Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 17:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ZhangWallPaperSetup.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
ZhangWallPaperSetup.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target ZhangWallPaperSetup.exe
- Size 3.8MB
- Sample260916-vpd71atarc
- SHA256 1f593377f3cf75b4f2cf0e0937221b62e7f67c341635b3f530b5098a3b9466f7
- MD5 ac68bdbf469cf908014035c45bbd36e2
- SHA1 051467db593d90da6d6624de9ad2be7e82053184
- SHA512 d78b3e9d06848638f3240ae9f825e24f4737c69f5e39d300d0fbeccf6ffb5cac948478694124d49ae5cc0fe9fa2c08ece590239fecb88a2fbbb95778d49e7159
- SSDEEP 98304:EHeF+roFYBzakMPYsjwKVqvgSt8haoMbtZetE+KKCn7:E1Fs0uuKa4E+W7
- TLSH T137068C31B68BC537D57A15B0692CDBAF5069BE650FB094D763D83E6E08B08C34632E27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 6 IoCs
pid Process 3356 MsiExec.exe 3356 MsiExec.exe 3356 MsiExec.exe 3356 MsiExec.exe 3356 MsiExec.exe 3356 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: ZhangWallPaperSetup.exe File opened (read-only) \??\K: ZhangWallPaperSetup.exe File opened (read-only) \??\M: ZhangWallPaperSetup.exe File opened (read-only) \??\U: ZhangWallPaperSetup.exe File opened (read-only) \??\Z: ZhangWallPaperSetup.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: ZhangWallPaperSetup.exe File opened (read-only) \??\O: ZhangWallPaperSetup.exe File opened (read-only) \??\W: ZhangWallPaperSetup.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: ZhangWallPaperSetup.exe File opened (read-only) \??\G: ZhangWallPaperSetup.exe File opened (read-only) \??\S: ZhangWallPaperSetup.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: ZhangWallPaperSetup.exe File opened (read-only) \??\P: ZhangWallPaperSetup.exe File opened (read-only) \??\V: ZhangWallPaperSetup.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: ZhangWallPaperSetup.exe File opened (read-only) \??\Q: ZhangWallPaperSetup.exe File opened (read-only) \??\Y: ZhangWallPaperSetup.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\R: ZhangWallPaperSetup.exe File opened (read-only) \??\X: ZhangWallPaperSetup.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: ZhangWallPaperSetup.exe File opened (read-only) \??\D: ZhangWallPaperSetup.exe File opened (read-only) \??\H: ZhangWallPaperSetup.exe File opened (read-only) \??\T: ZhangWallPaperSetup.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZhangWallPaperSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 4936 msiexec.exe Token: SeCreateTokenPrivilege 4388 ZhangWallPaperSetup.exe Token: SeAssignPrimaryTokenPrivilege 4388 ZhangWallPaperSetup.exe Token: SeLockMemoryPrivilege 4388 ZhangWallPaperSetup.exe Token: SeIncreaseQuotaPrivilege 4388 ZhangWallPaperSetup.exe Token: SeMachineAccountPrivilege 4388 ZhangWallPaperSetup.exe Token: SeTcbPrivilege 4388 ZhangWallPaperSetup.exe Token: SeSecurityPrivilege 4388 ZhangWallPaperSetup.exe Token: SeTakeOwnershipPrivilege 4388 ZhangWallPaperSetup.exe Token: SeLoadDriverPrivilege 4388 ZhangWallPaperSetup.exe Token: SeSystemProfilePrivilege 4388 ZhangWallPaperSetup.exe Token: SeSystemtimePrivilege 4388 ZhangWallPaperSetup.exe Token: SeProfSingleProcessPrivilege 4388 ZhangWallPaperSetup.exe Token: SeIncBasePriorityPrivilege 4388 ZhangWallPaperSetup.exe Token: SeCreatePagefilePrivilege 4388 ZhangWallPaperSetup.exe Token: SeCreatePermanentPrivilege 4388 