Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 12:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ZClient.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
ZClient.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target ZClient.exe
- Size 442KB
- Sample260730-ptfnqsap2s
- SHA256 e328e4aacda57f19f04a5e658ee7c93794983db9d6a636dcd289234bc8c0fd2b
- MD5 d7194ffea83919fa3f515172837875eb
- SHA1 c0df600fc28bcb5d3ac24a60be77515b7114150f
- SHA512 6365ae426217a2f7d94ce2278b3730e8350e873e7908cf5f66406d039d14dc2ab6ef31b8427d14b0d57013f578851fe5ca4e38ef4f0d0c13661f713d54e01a23
- SSDEEP 6144:H+tJDznSqlGORxxtY/9SYV5JT/SJE/++hUcSLhdOtJUDp3YqEDPmtPS:H+L5jR29ZJT/SJE/++8leZIPS
- TLSH T1C6A43B99FB4355F0E22745B18DDFE7BB862476018522FFF7EF4ECA52B4322122902295
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZClient.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 ZClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID ZClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 ZClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID ZClient.exe - Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Control Panel\Colors ZClient.exe - Modifies registry class 37 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zlo\Shell\Open\Command ZClient.exe Set value (data) \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff ZClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ ZClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\ ZClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ ZClient.exe Key created \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 ZClient.exe Set value (int) \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2" ZClient.exe Key created \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags ZClient.exe Key created \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 ZClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ ZClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ ZClient.exe Key created \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings ZClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ ZClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\ ZClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\ ZClient.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zlo\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ZClient.exe,0" ZClient.exe Set value (str) \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents" ZClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ ZClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ ZClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\ ZClient.exe Key created \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\NotificationData ZClient.exe Key created \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU ZClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zlo ZClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zlo\Shell ZClient.exe Set value (data) \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff ZClient.exe Set value (data) \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000 ZClient.exe Set value (data) \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff ZClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ ZClient.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zlo\URL Protocol ZClient.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zlo\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ZClient.exe\" \"%1\"" ZClient.exe Set value (data) \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 ZClient.exe Set value (data) \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 ZClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zlo\DefaultIcon ZClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zlo\Shell\Open ZClient.exe Key created \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell ZClient.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zlo\ = "URL:zlo protocol" ZClient.exe Key created \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell ZClient.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe 4928 ZClient.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4928 ZClient.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4928 ZClient.exe 4928 ZClient.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4928 ZClient.exe 4928 ZClient.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4928 ZClient.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZClient.exe"C:\Users\Admin\AppData\Local\Temp\ZClient.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4928