Analysis
- max time kernel
103s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 12:33
General
- Target 30-day European travel plan.com.exe
- Size 34.4MB
- Sample260708-prhejsfw81
- SHA256 794331fd4fd48600ebee0c579517f3a7122a87a2bf8e2da18dfc8d5d57c0da93
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 39 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 37 IoCs
- Suspicious use of FindShellTrayWindow 54 IoCs
- Suspicious use of SendNotifyMessage 43 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\30-day European travel plan.com.exe"C:\Users\Admin\AppData\Local\Temp\30-day European travel plan.com.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\74e1dccad461ee59.pptx"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\74e1dccad461ee59.pptx" /ou ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
C:\ProgramData\Accounts\ae26a8eb\ZillberRelayHost.exeC:\ProgramData\Accounts\ae26a8eb\ZillberRelayHost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Accounts\ae26a8eb\ZillberRelayHost.exeC:\ProgramData\Accounts\ae26a8eb\ZillberRelayHost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
74e1dccad461ee59.pptx
Tmp8B00.tmp
memory/1812-364-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-368-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-6579-0x000000000A170000-0x000000000A248000-memory.dmp
memory/1812-6574-0x0000000009240000-0x000000000924A000-memory.dmp
memory/1812-323-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-15-0x0000000008700000-0x0000000008754000-memory.dmp
memory/1812-16-0x0000000008760000-0x0000000008778000-memory.dmp
memory/1812-17-0x00000000087E0000-0x000000000882C000-memory.dmp
memory/1812-324-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-30-0x0000000008900000-0x0000000008966000-memory.dmp
memory/1812-403-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-136-0x0000000009700000-0x0000000009CBA000-memory.dmp
memory/1812-326-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-328-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-332-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-335-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-336-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-338-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-322-0x0000000009610000-0x00000000096E6000-memory.dmp
memory/1812-330-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-341-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-344-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-358-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-382-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-398-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-418-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-423-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-424-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-421-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-414-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-565-0x000000000A0A0000-0x000000000A172000-memory.dmp
memory/1812-412-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-410-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-408-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-400-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-405-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-135-0x00000000090A0000-0x0000000009132000-memory.dmp
memory/1812-343-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-406-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-396-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-392-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-394-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-390-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-389-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-386-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-372-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-417-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-384-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-381-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-379-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-377-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-375-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-371-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-366-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-347-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-362-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-360-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-356-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-355-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-352-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-350-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/1812-348-0x0000000009610000-0x00000000096E1000-memory.dmp
memory/2020-2-0x00007FFC88000000-0x00007FFC88010000-memory.dmp
memory/2020-3-0x00007FFC88000000-0x00007FFC88010000-memory.dmp
memory/2020-4-0x00007FFC88000000-0x00007FFC88010000-memory.dmp
memory/2020-5-0x00007FFC88000000-0x00007FFC88010000-memory.dmp
memory/2020-9-0x00007FFC859B0000-0x00007FFC859C0000-memory.dmp
memory/2020-8-0x00007FFC859B0000-0x00007FFC859C0000-memory.dmp
memory/2020-6-0x00007FFC88000000-0x00007FFC88010000-memory.dmp
memory/4512-152-0x000001BC82DC0000-0x000001BC82EC0000-memory.dmp
memory/4512-151-0x000001BC82860000-0x000001BC82880000-memory.dmp
memory/4512-138-0x000001BC80180000-0x000001BC80280000-memory.dmp
memory/4512-171-0x000001BC82D40000-0x000001BC82D60000-memory.dmp
memory/4512-185-0x000001BC941C0000-0x000001BC941E0000-memory.dmp