ZhangWallPaperSetup.exe Token: SeBackupPrivilege 4388 ZhangWallPaperSetup.exe Token: SeRestorePrivilege 4388 ZhangWallPaperSetup.exe Token: SeShutdownPrivilege 4388 ZhangWallPaperSetup.exe Token: SeDebugPrivilege 4388 ZhangWallPaperSetup.exe Token: SeAuditPrivilege 4388 ZhangWallPaperSetup.exe Token: SeSystemEnvironmentPrivilege 4388 ZhangWallPaperSetup.exe Token: SeChangeNotifyPrivilege 4388 ZhangWallPaperSetup.exe Token: SeRemoteShutdownPrivilege 4388 ZhangWallPaperSetup.exe Token: SeUndockPrivilege 4388 ZhangWallPaperSetup.exe Token: SeSyncAgentPrivilege 4388 ZhangWallPaperSetup.exe Token: SeEnableDelegationPrivilege 4388 ZhangWallPaperSetup.exe Token: SeManageVolumePrivilege 4388 ZhangWallPaperSetup.exe Token: SeImpersonatePrivilege 4388 ZhangWallPaperSetup.exe Token: SeCreateGlobalPrivilege 4388 ZhangWallPaperSetup.exe Token: SeCreateTokenPrivilege 4388 ZhangWallPaperSetup.exe Token: SeAssignPrimaryTokenPrivilege 4388 ZhangWallPaperSetup.exe Token: SeLockMemoryPrivilege 4388 ZhangWallPaperSetup.exe Token: SeIncreaseQuotaPrivilege 4388 ZhangWallPaperSetup.exe Token: SeMachineAccountPrivilege 4388 ZhangWallPaperSetup.exe Token: SeTcbPrivilege 4388 ZhangWallPaperSetup.exe Token: SeSecurityPrivilege 4388 ZhangWallPaperSetup.exe Token: SeTakeOwnershipPrivilege 4388 ZhangWallPaperSetup.exe Token: SeLoadDriverPrivilege 4388 ZhangWallPaperSetup.exe Token: SeSystemProfilePrivilege 4388 ZhangWallPaperSetup.exe Token: SeSystemtimePrivilege 4388 ZhangWallPaperSetup.exe Token: SeProfSingleProcessPrivilege 4388 ZhangWallPaperSetup.exe Token: SeIncBasePriorityPrivilege 4388 ZhangWallPaperSetup.exe Token: SeCreatePagefilePrivilege 4388 ZhangWallPaperSetup.exe Token: SeCreatePermanentPrivilege 4388 ZhangWallPaperSetup.exe Token: SeBackupPrivilege 4388 ZhangWallPaperSetup.exe Token: SeRestorePrivilege 4388 ZhangWallPaperSetup.exe Token: SeShutdownPrivilege 4388 ZhangWallPaperSetup.exe Token: SeDebugPrivilege 4388 ZhangWallPaperSetup.exe Token: SeAuditPrivilege 4388 ZhangWallPaperSetup.exe Token: SeSystemEnvironmentPrivilege 4388 ZhangWallPaperSetup.exe Token: SeChangeNotifyPrivilege 4388 ZhangWallPaperSetup.exe Token: SeRemoteShutdownPrivilege 4388 ZhangWallPaperSetup.exe Token: SeUndockPrivilege 4388 ZhangWallPaperSetup.exe Token: SeSyncAgentPrivilege 4388 ZhangWallPaperSetup.exe Token: SeEnableDelegationPrivilege 4388 ZhangWallPaperSetup.exe Token: SeManageVolumePrivilege 4388 ZhangWallPaperSetup.exe Token: SeImpersonatePrivilege 4388 ZhangWallPaperSetup.exe Token: SeCreateGlobalPrivilege 4388 ZhangWallPaperSetup.exe Token: SeCreateTokenPrivilege 4388 ZhangWallPaperSetup.exe Token: SeAssignPrimaryTokenPrivilege 4388 ZhangWallPaperSetup.exe Token: SeLockMemoryPrivilege 4388 ZhangWallPaperSetup.exe Token: SeIncreaseQuotaPrivilege 4388 ZhangWallPaperSetup.exe Token: SeMachineAccountPrivilege 4388 ZhangWallPaperSetup.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4388 ZhangWallPaperSetup.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4936 msiexec.exe 3356 MsiExec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4936 wrote to memory of 3356 4936 msiexec.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZhangWallPaperSetup.exe"C:\Users\Admin\AppData\Local\Temp\ZhangWallPaperSetup.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4388
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8D6C8400EF139F58DF01BE758E0E9C28 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3356
