0b3e355628dc1c30a9ee978414ce9d2c0add859921fd6de351b34d745e3c4d4c

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Property for Sale.exe
Size 11.0MB
Sample260919-h6dataxyhx
SHA256 0b3e355628dc1c30a9ee978414ce9d2c0add859921fd6de351b34d745e3c4d4c
MD5 3c76aa7c931f516d1c95dd8d69b155af
SHA1 3213411e787a64af3a796c9147116f03710a673a
SHA512 95d6b7894a22793f9a10e8eebb870b6c4fe2c2a1b97a8128be2f177ce11be790f6b5290b0cb95d177e2e99afbdd8d1f5fdded34edf6c15aefee7eb7288ee5070
SSDEEP 24576:1jQU/lQhOUIvWIccEsRWmx1qri2t0RAtN5W+80FKdAUu1gU+d1jaJg55lgY:hZlJUIHccEe1qri2tm+0rufJg5v
TLSH
T149C68E26FED574329BAED3934BE3D87E9527500053272CEF2A8A17C88015BA86F7315D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
6120	ZillberReleyHost.exe
1204	ZillberReleyHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4472	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZillberReleyHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Property for Sale.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3856	POWERPNT.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3856	POWERPNT.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3856	POWERPNT.EXE
3856	POWERPNT.EXE
3856	POWERPNT.EXE
3856	POWERPNT.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 6072 wrote to memory of 4472	6072	Property for Sale.exe	90
PID 4472 wrote to memory of 3856	4472	cmd.exe	92
PID 2252 wrote to memory of 6120	2252	mshta.exe	96
PID 6120 wrote to memory of 1204	6120	ZillberReleyHost.exe	97

C:\Users\Admin\AppData\Local\Temp\Property for Sale.exe
"C:\Users\Admin\AppData\Local\Temp\Property for Sale.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6072
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\140979cf53a600b2.pptx"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\140979cf53a600b2.pptx" /ou ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:432

C:\Windows\System32\mshta.exe
C:\Windows\System32\mshta.exe "C:\ProgramData\SystemData\e4a57627c3955a84\launch.hta"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\ProgramData\SystemData\e4a57627c3955a84\ZillberReleyHost.exe
  "C:\ProgramData\SystemData\e4a57627c3955a84\ZillberReleyHost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\ProgramData\SystemData\e4a57627c3955a84\ZillberReleyHost.exe
    C:\ProgramData\SystemData\e4a57627c3955a84\ZillberReleyHost.exe --monitor 6120
    3⤵
    - Executes dropped EXE
    PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ZillberReleyHost.exe

Path C:\ProgramData\SystemData\e4a57627c3955a84\ZillberReleyHost.exe
Size 100.0MB
SHA256 61b8bbb39248b041bd0494e3b17ab0578b56b73c6aa06d430d3f3f8e274cfa1c
MD5 63cf208924baf931e2026d16b6d9a5de
SHA1 06dc8b2f15d364c0393bb05471525508a3fe56c5
SHA512 9bd71702600a38fed9a19dcdb538ff54ff6f2529b77dce2e79929ca0024229ac77c4f8cfa6c3cefaa89f388a1afa35e9d31ed29f02724419ca521be6a8615281
SSDEEP 3145728:xBd33cRZA3QnyjgvTpC8KIkyvTaffZdHP:ZSZ2rZ6kNfBdv
TLSH
T1CA382316FED574329BAED3934BE3C87E9527500053272CEF2A8A1BC88415BA86F7315D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launch.hta

