565b8baeb1362609094a9dc16f81523265415536e5444e38522160fb97d94ac1

Resubmissions

06/07/2026, 21:38

260706-1g59eahs8q7

06/07/2026, 21:31

260706-1dd1rabx7v7

Analysis

max time kernel
7s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 21:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZChaos.exe
Size 13.8MB
Sample260706-1g59eahs8q
SHA256 565b8baeb1362609094a9dc16f81523265415536e5444e38522160fb97d94ac1
MD5 7fdf023d5ffd2833fb751f40263de381
SHA1 a9eb6db3418853545cc6bba44f8cca7207f1503d
SHA512 f4a7a9c45a4ace016aef582d413e799e33f90409e1960d7d4d18a9b23f2d42be96b450647da9ca3860cd57c94f3207e8f78475ebf56397977079719f5196966f
SSDEEP 196608:t3ZCpsNAbQWRZ0b0pYh8e151DP5FO00sAy4jMVI/iW2g2JRc5H2+Fa7JcRlZOfm/:CpdbRZkyP4DD9yeI/AvEW+YIOf
TLSH
T155E6335A6391D19BD0A783306DD74B627770ECA5224362C7E8727B840DBBBD69E403CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

persistence privilege_escalation ransomware

Malware Config

Signatures

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bg.jpg"	ZChaos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3528	Magnify.exe
3528	Magnify.exe
3528	Magnify.exe
3528	Magnify.exe
3528	Magnify.exe
3528	Magnify.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5184	ZChaos.exe
Token: SeDebugPrivilege	5184	ZChaos.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3528	Magnify.exe
3528	Magnify.exe
3528	Magnify.exe
3528	Magnify.exe
3528	Magnify.exe
3528	Magnify.exe
3528	Magnify.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5184 wrote to memory of 3528	5184	ZChaos.exe	87

C:\Users\Admin\AppData\Local\Temp\ZChaos.exe
"C:\Users\Admin\AppData\Local\Temp\ZChaos.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5184
- C:\Windows\System32\Magnify.exe
  "C:\Windows\System32\Magnify.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3528
- C:\Windows\System32\control.exe
  "C:\Windows\System32\control.exe" color
  2⤵
  PID:3752
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL desk.cpl ,@Advanced
    3⤵
    PID:4104
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" ms-settings:personalization
      4⤵
      PID:1868
- C:\Windows\System32\mmc.exe
  "C:\Windows\System32\mmc.exe" compmgmt.msc
  2⤵
  PID:4896
- C:\Windows\System32\DpiScaling.exe
  "C:\Windows\System32\DpiScaling.exe"
  2⤵
  PID:5516
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" ms-settings:display
    3⤵
    PID:4192
- C:\Windows\System32\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:3212
- C:\Windows\System32\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:4196
- C:\Windows\System32\shrpubw.exe
  "C:\Windows\System32\shrpubw.exe"
  2⤵
  PID:2620
- C:\Windows\System32\control.exe
  "C:\Windows\System32\control.exe" color
  2⤵
  PID:1580
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL desk.cpl ,@Advanced
    3⤵
    PID:3028
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" ms-settings:personalization
      4⤵
      PID:3024
- C:\Windows\System32\mobsync.exe
  "C:\Windows\System32\mobsync.exe"
  2⤵
  PID:2716
- C:\Windows\System32\control.exe
  "C:\Windows\System32\control.exe" "C:\Windows\System32\joy.cpl",
  2⤵
  PID:1828
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\System32\joy.cpl",
    3⤵
    PID:4836
- C:\Windows\System32\dxdiag.exe
  "C:\Windows\System32\dxdiag.exe"
  2⤵
  PID:2728
- - C:\Windows\System32\dxdiag.exe
    "C:\Windows\System32\dxdiag.exe"
    3⤵
    PID:2600
- C:\Windows\System32\mmc.exe
  "C:\Windows\System32\mmc.exe" devmgmt.msc
  2⤵
  PID:1216
- C:\Windows\System32\eudcedit.exe
  "C:\Windows\System32\eudcedit.exe"
  2⤵
  PID:5364
- C:\Windows\System32\dxdiag.exe
  "C:\Windows\System32\dxdiag.exe"
  2⤵
  PID:1092
- C:\Windows\System32\shrpubw.exe
  "C:\Windows\System32\shrpubw.exe"
  2⤵
  PID:1096
- C:\Windows\System32\msra.exe
  "C:\Windows\System32\msra.exe"
  2⤵
  PID:2716
- C:\Windows\System32\Magnify.exe
  "C:\Windows\System32\Magnify.exe"
  2⤵
  PID:3732
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1700
- C:\Windows\System32\winver.exe
  "C:\Windows\System32\winver.exe"
  2⤵
  PID:1692
- C:\Windows\System32\mobsync.exe
  "C:\Windows\System32\mobsync.exe"
  2⤵
  PID:1784
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:908
- C:\Windows\System32\osk.exe
  "C:\Windows\System32\osk.exe"
  2⤵
  PID:3024
- C:\Windows\System32\msra.exe
  "C:\Windows\System32\msra.exe"
  2⤵
  PID:5484
- C:\Windows\System32\mmc.exe
  "C:\Windows\System32\mmc.exe" eventvwr.msc
  2⤵
  PID:2736

