Analysis
- user interaction
yes - max time kernel
150s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 21:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
zinc-1.21.11.jar
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
zinc-1.21.11.jar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target zinc-1.21.11.jar
- Size 651KB
- Sample260715-z2fntaev2j
- SHA256 cc0a5090ce5d5b8f9600c1eb7c8da264de4cc19a6eb42ef21e454b164590504e
- MD5 8b8d06a59eaff3ccb292d73abe8ebd2d
- SHA1 3720c51fa2b8986017acdbd78f1826f3fae80938
- SHA512 22d3c6019566f519a453e204d8a3cd519721e33c293f91523e70286b432b09e52e5e72f98027911904cff3cd343b9b02a2c9719ed1af4e561f5c2579b4258d8d
- SSDEEP 12288:8O7o6iRaxdyKa4L+eLqUUMsYQL2fz+j//NNft2qqNu2lAqYXSGK4jElbGnB1yE5:8OUaggiPUUMLQSL+j/FbmI8N6tKr66E5
- TLSH T1F6E412273EF0846EDD3B9970B592C092E84CA5D8B85EA48F419D04CD14E2CDB47E9BDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 4140 taskmgr.exe Token: SeSystemProfilePrivilege 4140 taskmgr.exe Token: SeCreateGlobalPrivilege 4140 taskmgr.exe Token: 33 4140 taskmgr.exe Token: SeIncBasePriorityPrivilege 4140 taskmgr.exe Token: SeDebugPrivilege 3836 taskmgr.exe Token: SeSystemProfilePrivilege 3836 taskmgr.exe Token: SeCreateGlobalPrivilege 3836 taskmgr.exe Token: 33 3836 taskmgr.exe Token: SeIncBasePriorityPrivilege 3836 taskmgr.exe Token: SeDebugPrivilege 788 taskmgr.exe Token: SeSystemProfilePrivilege 788 taskmgr.exe Token: SeCreateGlobalPrivilege 788 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 4140 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe 3836 taskmgr.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4140 taskmgr.exe 3836 taskmgr.exe 788 taskmgr.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\zinc-1.21.11.jar1⤵PID:3388
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4140
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3652
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3836
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:788
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\D3DSCache\b7c78e20530d35f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
- Size 64KB
- SHA256 42c4fcd383e47854e66057644f88979287b077564fa0e83dd5097623e224804c
- MD5 d5b8e33845632b223ead9f7767ee1379
- SHA1 5c1b01562bc2bd424d2d703de91e00b40379f3c8
- SHA512 5ca20e1fadc3d123a174427c582e6822453d233accd614ae0e0d77978b631e9c0b355a0090f2602cfb451f5aec4021898e6a294597d7787424e761071834e2a8
- SSDEEP 3:t89llGlll/l/lXp9ZjrPBY06llqlHeU/ZP:sl0dPBY0OcPJ
- TLSH T12053244151C30317C443033004CF07443F75130C4343043143105370C45CF0040F11C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\D3DSCache\b7c78e20530d35f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
- Size 4B
- SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
- MD5 f49655f856acb8884cc0ace29216f511
- SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
- SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\D3DSCache\b7c78e20530d35f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
- Size 960B
- SHA256 565de87de825884dfdd98f37a1b05d5293eb72bb28ba1950f879e0082b0344c8
- MD5 41771ed4b8806ab6a027db8f95942da4
- SHA1 7fa42f8cc0b391d46d29dd25c08ca7483646c430
- SHA512 5b6e35b911a88c142ea61a14ebe98987da3f5e1b1d6898b28558a1f80f45ca27fc1518c21464bdb9ac86e2f1b7cbeaab02cedb2b89ba34ea96e46b4f6116b44a
- TLSH T1EB118C483BCB2CB0E33A7830002992201203B12208D2D20C8AC084668A31104D032FA8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\TaskManager\settings.json
- Size 14KB
- SHA256 c3184ab6d0273c4d9ea967679d686ba810081034a4a582d29624a806fe00b68c
- MD5 8a283c2ff8d613712f94f74d280d04e7
- SHA1 eaf903ae4aeab9ebe49d63971014904dd888bbfc
- SHA512 f14f4293f73775219c93a09c4cc257370bd64ae1b2579fea2e56ba45c531258cb8e5f0589dec0071fba173935d872086864b7e3c7c7ccb6696f0bc57d9f73166
- SSDEEP 384:sIiol3FwYVp8lzrZZrzDqT5fERZW7j5U/qdc741ybaS:riol3FwYVp8lzrZlCT5fERZW7j5UaS
- TLSH T112626929A465DE2C87A01ED03C3F294F5E963310BFE596F8E1FF4E0476818AD2326765
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\TaskManager\settings.json
- Size 14KB
- SHA256 c7d30aeed2c3a4e185f1e86797cc8ba165ded70a9884301fa4152946235421fa
- MD5 5552fcc96e2adb80601ab01d83492244
- SHA1 8aa7fd971450d5f48174614dab32121a371e901f
- SHA512 fe26867fa982c27ebda6af4e79a622c3a30e5c0492af86c4cf2c6c16cedfad705bce6a4c6182bfd2257a6f26c6496543a2471728e4775f38099f7e2a2fc206e4
- SSDEEP 384:sIiol3FwNpp8lzrZZrzDqT5fERZW7j5U/qdc741ybad:riol3FwNpp8lzrZlCT5fERZW7j5Uad
- TLSH T13C627A29A465DE2C87A01ED03C3F294F5E963310BFE596F8E1FF4E0476818AD2326765
- MD5 SHA1 SHA512 SSDEEP TLSH