7345401e4b16b1981e68e1a899e376d159be35b7f8afe549ffd06a148b5c7e65

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 09:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
30-day European travel plan.com.exe
Size 34.8MB
Sample260703-k23q1set6v
SHA256 7345401e4b16b1981e68e1a899e376d159be35b7f8afe549ffd06a148b5c7e65
MD5 03777c1c8235b75136f1d34742c658fb
SHA1 235ccfdbba3954f3a1df7f66006de80c3c2dcb50
SHA512 345ab34034e414d9bcdd8b89342eeac5a0854b6e3d8864e5bbe4a04428da1da5dfdfa72146120c373ef7ab1d66935567dc1ba0d3a5a9c6e13950e157cf459239
SSDEEP 49152:GD+D8pl4zyaq5P1OWoIm6G+a9VZh/VgxFWYUtTe4s3QM1p:GD+D80e4Bh/VDtTjsAM1p
TLSH
T1D7876D1ABED578725BFED3935BD3CCBD8517900012633C9F298A17C88409BA8AF7625D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2060 created 3728	2060	AggregatorHost.exe	58

Executes dropped EXE 2 IoCs

pid	Process
2060	AggregatorHost.exe
5684	AggregatorHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30-day European travel plan.com.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AggregatorHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AggregatorHost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2856	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2060	AggregatorHost.exe
2060	AggregatorHost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2856	POWERPNT.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2856	POWERPNT.EXE
2856	POWERPNT.EXE
2856	POWERPNT.EXE
2856	POWERPNT.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 4092	2760	30-day European travel plan.com.exe	89
PID 4092 wrote to memory of 2856	4092	cmd.exe	91
PID 2060 wrote to memory of 5684	2060	AggregatorHost.exe	94

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3728
- C:\Users\Admin\AppData\Local\Temp\30-day European travel plan.com.exe
  "C:\Users\Admin\AppData\Local\Temp\30-day European travel plan.com.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\7d3ee0063f99ca35.pptx"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\7d3ee0063f99ca35.pptx" /ou ""
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:2856
- C:\ProgramData\Microsoft\6491d1f7\AggregatorHost.exe
  C:\ProgramData\Microsoft\6491d1f7\AggregatorHost.exe --monitor 2060
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5684

C:\ProgramData\Microsoft\6491d1f7\AggregatorHost.exe
C:\ProgramData\Microsoft\6491d1f7\AggregatorHost.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92
Size 1KB
SHA256 aeb0541e36226623bbf712d36b164a1e450fec0336e5912820d9898478d7e789
MD5 ad3aa49e69bf5716ee9c8e4ccc2f3b33
SHA1 0a8e7594912bf2af9dc49a3f2f44419de9447416
SHA512 c25823d07ada08cce336492cc61dad68a4d54c0da230db65b7cebfb4ce5f6cddf82d417c27806ff8b81c1c6169bf3dd48f211cc4d2d2215fcd06070f415813c4
TLSH
T1AA31E9638634B5C12DC5BA0A7098D6033C7A35C1ECD48C1B590CD2652D7A7F7FBA995C
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 9cbd9412296fa313f6910c27261d07a454c13fb415da4230339dd483663405b6
MD5 52d091a30b03c1ca668693c16397052c
SHA1 734b16c2ff79998b06be288f05987167f185bd92
SHA512 1e8912fde1f960e3c9817cd349dc9b90e586c8cc1e391147dc5c4c24f160f8021f703f7d9cea8dba4f098dcfb957a0285cb1f7faf7d14e90d725eecdf5740279
TLSH
T108E05E126BE80204F9770A3CA97366499977B76BAA01CADD0675008D1C26F62CD3271D
MD5 SHA1 SHA512 TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92
Size 422B
SHA256 7ce358bfa7e5ae60d4bea4188d7529a4f597b8390c63da4729ae32e32495504b
MD5 d702ae8ed78350257dfab84a52df0f6b
SHA1 467c753629e84ed3017569d861d4d95262e8462f
SHA512 b151e91998bf7889dd81b7cf65df9259416f508a216b1eddab4f0bfd3a1e0da12670bfb957655df16230d19ddcbed5734b5f238c75d291ed3cdd0c0d7de6292e
TLSH
T1E0E0C02039FD8034E3326FBC87E9292E8B3DF167840467792B10021C1115E444C35B33
MD5 SHA1 SHA512 TLSH

Submit Download

7d3ee0063f99ca35.pptx

Path C:\Users\Admin\AppData\Local\Temp\7d3ee0063f99ca35.pptx
Size 15.5MB
SHA256 0b32e4480e08f487e2264a1bb5444ca31807c43f8e77f3df2fb7efa39a5f6a6d
MD5 b55f5d476bcd416dc720326b84e24d4c
SHA1 11303d06dac09134e0ff1db6eb113b4c6dc7202c
SHA512 f27ad9e65083b3a3546cc630678e9d3cfc7a279e17578628d3b721c82de870f8620a17e23d432d6864d9b73155475e7a16fbc849bdb1e9f7da379a50c3c92ce0
SSDEEP 393216:kI9ujzoA3fQdg8YZfmOrm4u4uJoIuGv/uzieRmRc3iYsO8aoovT:kIGN3YdgVlTanXsieRJgO8M
TLSH
T187F63306AD804A01C02A797ADCFE8591D3EB9DE1AC61600F3B8DDD08DF449BEDCDA597
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpEC01.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpEC01.tmp
Size 2KB
SHA256 cce1d05d1856c66d95f205e985fae9d50d5bca786c6c6ee5c81f78c38aff1f57
MD5 c974d55345218c25d00d118b73d79fec
SHA1 2e697c1023a01396084a78133740573956aa5e8b
SHA512 1008fb505d08bf6f60f056555d9db8ba7748c6133032ee96ba94370f56e7e0c66645cda175cda55f116febc3fd7bae81c70c3ae41f8d5759446c42cbe1a4b8db
TLSH
T16141286B1DE1DAC138AE584CC0AE66231520F16358B06D6F6124B1E611939297F0CAF3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2060-319-0x0000000008520000-0x0000000008574000-memory.dmp

Download

memory/2060-320-0x0000000008590000-0x00000000085A8000-memory.dmp

Download

memory/2060-321-0x0000000008620000-0x000000000866C000-memory.dmp

Download

memory/2060-340-0x0000000008750000-0x00000000087B6000-memory.dmp

Download

memory/2856-8-0x00007FFBA3C10000-0x00007FFBA3C20000-memory.dmp

Download

memory/2856-7-0x00007FFBA3C10000-0x00007FFBA3C20000-memory.dmp

Download

memory/2856-6-0x00007FFBA5F00000-0x00007FFBA5F10000-memory.dmp

Download

memory/2856-3-0x00007FFBA5F00000-0x00007FFBA5F10000-memory.dmp

Download

memory/2856-4-0x00007FFBA5F00000-0x00007FFBA5F10000-memory.dmp

Download

memory/2856-5-0x00007FFBA5F00000-0x00007FFBA5F10000-memory.dmp

Download

memory/2856-2-0x00007FFBA5F00000-0x00007FFBA5F10000-memory.dmp

Download