Overview

overview

7

Static

static

3

Zuhls Macr....0.exe

windows11-21h2-x64

7

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDIR/UAC.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

LICENSES.c...m.html

windows11-21h2-x64

3

Zuhls Macro.exe

windows11-21h2-x64

1

d3dcompiler_47.dll

windows11-21h2-x64

1

ffmpeg.dll

windows11-21h2-x64

1

libEGL.dll

windows11-21h2-x64

1

libGLESv2.dll

windows11-21h2-x64

1

resources/app.js

windows11-21h2-x64

3

resources/elevate.exe

windows11-21h2-x64

3

vk_swiftshader.dll

windows11-21h2-x64

1

vulkan-1.dll

windows11-21h2-x64

1

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

$PLUGINSDI...7z.dll

windows11-21h2-x64

3

$R0/Uninst...ro.exe

windows11-21h2-x64

7

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDIR/UAC.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    09/08/2026, 22:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Zuhls Macro.exe
  • Size 164.7MB
  • Sample260809-13mdeswfpg
  • SHA256 252fcec67588dbdc8d686c112575d0a242b1fa8ab38081ba9c35ffb6fef12ed0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe
    "C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe
      "C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --use-angle=d3d11 --user-data-dir="C:\Users\Admin\AppData\Roaming\zuhls-macro" --gpu-preferences=WAAAAAAAAADgAQAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=1648 --field-trial-handle=1652,i,11933335915874327991,11901297788087654925,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:4948
      • C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe
        "C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=d3d11 --ignore-certificate-errors --user-data-dir="C:\Users\Admin\AppData\Roaming\zuhls-macro" --mojo-platform-channel-handle=1960 --field-trial-handle=1652,i,11933335915874327991,11901297788087654925,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
          PID:3416
        • C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe
          "C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\zuhls-macro" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --first-renderer-process --no-sandbox --force-color-profile=srgb --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2224 --field-trial-handle=1652,i,11933335915874327991,11901297788087654925,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
          2⤵
            PID:632
          • C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe
            "C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\zuhls-macro" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --no-sandbox --force-color-profile=srgb --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3128 --field-trial-handle=1652,i,11933335915874327991,11901297788087654925,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
            2⤵
              PID:2884

          Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                default.dic
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                • Size 2B
                • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                • MD5 SHA1 SHA512
                Submit Download

                Network Persistent State
                • Path C:\Users\Admin\AppData\Roaming\zuhls-macro\Network\Network Persistent State
                • Size 300B
                • SHA256 cefff8e30f41d4bd8a353d5d06ed54b97737b9a2abd4d570c758f1785e1d3fb1
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Network Persistent State~RFe593a40.TMP
                • Path C:\Users\Admin\AppData\Roaming\zuhls-macro\Network\Network Persistent State~RFe593a40.TMP
                • Size 59B
                • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                CURRENT
                • Path C:\Users\Admin\AppData\Roaming\zuhls-macro\Session Storage\CURRENT
                • Size 16B
                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                • MD5 SHA1 SHA512
                Submit Download