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1232

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3700

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:4520

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4848

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
PID:5028

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:3904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:2344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\ed902ee9a43ed5a7\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 6783c2bfcb5c3774cc4da41285b9f1e4198f13da4bf37a72f3bc39958d9a1677
MD5 1125f4f67d59eff8fdecc600d5098597
SHA1 e90b8e0687244c1a8c936ed37707a45250cfa358
SHA512 62024e46586a45049090690825212f1c3b9443423635e1d50f1b6be4257635f1be2583dd9b8549aa7f59a9354df4f98a8e16ec6b2db66e691e1a2eba14dc616f
SSDEEP 3:7WHlGlll/l/lXp9ZjrPBY06ll0xeAXlZP:6H0dPBY0O8Xz
TLSH
T1C353124021C2021BC442033006C60740397412495393086142109230C49970100A12C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\ed902ee9a43ed5a7\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\ed902ee9a43ed5a7\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 960B
SHA256 ec3c1a143ffa5345e8f408fe6a5e52a164cb291b792cdd6b080cf9d110a511a8
MD5 457588a8703e9dcc0f3f903d88bdd47f
SHA1 b543b52cbfc5dde3d6b27c49d54b5262a0d2d30c
SHA512 6e6a4c68b7476f2e19b182e31879e2f83a1111587b9bc0135aa0247d488e3a4e91d706c722ef6c6195f16ae9f3e79a107e2744fec10950f4bc87fdc58c1a8dc5
TLSH
T1F7118C543BC72DB0E36674364029A2101212A10244D2D24885C088624E23204E021FA5
MD5 SHA1 SHA512 TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 41d100db2b6f52e3499e7f846076464f098b0f568166f8175df5c43eb8bfa8cf
MD5 9bb88905afc84337d53228f1cd0abec1
SHA1 120b2981b93b33f80d1ce7366758df29ecb21ce1
SHA512 0a82c80dda364540a44977790f9ddeaf46de57cb980703eee8c86682cbd4b40b45e2a8fbf5a9f0f24bd962418167b50c9b0e0f4fab8ab59057fdbe4a4179cbb6
SSDEEP 768:jc0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdb5:jyZP2tFPuNnY4UmqEMioTaBacg
TLSH
T125154137D190B085CF2C75B1E5ED5F08BA23B10712E052465FB8A67BBA633C98D1B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

video1.mp4

Path C:\Users\Admin\AppData\Local\Temp\video1.mp4
Size 2.9MB
SHA256 f49190c15efb36cff22c2d9c6d81361db2bfcc8c254232110faa0b1e71cfba4f
MD5 4c82181ec7645fe1626338bf1ae9653e
SHA1 aea1775bbd2cebae8ffcd567c79150438bcc495b
SHA512 5d358085e89506faa6f5c696d82dde0bd108c7a61f54a13cee83d856922b4528b10d59dcf5fb164af3cdc94d88a281aa78b88bd3cfe5a3900e9e45bb4c4f2c93
SSDEEP 49152:ExW63QR7dnYU8AUx7cPje1tiZe1DOZikURC6LHabxHUwt9+X/me9i:ExJ3EpYhnxcje151DPkUFLOx0Ji
TLSH
T19AE5333753BAAA10D4719372D6BE5332E7352A0051886BE79D7481B458305CBCFE8BEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

video2.mp4

Path C:\Users\Admin\AppData\Local\Temp\video2.mp4
Size 3.5MB
SHA256 2a24050160d05079b7d5ef5f8aed400fb0da8fe0755e64942e6c803b32fc60ff
MD5 30100d444c131b48b9db16a8e9f23f8c
SHA1 81e50f827cfe05e0973e9f2cd865c68975855ab5
SHA512 842ac2e5088eeee4067eb917f5242fa1e9b2db0ca21dec86469254f12401f1abe5bc85ad8398cfc0a669e1f495e868da4acc6a85389d0fa3573006117cd49388
SSDEEP 49152:rG3ubqxbEu+Onl1Bn5PYNFMvug4QZ8Nk/LRGdVlgGdo2cq/JUiK1+gwz2gZ43a4p:CMsbEu+OnYfM2tNk/VcVln/xUTq2g6qK
TLSH
T1C406335AB39014ABCAD5837418D60FAA77B5EDA1534333C7DC322E850DD6BE9AE132D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

