ffda956b63a8bec81010f7a02ac4cbaa403b99a98ff80ed795f9929ac41829c6

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zpe-desktop-windows-installer.exe
Size 12.7MB
Sample260729-bl2pcadc96
SHA256 ffda956b63a8bec81010f7a02ac4cbaa403b99a98ff80ed795f9929ac41829c6
MD5 1a7bf05ca169f8fae148edf7d476d21f
SHA1 c9c203487144d27b75326c70238e7b291d6facf8
SHA512 f9a04952e8660b410579fc85aa7fcc9f2ac8ff7090d09802619f3df6d36692fce81fba7e745b473cd2f60333a09cf177b4b9f7164023cb2b6c67734e6df89f96
SSDEEP 196608:9A70yAyMGXjeFV7PEE+sy+UktNyD5NnWXaJLXc2mefmKM+WMyLR2j0FdUKTHapfD:9HOzU7sEpkC4DaReu3+W5pTHaljvn7
TLSH
T1CCD6335BB0B55B98D75017B08CBBEA6E96F69E6C212208421C461FB303B10CFFF9656D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
4516	zpe-desktop-windows-installer.exe
4516	zpe-desktop-windows-installer.exe
4516	zpe-desktop-windows-installer.exe
4516	zpe-desktop-windows-installer.exe
4516	zpe-desktop-windows-installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\3 Lados\ZPE Desktop\zpe-desktop.exe	zpe-desktop-windows-installer.exe
File created	C:\Program Files\3 Lados\ZPE Desktop\uninstall.exe	zpe-desktop-windows-installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zpe-desktop-windows-installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
1776	taskkill.exe
4368	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1776	taskkill.exe
Token: SeDebugPrivilege	4368	taskkill.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 1776	4516	zpe-desktop-windows-installer.exe	86
PID 4516 wrote to memory of 4368	4516	zpe-desktop-windows-installer.exe	89

C:\Users\Admin\AppData\Local\Temp\zpe-desktop-windows-installer.exe
"C:\Users\Admin\AppData\Local\Temp\zpe-desktop-windows-installer.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /IM "zpe-desktop.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM "zpe-desktop.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zpe-desktop.exe

Path C:\Program Files\3 Lados\ZPE Desktop\zpe-desktop.exe
Size 30.6MB
SHA256 a3363b0308ef2674ce09c6aba0c37a4821876937f0e93a4c63f45738c2e86c9f
MD5 430b427b5e70ec512ba5ba15124fa900
SHA1 89543d8342dfc19c59755e0d399f5dea93501661
SHA512 6c70bdd10c5e0457817c18cfdb1e465c42f3a64bc222909d5e5f31bd86e28ac1adcd73d4acd4c624af3cecf5b564c574fcd63a868c56013c215e232c93459e89
SSDEEP 196608:LQJDodxRwklMA2SimtkVnB4YTP/Z1jEZ7lyI0pAMGBCxim+WGo:L2gRwklNtkl2YoYUBTo
TLSH
T165673A43F86109D5D0EDD130C9669512BB717C994F2027E72B60FA252FBABD0AEBB740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl6E46.tmp\InstallOptions.dll
Size 15KB
SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
MD5 7854290f8bc473fb9fad1917b0065731
SHA1 27c0e4731e395dfe612d954bf8793c533c53ef8f
SHA512 736030a5e1b744d0f96745f9933a57f5b52361288d33aeeaad12e054c47c4bb705cfc7d5cd4a5e3e667a6c6252e1c2a573b2707241d7b73b60c73daf2de52038
SSDEEP 192:EJGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT2g11929WtshLAzgSrX8:EJNt+4t7uJalUnGesY7Lt8nC3/Yosa
TLSH
T1E9624D1137D598B3E2E62A797EF373138FA5FB22A4428E0BC7332E0638565805D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl6E46.tmp\System.dll
Size 12KB
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsl6E46.tmp\ioSpecial.ini
Size 1KB
SHA256 6504ba8ca3d8bf6fde3468fc27acb7a485191b2195b908093213c94b1372359c
MD5 fdccc3675536710a5733545fd62af436
SHA1 af2429bc3672f00aca5bff9524b7d39d37472faf
SHA512 73378afc35b9c28aaeb75de9fea009e70ae3156f08d1c3ba9a2a4d9c27d48dc028841d065948e2a1fcef84e6a836ccf7e81939d55dfc4a34dba25e5af174c2df
TLSH
T103119D1339FC5514E2BAFB08EFF4807597397851682DC50E91D10A0E48E6B808923BEB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsl6E46.tmp\ioSpecial.ini
Size 1KB
SHA256 d9fa32a0320801a5f34c5d67aa32181f3d3eb14d6edabd5164cfb1e240450b1f
MD5 7d810a1192d313d74763c65284075a4e
SHA1 fbd43cf1a4829c74d1a26c9feddf1ae37f10d65e
SHA512 eb0d3a79eeadb06242a333f449c83c83955f5911903378e1eee0802154f3761282cb09645f1b369f2a5403e4fecd6534ac9aa4adb571cf31a50c69ffec30c407
TLSH
T10421BE037AFC1614F2BABB14FFF541748B3A7816AC39C60D81D1090E09E5B80C963BAB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsl6E46.tmp\ioSpecial.ini
Size 1KB
SHA256 d0986536822705c2e0523c10465b671cff461b437391c4bd70192a1cfe00c11d
MD5 96d42882a0190b3c77eee2815aa38e14
SHA1 11dccb33f9d0b1408752cdaa35c5f6a800fa527b
SHA512 569be9ddb0cf088b83ea9fe384cf681b5054742fd7581da1a4f7ca7b9592d7a59d56bb4835c58fafb6fa301fdada35a8f86c97f5f463a1f3856c37c876a5690e
TLSH
T17121A1137AFC1614F2BABB14FFF541759B3A7815A839C60D41D10A0E09E5B80C963BAB
MD5 SHA1 SHA512 TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl6E46.tmp\nsExec.dll
Size 7KB
SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
MD5 c953dd0aab774f1446fcd63fa7c5f613
SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
TLSH
T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads