09b98016dd640f32a74295a14b55015770884d136aeb8a21fd139edc8b8c67f0

Resubmissions

14/10/2026, 12:26

261014-pmj3ksvwfs5

14/10/2026, 12:18

261014-pgvl5avtd15

14/10/2026, 12:00

261014-n6plqsvsay5

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 12:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
phish_alert_sp2_2.0.0.0 (3).eml
Size 3.3MB
Sample261014-n6plqsvsay
SHA256 09b98016dd640f32a74295a14b55015770884d136aeb8a21fd139edc8b8c67f0
MD5 765c95de8b0871ed2de347e81911636a
SHA1 f078fbae95d40add7b524f0951a670c22a7aafbf
SHA512 40b6c917a7be3f0567284ad4d8e16e94549ec6b7abfaa450a6372a0e2cacff89125ed42f8ab01623c9e2414a29f4b2b0e854cfe2282bc8e3ecdc5688dd625b06
SSDEEP 49152:Cuouoym8sDnIygynv+cyTbzNq8ajRY6v/GDjfpLG:q
TLSH
T134F501BBBC071DA717204ADBD1DE64C01D6CA74F28C612F2B79EB724526D1B989E087C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware spyware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1096	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1096	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE
1096	OUTLOOK.EXE

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0 (3).eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

22F01781.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\22F01781.dat
Size 642B
SHA256 4469cea3c8e960dd973b8fbfe8aaaceeb3fe27941aef4a3a4714fceb2d9c5081
MD5 d586674d60440234b9a78d8ad6877ae1
SHA1 6d223175e9ca5d42ba3d6b210c0f5ba952f3121c
SHA512 b2b06460563500d707e75dbb73517e47d88b94e700d5903db67deef4d1434fe3cf532794201a3861eb71c3a716e00d7c32e5d092c2faefb9cc839a8e82bcd985
TLSH
T177F02D832924ECA0765C335182CB800E5AB8B4CD620E9E0C1721F9D892A838D0DA3312
MD5 SHA1 SHA512 TLSH

Submit Download

FAD61580.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\FAD61580.dat
Size 46KB
SHA256 361ceac79856ec70ad6680dab6d340cff77eb8caaaf6b8df602093e7cb9554c3
MD5 2efc6b1ee51984a31c502655d3d4c693
SHA1 c1ec407b7a9d92c91405456216be6069ca277b59
SHA512 36d78811550dbbd1e91e924d24239d782d462d7d31a0811e7cb8bc5e2f3fb374f167013eacb299a55d98096a80e3dce06c5c80676ea6abf765007acc68300e9c
SSDEEP 192:vStkJ/vZRhuZRW6RRZRSCRhZCRhqJRhP6Rn6RHMR2dRv4RQNRhzORcDxRbDCRSDm:aOJIShsx5vzNGecL+T2wqSjUwuGEP
TLSH
T1692372627FF609A1C21CD2A552843C893CC7359FC5F02E8BFADE4E95EF2855444CB64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

transparent[1].png

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0ZRRKB0Q\transparent[1].png
Size 68B
SHA256 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20
MD5 978c1bee49d7ad5fc1a4d81099b13e18
SHA1 afcb011cfe6b924f202ee9544f17f631b32a01b1
SHA512 81f251d1ca407945457425b681a96d1e7743706fafa47ace26f5f569e69337e9aaf726bff1a854b1a5a47a22e55c4bd285a4d21f695d126da631a1c891d10f48
TLSH
T1F6A022C233808E3CCABC0233C0000320F832820B0C008808C002F0223C2B2E00A882A2
MD5 SHA1 SHA512 TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

memory/1096-10-0x00007FFE7A2A0000-0x00007FFE7A503000-memory.dmp

Download

memory/1096-13-0x00007FFE7A2A0000-0x00007FFE7A503000-memory.dmp

Download

memory/1096-6-0x00007FFE7A2A0000-0x00007FFE7A503000-memory.dmp

Download

memory/1096-7-0x00007FFE7A2A0000-0x00007FFE7A503000-memory.dmp

Download

memory/1096-8-0x00007FFE7A2A0000-0x00007FFE7A503000-memory.dmp

Download

memory/1096-9-0x00007FFE7A2A0000-0x00007FFE7A503000-memory.dmp

Download

memory/1096-0-0x00007FFE3A3E0000-0x00007FFE3A3F0000-memory.dmp

Download

memory/1096-11-0x00007FFE377E0000-0x00007FFE377F0000-memory.dmp

Download

memory/1096-12-0x00007FFE7A2A0000-0x00007FFE7A503000-memory.dmp

Download

memory/1096-5-0x00007FFE3A3E0000-0x00007FFE3A3F0000-memory.dmp

Download

memory/1096-14-0x00007FFE7A2A0000-0x00007FFE7A503000-memory.dmp

Download

memory/1096-15-0x00007FFE377E0000-0x00007FFE377F0000-memory.dmp

Download

memory/1096-2-0x00007FFE3A3E0000-0x00007FFE3A3F0000-memory.dmp

Download

memory/1096-3-0x00007FFE7A3FF000-0x00007FFE7A400000-memory.dmp

Download

memory/1096-4-0x00007FFE3A3E0000-0x00007FFE3A3F0000-memory.dmp

Download

memory/1096-1-0x00007FFE3A3E0000-0x00007FFE3A3F0000-memory.dmp

Download

memory/1096-91-0x0000026972310000-0x000002697233D000-memory.dmp

Download

memory/1096-92-0x00007FFE7A2A0000-0x00007FFE7A503000-memory.dmp

Download