Analysis
- user interaction
yes - max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 12:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ZapretX.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
ZapretX.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target ZapretX.exe
- Size 385KB
- Sample260809-prcjaser2v
- SHA256 cb26314d6fe8a031ccf7bf3300085c3efbe38721e170c76cd462c4fa84f53f46
- MD5 e5b2f51830ae840c73bbafe8b435476b
- SHA1 d0f4286a516102fe9b8097fc163c3ff5227074e7
- SHA512 1c9ae278b207db3d17ff37eadc5a2cf7238c957b4499074ee7d399b9f24c8be381ab568c4cd8f92d490dfb686af575572ea4f3b6c781e8b18f4a630a14611fb2
- SSDEEP 6144:zddVcSvTrVLssSgDx/Rxoodkr97m0PmBLO8buo8H0:3miTiKsmTAF
- TLSH T1D384D6143FA98E08E580257E855E1604DB9ED1F226327343370AEF624D459DEEE2D3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\zapret-hlauncher" ZapretX.exe - Executes dropped EXE 1 IoCs
pid Process 4044 zapret-hlauncher - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 api.ipify.org 32 api.ipify.org 13 api.ipify.org - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\zapret-hlauncher ZapretX.exe File opened for modification C:\Program Files\zapret-hlauncher zapret-hlauncher File created C:\Program Files\zapret-hlauncher ZapretX.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\zapret-hlauncher ZapretX.exe File opened for modification C:\Windows\zapret-hlauncher ZapretX.exe File opened for modification C:\Windows\zapret-hlauncher zapret-hlauncher - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3432 cmd.exe 3480 cmd.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 908 schtasks.exe 220 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4148 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2284 ZapretX.exe Token: SeDebugPrivilege 4148 taskmgr.exe Token: SeSystemProfilePrivilege 4148 taskmgr.exe Token: SeCreateGlobalPrivilege 4148 taskmgr.exe Token: SeDebugPrivilege 4044 zapret-hlauncher Token: SeIncBasePriorityPrivilege 4044 zapret-hlauncher - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe 4148 taskmgr.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2324 2284 ZapretX.exe 90 PID 2284 wrote to memory of 3432 2284 ZapretX.exe 92 PID 3432 wrote to memory of 908 3432 cmd.exe 94 PID 2284 wrote to memory of 3480 2284 ZapretX.exe 95 PID 3480 wrote to memory of 220 3480 cmd.exe 99 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZapretX.exe"C:\Users\Admin\AppData\Local\Temp\ZapretX.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="hKEwRd+VREM}R&" dir=in action=allow program="C:\Windows\zapret-hlauncher" enable=yes & exit2⤵PID:2324
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\zapret-hlauncher" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\zapret-hlauncher" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:908
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Program Files\zapret-hlauncher" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Program Files\zapret-hlauncher" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:220
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4148
-
C:\Windows\zapret-hlauncherC:\Windows\zapret-hlauncher1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4044
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1