4235f1f15db8e2a0e6813dcd62961fa37b23ef54d7ea7639c0234a404b9b16e1

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zpe-desktop-windows-installer.exe
Size 12.7MB
Sample260728-rh17eahf77
SHA256 4235f1f15db8e2a0e6813dcd62961fa37b23ef54d7ea7639c0234a404b9b16e1
MD5 2a2f899a1372b49730ff2e00125f0841
SHA1 2757fc232c103c1550ed854db33d14de44c4277e
SHA512 6eb20d6d25de28d5f6f7b323d790d614447aa3510a59c4bbd54501c62630e518b77b15429b2495e6a2d7cc78d43aa07738ebe0dbecc6991f767fe3816bb0d72b
SSDEEP 393216:9EOyTepRyNXpVPyb7JQAoQH0z2kBCrxfrJpIsFxO9n1n8:9EGkSJZG9BmVJmFh8
TLSH
T1A5D6331C3B779488EF1253B45FAB92B0E5E38714D4399E988A1571391FF4836AE93BC0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1212	zpe-desktop-windows-installer.exe
1212	zpe-desktop-windows-installer.exe
1212	zpe-desktop-windows-installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\3 Lados\ZPE Desktop\zpe-desktop.exe	zpe-desktop-windows-installer.exe
File created	C:\Program Files\3 Lados\ZPE Desktop\uninstall.exe	zpe-desktop-windows-installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zpe-desktop-windows-installer.exe

C:\Users\Admin\AppData\Local\Temp\zpe-desktop-windows-installer.exe
"C:\Users\Admin\AppData\Local\Temp\zpe-desktop-windows-installer.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zpe-desktop.exe

Path C:\Program Files\3 Lados\ZPE Desktop\zpe-desktop.exe
Size 30.6MB
SHA256 b7d715f92c32f6cb2dd41fdd47c9b47a370f8523c496eb0f808bcaa79ab7b093
MD5 d5295641bc101f4a1c68d65431a050dd
SHA1 46c6a19cda77dba5f18ab5f29c39d9d030be5693
SHA512 877baea0475fdb61362222de42b10e4489b77eb2acac2cd9161fea3c3a54889836a844767bfa5aac36acb867cccd1adf323635b67f3571d879167571cb7ef22d
SSDEEP 196608:ee3a9XKuldMJrdWNdA3Rf3JrJSmypYIPpdZH04eDZ+VGob7:e8wXKul0WNo45VLexo
TLSH
T129675B43F86108E5D0EDD130C9269512BBB17C595F3127E72B60FA252FB6BD0AEBA740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx6316.tmp\InstallOptions.dll
Size 15KB
SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
MD5 7854290f8bc473fb9fad1917b0065731
SHA1 27c0e4731e395dfe612d954bf8793c533c53ef8f
SHA512 736030a5e1b744d0f96745f9933a57f5b52361288d33aeeaad12e054c47c4bb705cfc7d5cd4a5e3e667a6c6252e1c2a573b2707241d7b73b60c73daf2de52038
SSDEEP 192:EJGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT2g11929WtshLAzgSrX8:EJNt+4t7uJalUnGesY7Lt8nC3/Yosa
TLSH
T1E9624D1137D598B3E2E62A797EF373138FA5FB22A4428E0BC7332E0638565805D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx6316.tmp\System.dll
Size 12KB
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsx6316.tmp\ioSpecial.ini
Size 1KB
SHA256 1661f46aeb6b35310715631713843bb6afa8f5ab4a7be1d9fb51b1143e840c20
MD5 d36bef00625584a7ddf763eca341b1a3
SHA1 a00119f0577a95b07f8e708538b3f690eb16c088
SHA512 677d4a3c77020f6c32318a5fa3a9d99b9770424fd280723afba388394c9bc474f0f8fd9d3c8fe5992f8c84c132d58cd6fab3d34f242336fa7b3765374185cd6f
TLSH
T137119D133EFD5514E2BAFB08EFF4807997397851582DD50E91D10A0E48E5B808923BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsx6316.tmp\ioSpecial.ini
Size 1KB
SHA256 2f70662be8e4470122e16fef3c7ffce15c664d26b1b9fd839ce1d576d0f0dc7a
MD5 51c920cbdb47071a2301b794ae2154bf
SHA1 9c2d89763bec19a6a835a5fe2591c262e78eed0b
SHA512 8a44c8b0330ff4d62b070ab5cee363c3db5a0c5bd823345716fe079546bfebaa136536100c3b931477790b970fffb8309d7ef983915cf9fa347ea26f60b261f9
TLSH
T16721F7037AFC1614F2BBBB14FFF440788B3A78169838C90D51D0090E08E5B40C923BAB
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads