b56f8fdd49e5d3e0c7cf80157cb10513342f5c61629f88506e3446dc17e51296

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
phish_alert_sp2_2.0.0.0 (56).eml
Size 146KB
Sample261027-qf4dbads9t
SHA256 b56f8fdd49e5d3e0c7cf80157cb10513342f5c61629f88506e3446dc17e51296
MD5 badf2b38df220eecf7e051f6ccc439e4
SHA1 b7ac0a88f92432e4ca44e5c1d0bb38b1be94cd47
SHA512 721a984a82aa3c83fce660843863fc4b34549232f1c5138d5421fde9bfa3ba1c8dfbaa31c2eb201895a9da5419b34ced8ad77b9adbb3abd2dc745062ecad2a09
SSDEEP 1536:qKa8xxeCXWIgQ45PMZs8WsJK4ETJbTepGYnE/1e3:va8xxNaM9tZ
TLSH
T1DCE37461AFA1B54E517E5AA7E80338F4EB240E0AC29356FDE853777B8D8DC86139071C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware spyware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5060	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5060	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE
5060	OUTLOOK.EXE

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\phish_alert_sp2_2.0.0.0 (56).eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BDD39983.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\BDD39983.dat
Size 2KB
SHA256 9a6673afe1056e5eb4b8363fe95d42ac4e18d67b3568754d35c6c4df984a9e5e
MD5 5f472aab9afcd3f088d0b1b7f35d3fdb
SHA1 64dcf9371ede86fd204751d33b304da25ffd9342
SHA512 c7c57e000c32947591982cbc454ee2679705fab09c0bda420a7649bd46c55a36b4e899f075b88c6b0070554dca1070940e2ad1b351d61be9cd0f6fa6c6a4bad5
TLSH
T10341D88329FF1DCFC4B141DD8A95E5D090F9CB03A941D96B74879DEC0427E590606B76
MD5 SHA1 SHA512 TLSH

Submit Download

F0B3FDA8.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F0B3FDA8.dat
Size 2KB
SHA256 bdc19eddc162c2b22a3be09d4117d102025e72d9c8754655af774093a0c1bd8e
MD5 e222bf6d0a6cf309a64f3bdd07e6ebcd
SHA1 f599f410450e207af33c9f9f98c98c5eeefc8536
SHA512 7fdde157bde43ca2fe33b24eadad50068266598b1c516f5de164b7a15926cd8be805c6f32619e56f8f3d72c0a08130b781357c7167c401a4a0e95cb8ca89ab8f
TLSH
T1B551D796CFA41E2B1C1737F1493CCB5DB011C65E08429017BA367FAEF59D292428D6E5
MD5 SHA1 SHA512 TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

memory/5060-10-0x00007FF8A2670000-0x00007FF8A2680000-memory.dmp

Download

memory/5060-12-0x00007FF8E49A0000-0x00007FF8E4C03000-memory.dmp

Download

memory/5060-6-0x00007FF8E49A0000-0x00007FF8E4C03000-memory.dmp

Download

memory/5060-5-0x00007FF8E49A0000-0x00007FF8E4C03000-memory.dmp

Download

memory/5060-8-0x00007FF8E49A0000-0x00007FF8E4C03000-memory.dmp

Download

memory/5060-4-0x00007FF8A4AE0000-0x00007FF8A4AF0000-memory.dmp

Download

memory/5060-9-0x00007FF8E49A0000-0x00007FF8E4C03000-memory.dmp

Download

memory/5060-0-0x00007FF8A4AE0000-0x00007FF8A4AF0000-memory.dmp

Download

memory/5060-11-0x00007FF8E49A0000-0x00007FF8E4C03000-memory.dmp

Download

memory/5060-7-0x00007FF8A4AE0000-0x00007FF8A4AF0000-memory.dmp

Download

memory/5060-14-0x00007FF8E49A0000-0x00007FF8E4C03000-memory.dmp

Download

memory/5060-13-0x00007FF8E49A0000-0x00007FF8E4C03000-memory.dmp

Download

memory/5060-16-0x00007FF8A2670000-0x00007FF8A2680000-memory.dmp

Download

memory/5060-15-0x00007FF8E49A0000-0x00007FF8E4C03000-memory.dmp

Download

memory/5060-3-0x00007FF8E4AFF000-0x00007FF8E4B00000-memory.dmp

Download

memory/5060-2-0x00007FF8A4AE0000-0x00007FF8A4AF0000-memory.dmp

Download

memory/5060-1-0x00007FF8A4AE0000-0x00007FF8A4AF0000-memory.dmp

Download

memory/5060-92-0x00007FF8E49A0000-0x00007FF8E4C03000-memory.dmp

Download