Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 04:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Zinapah IT Audit ML 2026.scr
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Zinapah IT Audit ML 2026.scr
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Zinapah IT Audit ML 2026.scr
- Size 561KB
- Sample260810-ffg5za1fmd
- SHA256 569d1ea191d363a113679c40a6e4359863da18d9679c6e6c1ebd5c741e50cc58
- MD5 2c1da777248ad2686bcfbd7ff97a3c15
- SHA1 ecde7b578ca67ef43222f8c06f77c34158cb975d
- SHA512 465d1ec232633f8499a10c51752f6c5b530eb3d75c43da5029eb71c406b6208e4e1f1c83adb0bcff89e7004851356c1227d97d0f1839aed8a4a7c64a089f620f
- SSDEEP 12288:cyWZkyRc65sAKdDI4edOP/uaPSaR2rYQxTuy:cyWZk565sAKZ3edOHwo8Tuy
- TLSH T142C412A17A91C1D2E07045B3D752AAF1151B9D32EB8999177340BE0FFB3D482A827F39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks QEMU agent file 2 TTPs 1 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe Zinapah IT Audit ML 2026.scr - Loads dropped DLL 2 IoCs
pid Process 4632 Zinapah IT Audit ML 2026.scr 4632 Zinapah IT Audit ML 2026.scr - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4632 Zinapah IT Audit ML 2026.scr - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zinapah IT Audit ML 2026.scr - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr Token: SeDebugPrivilege 4632 Zinapah IT Audit ML 2026.scr
Processes
-
C:\Users\Admin\AppData\Local\Temp\Zinapah IT Audit ML 2026.scr"C:\Users\Admin\AppData\Local\Temp\Zinapah IT Audit ML 2026.scr" /S1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4632
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsq5CDD.tmp\System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH