Windows Analysis Report
a.manasova@mlsp.kg.msg

Overview

General Information

Sample Name: a.manasova@mlsp.kg.msg
Analysis ID: 882695
MD5: 141b5248e25ba914cf62643f1e37a1be
SHA1: 7506634f2eeafdff86ead03ab276127a3b19fcf3
SHA256: e873bc60713be05e0d7e32218bba4839f6b09e7f59c5ac5cbc0ef582b666c26f
Infos:

Detection

Score: 21
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

LLM found phishing text in email (MSG / EML)
Creates or modifies windows services
Deletes files inside the Windows folder
Creates files inside the system directory

Classification

Phishing
barindex
LLM found phishing text in email (MSG / EML)
Source: a.manasova@mlsp.kg.msg ChatGPT: Communication: 0 reasoning: Subject is an email address, not a relevant subject line
Source: a.manasova@mlsp.kg.msg ChatGPT: Communication: 0 reasoning: Mismatch between sender's email domain and organization mentioned in signature
Source: a.manasova@mlsp.kg.msg ChatGPT: Communication: 0 reasoning: Message content mentions infected password to file
Source: a.manasova@mlsp.kg.msg ChatGPT: Communication: 0 reasoning: Unrelated recipient email address
Source: a.manasova@mlsp.kg.msg ChatGPT: Communication: 0 reasoning: Attachment with suspicious file format (.zip)
Deletes files inside the Windows folder
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE File deleted: C:\Windows\SysWOW64\PerfStringBackup.TMP Jump to behavior
Creates files inside the system directory
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE File created: C:\Windows\inf\Outlook\ Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE File created: C:\Users\user\AppData\Local\Temp\{285EE306-80F3-46AB-9CE8-F29B3B7E7A13} - OProcSessId.dat Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE File written: C:\Windows\INF\Outlook\outlperf.ini Jump to behavior
Source: classification engine Classification label: sus21.phis.winMSG@1/14@0/0
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE File read: C:\Program Files (x86)\Microsoft Office\Office16\1033\OUTLPERF.INI Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE File created: C:\Users\user\Documents\Outlook Files\~Outlook.pst.tmp Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Window found: window name: SysTabControl32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Window detected: Number of UI elements: 13
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages Jump to behavior
Creates or modifies windows services
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Outlook\Performance Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 882695 Sample: a.manasova@mlsp.kg.msg Startdate: 06/06/2023 Architecture: WINDOWS Score: 21 7 LLM found phishing text in email (MSG / EML) 2->7 5 OUTLOOK.EXE 32 43 2->5         started        process3
⊘No contacted IP infos