Path C:\ProgramData\SystemData\e4a57627c3955a84\launch.hta
Size 342B
SHA256 87d9cd4d1177facdbc1dc24040fdbec643f51633368c191c6b3fc320e453ca42
MD5 7a780e312a4024de2e814b09da604bad
SHA1 39bf9861f1be1b5d57987af75641dc9d5450fc35
SHA512 79829253388ab1043f49ec3a34a96346aa4f4768adb564a4d29063151ce8acb82b999532cd93905bc1a17bb6ab027a0e10fb68d23bc947f25b1dce66f8691929
TLSH
T166E0C6E04C02E18CECD73ADA20EAE5982BC0681036CEAD2AD601008AF3016421AA5516
MD5 SHA1 SHA512 TLSH

Submit Download

140979cf53a600b2.pptx

Path C:\Users\Admin\AppData\Local\Temp\140979cf53a600b2.pptx
Size 4.3MB
SHA256 3c53140331c0e44483f50bf69d9616625c51c5cb3ccfd6a25375488a5c362350
MD5 82eea976b862c69aed755fb6d93527b1
SHA1 dd548b8d24a2b74fa040d4acb6b406279422a114
SHA512 93c3e59d931634fd339745bea71776d74b59d38096a79a94e16b8d4e020ef4285e797494be3564df7612e0267923e8ff8000c99b35e6968871a10b5d4fe152a0
SSDEEP 98304:mhpnGLjpd4C3Ibufr7HYLrr8dHmdLM84Cgx22ej3nADC8qjpBejqYPQJG+DYx:mhtGLjpdM0kLf8d7VpxleLADC8g4PQ4f
TLSH
T101263383E4804FF1C43BA6B15AE74A6D205321636727CB7C5872E4CEA499FB63144FD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp1CD0.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp1CD0.tmp
Size 2KB
SHA256 0da70775627dec6e077a632a9428a1046ce4b3fb27010691c477c5b64c9f383a
MD5 82fcd9ad93ecc5028653aa104959e52a
SHA1 1f7fc9c39829ddb3aac05106449ba139c0a2c37a
SHA512 1d10109f1b110dac0aff57a5c9efc3d99bde114026e9e0e7c4c4475a37eb3c2456e3be5e30f8d154c1c6a15037d0da36451792a0e8eac86b37d59474eeebaf68
TLSH
T17F411B534B7F5C3B361AF87EB1E80EE54280BB461D89E93FF53D55488B3260A151C227
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3856-276-0x00007FFB463E0000-0x00007FFB46643000-memory.dmp

Download

memory/3856-229-0x00007FFB06520000-0x00007FFB06530000-memory.dmp

Download

memory/3856-260-0x00007FFB463E0000-0x00007FFB46643000-memory.dmp

Download

memory/3856-284-0x00007FFB463E0000-0x00007FFB46643000-memory.dmp

Download

memory/3856-259-0x00007FFB463E0000-0x00007FFB46643000-memory.dmp

Download

memory/3856-318-0x00007FFB03940000-0x00007FFB03950000-memory.dmp

Download

memory/3856-243-0x00007FFB463E0000-0x00007FFB46643000-memory.dmp

Download

memory/3856-232-0x00007FFB06520000-0x00007FFB06530000-memory.dmp

Download

memory/3856-231-0x00007FFB06520000-0x00007FFB06530000-memory.dmp

Download

memory/3856-244-0x00007FFB06520000-0x00007FFB06530000-memory.dmp

Download

memory/3856-397-0x00007FFB03940000-0x00007FFB03950000-memory.dmp

Download

memory/3856-234-0x00007FFB06520000-0x00007FFB06530000-memory.dmp

Download

memory/3856-1462-0x00007FFB463E0000-0x00007FFB46643000-memory.dmp

Download

memory/3856-242-0x00007FFB4653F000-0x00007FFB46540000-memory.dmp

Download

memory/6120-1451-0x00000000058E0000-0x000000000592C000-memory.dmp

Download

memory/6120-1450-0x00000000057D0000-0x00000000057E8000-memory.dmp

Download

memory/6120-1449-0x0000000005820000-0x0000000005874000-memory.dmp

Download

memory/6120-1470-0x0000000005F00000-0x0000000005F66000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads