memory/2948-9-0x00007FFE9C840000-0x00007FFE9CAA3000-memory.dmp

Download

memory/2948-10-0x00007FFE9C840000-0x00007FFE9CAA3000-memory.dmp

Download

memory/2948-5-0x00007FFE5C980000-0x00007FFE5C990000-memory.dmp

Download

memory/2948-13-0x00007FFE9C840000-0x00007FFE9CAA3000-memory.dmp

Download

memory/2948-12-0x00007FFE9C840000-0x00007FFE9CAA3000-memory.dmp

Download

memory/2948-14-0x00007FFE5A610000-0x00007FFE5A620000-memory.dmp

Download

memory/2948-15-0x00007FFE5A610000-0x00007FFE5A620000-memory.dmp

Download

memory/2948-1-0x00007FFE5C980000-0x00007FFE5C990000-memory.dmp

Download

memory/2948-52-0x00007FFE9C840000-0x00007FFE9CAA3000-memory.dmp

Download

memory/2948-2-0x00007FFE5C980000-0x00007FFE5C990000-memory.dmp

Download