video3.mp4

Path C:\Users\Admin\AppData\Local\Temp\video3.mp4
Size 4.1MB
SHA256 4ac139fb8dce0e44ae89f49acfc0e4418bb6734aa2e76f738190823426d29ec8
MD5 6f5b77f4faf50316aefccdc72bc12a89
SHA1 ac75557f79766c96794e9439df0b9945b154c7b0
SHA512 06934751353c78516276401c5e80a1860147bc2bc6095126078ff2f08e6a73db4682e3afc9aef4aefea616124283a16f9dd7c6b113577813baea0ec0456902d1
SSDEEP 98304:xJRGL3Y+h5auMz+d/9YAnnrDVygvaNo6MIcRRHzNy3TfmmyUULEWX:xJRc5H2+Fa7JcRlZOfmm6F
TLSH
T12C16234D63A26157C5ED93709D810B533974C8F637073187D9E26F088CAEBAB1EA13DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SP_CC6F1AA2BB28413DB686FBBAF1A20E40.dat

Path C:\Users\Admin\AppData\Local\speech\Microsoft\Speech\Files\UserLexicons\SP_CC6F1AA2BB28413DB686FBBAF1A20E40.dat
Size 940B
SHA256 a050e613c588ffbaa0b79c0f0a32c9b63edfd2cc057458c6ee1d48bf1324cf20
MD5 bb4f8483c7d4c35bf7b85235b391f76b
SHA1 37ddd1827b6d4340b78e805c40f3ac3c15cb9e9e
SHA512 a372ac06d58b662f8b0aff04c4f4d5dcd3ecf366df6dcdc5a92ce95b6abe5167cdf0ed2dbfd051e0f18a6844af9f18409e8b75ce293a0c971f16644511be306f
TLSH
T113119B4A51F00408DD9673B8F0D53DE55BD0C44AD44CE91AB5F4C05251736955B35551
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2728-166-0x0000023C2A770000-0x0000023C2A771000-memory.dmp

Download

memory/2728-174-0x0000023C2A770000-0x0000023C2A771000-memory.dmp

Download

memory/2728-178-0x0000023C2A770000-0x0000023C2A771000-memory.dmp

Download

memory/2728-173-0x0000023C2A770000-0x0000023C2A771000-memory.dmp

Download

memory/2728-175-0x0000023C2A770000-0x0000023C2A771000-memory.dmp

Download

memory/2728-177-0x0000023C2A770000-0x0000023C2A771000-memory.dmp

Download

memory/2728-176-0x0000023C2A770000-0x0000023C2A771000-memory.dmp

Download

memory/2728-168-0x0000023C2A770000-0x0000023C2A771000-memory.dmp

Download

memory/5184-41-0x00007FFDAB860000-0x00007FFDAC204000-memory.dmp

Download

memory/5184-1-0x0000000000160000-0x0000000000F32000-memory.dmp

Download

memory/5184-9-0x00007FFDAB860000-0x00007FFDAC204000-memory.dmp

Download

memory/5184-28-0x000000001EDF0000-0x000000001EE0C000-memory.dmp

Download

memory/5184-0-0x00007FFDAB9EF000-0x00007FFDAB9F0000-memory.dmp

Download

memory/5184-42-0x00007FFDAB860000-0x00007FFDAC204000-memory.dmp

Download

memory/5184-29-0x00007FFDAB860000-0x00007FFDAC204000-memory.dmp

Download

memory/5184-13-0x00007FFDAB860000-0x00007FFDAC204000-memory.dmp

Download

memory/5184-12-0x00007FFDAB860000-0x00007FFDAC204000-memory.dmp

Download

memory/5184-37-0x0000000021BD0000-0x0000000021C0E000-memory.dmp

Download

memory/5184-38-0x000000001EE20000-0x000000001EE2E000-memory.dmp

Download

memory/5184-8-0x00007FFDAB860000-0x00007FFDAC204000-memory.dmp

Download

memory/5184-40-0x00007FFDAB860000-0x00007FFDAC204000-memory.dmp

Download

memory/5184-2-0x00007FFDAB860000-0x00007FFDAC204000-memory.dmp

Download