Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/11/2026, 04:35
Static task
static1
Behavioral task
behavioral1
Sample
Re RECEPTION PIPETTE INCOHERENCE - 221140653.eml
Resource
win10v2004-20260911-en
14 signatures
150 seconds
General
- Target Re RECEPTION PIPETTE INCOHERENCE - 221140653.eml
- Size 53KB
- Sample261110-e7wl1ayze1
- SHA256 638ada2ff8de2001111ecaa7d04bd8ffe008aeca9f60d13b40eea059f4464bf4
- MD5 c00a50a1053f31f802561c59e807ae4c
- SHA1 f42a35ca30984b4e828cbea6202f0fbe059305f1
- SHA512 030a96013f5296bc2080784c92f872c91b412cada8368e4a680d903ad22270d864f8e065abff29edf74a749253dc926001296e468da6bff49c8e061a2b5b5454
- SSDEEP 768:1FhabTm42C2N5mkVAw6Q/kdbblL96ZD1PNZ0wGB:1vQm6tSAwLUPlLUZJPN8B
- TLSH T12E3319824D522E78DBE4D44A14EF76E732EC33671CF1308E2A389FB1A1468E475E9586
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OUTLOOK.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OUTLOOK.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OUTLOOK.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001" OUTLOOK.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3376 OUTLOOK.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3376 OUTLOOK.EXE - Suspicious use of SetWindowsHookEx 30 IoCs
pid Process 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE 3376 OUTLOOK.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Re RECEPTION PIPETTE INCOHERENCE - 221140653.eml"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3376
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MW9UJA6Z\tlcharger1[1].png
- Size 6KB
- SHA256 523755988fe42f632b8bbd205bef4f013660d272f1e62c732071cc12529839f4
- MD5 b55076c7269c998e83c91fd312aa06cb
- SHA1 0541994ccdacfc4911463f6da906f9232aa6ff5b
- SHA512 1a4a732f82fa19d6419d209e072c39757b1d1e0e692790d11060a49fcd15ee1ba2aab44111d751a6e742b88015b512543df88ab95875d93951af28c0f355d8d8
- SSDEEP 96:/B5ztC5P4jAG1h7/YnfxpTTZXwjvTHrvfz6mGu8gss9NYX+lFxb:/xQgjA0eTTdw7DrbHH8gZNYX+5b
- TLSH T174C19E08A70AC1DC3B4B8564E07E44127D7BD99ECEB49681DB1A5E34A65B824FE5431C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512