Analysis
- max time kernel
151s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 17:04
General
- Target ZERO Macro V3 Setup.exe
- Size 70.1MB
- Sample260910-vlaqeavyes
- SHA256 f124b77ba087e78cc0cdc0ae03f528a2e9eea12ba37182a0b216f4783a38c665
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZERO Macro V3 Setup.exe"C:\Users\Admin\AppData\Local\Temp\ZERO Macro V3 Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-D78FSD1XWO.tmp\ZERO Macro V3 Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-D78FSD1XWO.tmp\ZERO Macro V3 Setup.tmp" /SL5="$501A8,72236642,1054720,C:\Users\Admin\AppData\Local\Temp\ZERO Macro V3 Setup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\ZERO Labs\ZERO Macro V3\ZERO Macro.exe"C:\Program Files\ZERO Labs\ZERO Macro V3\ZERO Macro.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
wpfgfx_cor3.dll
ZERO Macro V3 Setup.tmp
memory/1124-61-0x000002C1800D0000-0x000002C180150000-memory.dmp
memory/1124-175-0x000002C186220000-0x000002C186380000-memory.dmp
memory/1124-45-0x000002C1BA1E0000-0x000002C1BA340000-memory.dmp
memory/1124-53-0x000002C1B7CE0000-0x000002C1B7D20000-memory.dmp
memory/1124-49-0x000002C1B7C50000-0x000002C1B7CA0000-memory.dmp
memory/1124-57-0x000002C180BB0000-0x000002C1813E0000-memory.dmp
memory/1124-77-0x000002C181450000-0x000002C181470000-memory.dmp
memory/1124-97-0x000002C183340000-0x000002C183360000-memory.dmp
memory/1124-108-0x000002C1833F0000-0x000002C183440000-memory.dmp
memory/1124-105-0x000002C183580000-0x000002C183690000-memory.dmp
memory/1124-215-0x000002C185EF0000-0x000002C185F00000-memory.dmp
memory/1124-211-0x000002C186740000-0x000002C186750000-memory.dmp
memory/1124-114-0x000002C184210000-0x000002C1849B0000-memory.dmp
memory/1124-126-0x000002C1838E0000-0x000002C183910000-memory.dmp
memory/1124-134-0x000002C183910000-0x000002C183930000-memory.dmp
memory/1124-195-0x000002C185F10000-0x000002C185F30000-memory.dmp
memory/1124-199-0x000002C1889E0000-0x000002C188B60000-memory.dmp
memory/1124-93-0x000002C183390000-0x000002C1833C0000-memory.dmp
memory/1124-89-0x000002C183280000-0x000002C1832A0000-memory.dmp
memory/1124-85-0x000002C1832E0000-0x000002C183320000-memory.dmp
memory/1124-81-0x000002C183240000-0x000002C183260000-memory.dmp
memory/1124-73-0x000002C1813F0000-0x000002C181410000-memory.dmp
memory/1124-69-0x000002C1813E0000-0x000002C1813F0000-memory.dmp
memory/1124-65-0x000002C180020000-0x000002C180040000-memory.dmp
memory/1124-41-0x000002C1B9FB0000-0x000002C1BA1E0000-memory.dmp
memory/1124-192-0x000002C188580000-0x000002C188860000-memory.dmp
memory/1124-207-0x000002C183A50000-0x000002C183A60000-memory.dmp
memory/1124-122-0x000002C183850000-0x000002C1838E0000-memory.dmp
memory/1124-130-0x000002C184DB0000-0x000002C184E70000-memory.dmp
memory/1124-146-0x000002C183940000-0x000002C183960000-memory.dmp
memory/1124-142-0x000002C184EC0000-0x000002C184F10000-memory.dmp
memory/1124-150-0x000002C1859E0000-0x000002C185A30000-memory.dmp
memory/1124-162-0x000002C185960000-0x000002C185970000-memory.dmp
memory/1124-37-0x000002C1BB3C0000-0x000002C1BC320000-memory.dmp
memory/1124-33-0x000002C1B8F40000-0x000002C1B9BD0000-memory.dmp
memory/1124-158-0x000002C185B30000-0x000002C185B70000-memory.dmp
memory/1124-154-0x000002C185A90000-0x000002C185AF0000-memory.dmp
memory/1124-203-0x000002C1863D0000-0x000002C1863F0000-memory.dmp
memory/1124-179-0x000002C186060000-0x000002C1860A0000-memory.dmp
memory/1124-183-0x000002C186590000-0x000002C186700000-memory.dmp
memory/1124-171-0x000002C185FB0000-0x000002C186020000-memory.dmp
memory/1124-138-0x000002C1836F0000-0x000002C183700000-memory.dmp
memory/1124-187-0x000002C187890000-0x000002C188580000-memory.dmp
memory/1124-118-0x000002C183740000-0x000002C183770000-memory.dmp
memory/4444-6-0x0000000002F10000-0x0000000002F11000-memory.dmp
memory/4444-15-0x0000000000F40000-0x00000000013AB000-memory.dmp
memory/4444-112-0x0000000000F40000-0x00000000013AB000-memory.dmp
memory/4444-9-0x0000000000F40000-0x00000000013AB000-memory.dmp
memory/4444-10-0x0000000002F10000-0x0000000002F11000-memory.dmp
memory/4532-113-0x0000000000330000-0x0000000000440000-memory.dmp
memory/4532-8-0x0000000000330000-0x0000000000440000-memory.dmp
memory/4532-0-0x0000000000330000-0x0000000000440000-memory.dmp