ece1c2e31ef081f30a6e45c6a6ea2b6b907f8b364bfbc9a97d43dc5eda9065d8

Analysis

user interaction
yes
max time kernel
270s
max time network
223s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Potential Phish (72.6 KB).msg
Size 105KB
Sample261027-rca32aev5q
SHA256 ece1c2e31ef081f30a6e45c6a6ea2b6b907f8b364bfbc9a97d43dc5eda9065d8
MD5 d504150ab4b315a6d68918502408c57a
SHA1 f1c8ff18f21972bb1908253f48a5b90a58a8c64c
SHA512 d9e2711ea03e75d6ae8b801524e1153c4f1345323c85d8da3ec9c42f7f872e48de0017c65f795660b44dca8c061d3de05838de999831e045f15f758637057f57
SSDEEP 1536:iM6thg7gO7lW1uUdpVjdZzgL4ZA5ipGaZ7eDyXm2uBKQQ4DCYUNp7mGJFQGJE3:p7gJ1uUd7zoSeeXYBK/OUTmGJF9JE3
TLSH
T1BBB319242AFA011DF1739F7559F264979A3BBD627D35994D2084330E06B3E40E9A2F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prevhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\	AcroRd32.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\OACE3829\Nishiara Legister-short.pdf:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\OACE3829\Nishiara Legister-short (002).pdf\:Zone.Identifier:$DATA	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4848	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
4848	OUTLOOK.EXE
3304	AcroRd32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2416	2948	prevhost.exe	98
PID 2416 wrote to memory of 3304	2416	AcroRd32.exe	99
PID 2416 wrote to memory of 3304	2416	AcroRd32.exe	99
PID 2416 wrote to memory of 3304	2416	AcroRd32.exe	99

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "C:\Users\Admin\Documents\Potential Phish (72.6 KB).msg"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4848

C:\Windows\SysWOW64\prevhost.exe
C:\Windows\SysWOW64\prevhost.exe {DC6EFB56-9CFA-464D-8880-44885D7DC193} -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" /b /id 2948_1305221499 /if pdfshell_preva14cadce-b9d2-4463-8559-080f67921d53
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /prefetch:1 /b /id 2948_1305221499 /if pdfshell_preva14cadce-b9d2-4463-8559-080f67921d53
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nishiara Legister-short.pdf

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\OACE3829\Nishiara Legister-short.pdf
Size 54KB
SHA256 6cbc3eb48d5ddb21048e8778cad8fefc8fe691625fa9f9b6f56d03f60a275bd1
MD5 737c0233748b13da74e919a4e3386cfb
SHA1 d1e338cdc2fa71085e1a29b2c2d2f97c6f3c7ea6
SHA512 064c4a8b6f9c42deb033ae1e04f6a87ce1ec1703d1cead7d341bafb31b2363a45e4628ffeab72aacddfb3b7480f4f8432322a08d30b958be8e61436efc30b7a3
SSDEEP 1536:opGaZ7eDyXm2uBKQQ4DCYUNp7mGJFQGJE3U:CeeXYBK/OUTmGJF9JE3U
TLSH
T16B43F134D916A80CE84BD041753ABE9DAF8C7177B1D15891387C460FA681E8DFAD3B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/4848-8-0x00007FFCA4670000-0x00007FFCA4865000-memory.dmp

Download

memory/4848-7-0x00007FFCA4670000-0x00007FFCA4865000-memory.dmp

Download

memory/4848-5-0x00007FFC646F0000-0x00007FFC64700000-memory.dmp

Download

memory/4848-4-0x00007FFC646F0000-0x00007FFC64700000-memory.dmp

Download

memory/4848-6-0x00007FFCA4670000-0x00007FFCA4865000-memory.dmp

Download

memory/4848-9-0x00007FFCA4670000-0x00007FFCA4865000-memory.dmp

Download

memory/4848-0-0x00007FFC646F0000-0x00007FFC64700000-memory.dmp

Download

memory/4848-1-0x00007FFC646F0000-0x00007FFC64700000-memory.dmp

Download

memory/4848-12-0x00007FFCA4670000-0x00007FFCA4865000-memory.dmp

Download

memory/4848-11-0x00007FFCA4670000-0x00007FFCA4865000-memory.dmp

Download

memory/4848-10-0x00007FFCA4670000-0x00007FFCA4865000-memory.dmp

Download

memory/4848-13-0x00007FFC625F0000-0x00007FFC62600000-memory.dmp

Download

memory/4848-14-0x00007FFC625F0000-0x00007FFC62600000-memory.dmp

Download

memory/4848-2-0x00007FFC646F0000-0x00007FFC64700000-memory.dmp

Download

memory/4848-39-0x00007FFCA4670000-0x00007FFCA4865000-memory.dmp

Download

memory/4848-3-0x00007FFCA470D000-0x00007FFCA470E000-memory.dmp

Download