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4388\background
- Size 33KB
- SHA256 b8a3b818ae6f3f185a0727466c40c1856c13993a1c58d9e37bd1556a4226f4dc
- MD5 1910654994e9431f7e8deac7c1d5c941
- SHA1 c8415dcb8b2ade50b5fab790c23f24a3a380890e
- SHA512 ebf6c61030195cdc1905ec2aeae8f60e87cdd458225a1b045319fdff01a091c3fe582be88c3f9f85e3fbd05ba8e4bca781c11c8296177f608c3f50e39b02a628
- SSDEEP 768:/wSL7mD8/cqdWfJCqKCh2NUjDmFcN4Uf4KEUMJF3:YU7mD8/cOO9gNoiFcN4hlUMJF3
- TLSH T17CE2E05934959FF399CE933F48C7A7223B83D136A9BB24881A53916D74C347EA2136A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4388\glassbackground
- Size 414KB
- SHA256 950a19812e83091c1a3a8f62bcf8499b3deca1635aeb029e236025e1bee9b2f3
- MD5 599c096375e98fb6b14f8df4f70f252a
- SHA1 14ddf68a69a8ff88bbc3c5eba6efc2ece9893ef8
- SHA512 0ef8ce3ae5280072b36e76c9f67488089e1f5e046e6fe6692c8b8fcba32e9d08993be1841e314c392533b909374dc1bf0cabb3187467c9dfc49c5809645db99f
- SSDEEP 6144:pb7HzZ+l6Tq5qxAlaWy13v8uB+3AIh6Six/slIvzqLBHA4ICqKrrD5cSiLHomZFG:dHclSwyx8uB+jh6rhEB9HA4ICr5yHjFG
- TLSH T1559423513AB2C6386C9FE8B46B87CE3106A7B0E245D2774BE9D633CCBDB2C156710616
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4388\glassbackgroundsmall
- Size 5KB
- SHA256 d1da4f87faa0cd9b90d400d6276c45c77599326f4f813c625b88811153ce1dec
- MD5 ce1bcd853509d451eef57b8f2b9fe3d7
- SHA1 3ee660d8e45d706af617063e5f98d0b6d6b1da04
- SHA512 55a5284bd87a16443793cc5ca0838df5d4a5e6bd24f7b32c6b9f853a76ba6c569807c2ad3a78c08f5e1e922d63c8271b2e5d63a4be6bf3fac4bda81dee8f3dbd
- SSDEEP 96:NcAc0xwpGjrXLkb5BX2wqWrDS8je3E3A++uHnUaOTM/oo2aJOnK/jS/LJ1U6Quua:RNjzYb5kwbDStEQRuH4A/o3aJOnHHU67
- TLSH T14CC18F9953352CEFE10D4F7DC9381E06F85210E52670A8F7ED1F55D0AA16B9C26F5C0A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4388\nextcancelbuttons
- Size 3KB
- SHA256 321cccc65d7cbc769869a84d187557efd5f26f386e39c2857d6e028463790618
- MD5 e69621dd5af17a9a4164c1f2d5707e0b
- SHA1 df4e9c1df613faf6274dbf664a5f1ca088fcc450
- SHA512 1572e0c646d9b7762f0c41423ecb911ad5545289bb4c0ca7c1f3a955e7733d2ca1d8de87c94d86dbf184d93780e5cd78be80578c482371ef04bf43e8392b2689
- TLSH T136817EC7F29ABD203E58D49B1C7390905BD3919B6CF770785FA65D33147502945AD10F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4185.tmp
- Size 349KB
- SHA256 344abeb71ddccfdb70786849cca660982fd2ab099dcd74fd0d608a05139c8db1
- MD5 8752c01d76bc7b3a38b6acaf5b9c387b
- SHA1 8c7b2b5ffdf3c46d2e9a5803f3b8ac20533e7778
- SHA512 5a88de5be489088d8108dc45903e5d8368b53109c45646ab14ffe8fff41d5e3f5d19dc13ee1394dedb494e36f76824424602c8c65c6227741c952c2ffb7f4a0f
- SSDEEP 6144:jaczLWEYbeslrZOYnQnp0ysBVf+ZfW6LWAOk/UADttOUPMTZob+KC:2SLWEY8Yep/sTfZ6LWG/2UPMTZobO
- TLSH T1D2747D10B1D5C83AD1BF49F03A79D6AA54AABE655BF1D8FB03D40D2E0D728C24631F26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\小张软件\小张壁纸 1.0.0\install\小张壁纸.msi
- Size 1.8MB
- SHA256 d49743ce3955973641f22ea647a73ff6897666625f1a9f2092a880473b35e45d
- MD5 6e5fca680f3e2dd5f0858289f3ec56a1
- SHA1 0ca3b6b125e735f851a406f01809d9d61ed28fe8
- SHA512 b6c233aa0ceb0048b11173d120b75c54ec031a5cdf205c65f9fb4d649237dc560e24c64c9d259c13aa5d02618af07d4d4b61c5d167089611f36276a59d0e6552
- SSDEEP 49152:3jgSt8hakHMbtZtUtE+wLsjC49zRRhCrlsmHE/7PMT6bz:TgSt8haoMbtZetE+KKCn
- TLSH T18295CF107596C536D57E05B02A6EDBAE50AEBEA44FB044DB23C83E7F19F18D20235E27
- MD5 SHA1 SHA512 SSDEEP TLSH