ec6b4972de50a47fe489506347f523c24b5ff016c9539992df6f69949cdf86b6

Resubmissions

07/08/2026, 08:48

260807-kqf3wa1cmb3

07/08/2026, 08:45

260807-knr3cstybv3

Analysis

user interaction
yes
max time kernel
100s
max time network
58s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 08:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
entry_1_0/ZONDTEM1D.exe
Size 7.5MB
Sample260807-knr3cstybv
SHA256 ec6b4972de50a47fe489506347f523c24b5ff016c9539992df6f69949cdf86b6
MD5 547dee4530a57b098ec3b75b9070369f
SHA1 89f69ab9352e38a1157242384d4f2450228734a0
SHA512 90fbfaa41a1a509f4bf099b8975b4c35f6e438879054784c1be2996f73b2a6c60cc90780a0910d67b96f70c8629e46dfba034f9497b3856c804e39c882a3f4b0
SSDEEP 98304:5BZcCjUvYkRm+kRmpZZEQTq8V7gMHgTJIV5qkf7k8iSm91tV4/v1ipi/5HVTy3Hh:2CjaxkR5t89/lVxT9iS3/5HVtGJ
TLSH
T17E865A23BA9AD436C45715389D1B9BED1A2BBF307E20559736A93F2CEFB53803524213
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZONDTEM1D.exe

Modifies registry class 49 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	ZONDTEM1D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	ZONDTEM1D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tdfMAVFile\DefaultIcon	ZONDTEM1D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	ZONDTEM1D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	ZONDTEM1D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	ZONDTEM1D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ZONDTEM1D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	ZONDTEM1D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tdf\ = "tdfMAVFile"	ZONDTEM1D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tdfMAVFile	ZONDTEM1D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tdfMAVFile\ = "ZONDTEM1d - IP field data"	ZONDTEM1D.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	ZONDTEM1D.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy	ZONDTEM1D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tdfMAVFile\shell\open\command	ZONDTEM1D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tdfMAVFile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\entry_1_0\\ZONDTEM1D.exe %1"	ZONDTEM1D.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	ZONDTEM1D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	ZONDTEM1D.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	ZONDTEM1D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	ZONDTEM1D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	ZONDTEM1D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tdf	ZONDTEM1D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tdpMAVFile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\entry_1_0\\ZONDTEM1D.exe,2"	ZONDTEM1D.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ZONDTEM1D.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	ZONDTEM1D.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	ZONDTEM1D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	ZONDTEM1D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tdpMAVFile\DefaultIcon	ZONDTEM1D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tdpMAVFile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\entry_1_0\\ZONDTEM1D.exe %1"	ZONDTEM1D.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	ZONDTEM1D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tdfMAVFile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\entry_1_0\\ZONDTEM1D.exe,1"	ZONDTEM1D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tdfMAVFile\shell\open	ZONDTEM1D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tdp	ZONDTEM1D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tdpMAVFile\shell\open\command	ZONDTEM1D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	ZONDTEM1D.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	ZONDTEM1D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	ZONDTEM1D.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	ZONDTEM1D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tdfMAVFile\shell	ZONDTEM1D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tdpMAVFile	ZONDTEM1D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\tdpMAVFile\ = "ZONDTEM1d - IP project file"	ZONDTEM1D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	ZONDTEM1D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	ZONDTEM1D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	ZONDTEM1D.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	ZONDTEM1D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ZONDTEM1D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tdp\ = "tdpMAVFile"	ZONDTEM1D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tdpMAVFile\shell	ZONDTEM1D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\tdpMAVFile\shell\open	ZONDTEM1D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	ZONDTEM1D.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4044	ZONDTEM1D.exe
4044	ZONDTEM1D.exe
4044	ZONDTEM1D.exe
4044	ZONDTEM1D.exe
4044	ZONDTEM1D.exe
4044	ZONDTEM1D.exe
4044	ZONDTEM1D.exe
4044	ZONDTEM1D.exe
4044	ZONDTEM1D.exe
4044	ZONDTEM1D.exe
4044	ZONDTEM1D.exe
4044	ZONDTEM1D.exe

C:\Users\Admin\AppData\Local\Temp\entry_1_0\ZONDTEM1D.exe
"C:\Users\Admin\AppData\Local\Temp\entry_1_0\ZONDTEM1D.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ZONDTEM1D.in

Path C:\Users\Admin\AppData\Local\Temp\entry_1_0\ZONDTEM1D.in
Size 20B
SHA256 cddad90e91fb126bd1f1f7d1df1b11f4180ce6c9e0420166879c9605bcae06c3
MD5 d0f52b4d0677650e0d1ad0747b6f3015
SHA1 03decb21ce3da124e4e58edaa6ad9a533ffc1eb6
SHA512 7271bf6b7b774d90c99d55c9bfea96adc6a8b406d81ea96b7da6d12d7012253787a911698ffa17c4851f9c70684a86b1a28a1d55626aa091a8cb137bc7a48f8e
MD5 SHA1 SHA512

Submit Download

ZONDTEM1D.in

Path C:\Users\Admin\AppData\Local\Temp\entry_1_0\ZONDTEM1D.in
Size 55B
SHA256 847d5f0184875322e84ea06e849cca7caac429e006367352c17fc0e2182ff875
MD5 a39c04af9bb33b2f0e4ff88fa1cf58d2
SHA1 02ea45201d61d0989e846fbcb0b7a77c5a754e74
SHA512 d05a9ac35305d713aa8e52afeefa0f08a6a4d7f5898bddf58c89386cbfddfbb18132ba43c2962d9018476f1734b2f667dcb8c1f345f525a6b217e6f8fec2d356
TLSH
T1E490026C605101156471519506F45750B1568509C1925505F247D1909A5257994AF562
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4044-70-0x0000000000400000-0x0000000000BB3000-memory.dmp

Download

memory/4044-71-0x0000000000400000-0x0000000000BB3000-memory.dmp

Download

memory/4044-60-0x0000000000400000-0x0000000000BB3000-memory.dmp

Download

memory/4044-61-0x0000000000400000-0x0000000000BB3000-memory.dmp

Download

memory/4044-62-0x0000000000400000-0x0000000000BB3000-memory.dmp

Download

memory/4044-63-0x0000000000400000-0x0000000000BB3000-memory.dmp

Download

memory/4044-64-0x0000000000400000-0x0000000000BB3000-memory.dmp

Download

memory/4044-69-0x0000000000400000-0x0000000000BB3000-memory.dmp

Download

memory/4044-0-0x0000000000982000-0x0000000000983000-memory.dmp

Download

memory/4044-1-0x0000000000400000-0x0000000000BB3000-memory.dmp

Download

memory/4044-72-0x0000000000400000-0x0000000000BB3000-memory.dmp

Download

memory/4044-73-0x0000000000400000-0x0000000000BB3000-memory.dmp

Download

memory/4044-74-0x0000000000400000-0x0000000000BB3000-memory.dmp

Download

memory/4044-75-0x0000000000400000-0x0000000000BB3000-memory.dmp

Download

memory/4044-76-0x0000000000400000-0x0000000000BB3000-memory.dmp

Download

memory/4044-77-0x0000000000400000-0x0000000000BB3000-memory.dmp

Download

memory/4044-78-0x0000000000400000-0x0000000000BB3000-memory.dmp

Download

memory/4044-79-0x0000000000400000-0x0000000000BB3000-memory.dmp

Download

memory/4044-80-0x0000000000400000-0x0000000000BB3000-memory.dmp

Download

memory/4044-81-0x0000000000400000-0x0000000000BB3000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads