Overview

overview

7

Static

static

3

Zuhls Macr....0.exe

windows10-ltsc_2021-x64

7

$PLUGINSDI...ls.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...em.dll

windows10-ltsc_2021-x64

3

$PLUGINSDIR/UAC.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...ll.dll

windows10-ltsc_2021-x64

3

LICENSES.c...m.html

windows10-ltsc_2021-x64

3

Zuhls Macro.exe

windows10-ltsc_2021-x64

7

d3dcompiler_47.dll

windows10-ltsc_2021-x64

1

ffmpeg.dll

windows10-ltsc_2021-x64

1

libEGL.dll

windows10-ltsc_2021-x64

1

libGLESv2.dll

windows10-ltsc_2021-x64

1

resources/app.js

windows10-ltsc_2021-x64

3

resources/elevate.exe

windows10-ltsc_2021-x64

3

vk_swiftshader.dll

windows10-ltsc_2021-x64

1

vulkan-1.dll

windows10-ltsc_2021-x64

1

$PLUGINSDI...gs.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...ec.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...7z.dll

windows10-ltsc_2021-x64

3

$R0/Uninst...ro.exe

windows10-ltsc_2021-x64

7

$PLUGINSDI...ls.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...em.dll

windows10-ltsc_2021-x64

3

$PLUGINSDIR/UAC.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...ll.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...gs.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...ec.dll

windows10-ltsc_2021-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    162s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260911-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    02/10/2026, 15:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Zuhls Macro.exe
  • Size 164.7MB
  • Sample261002-tcnegade65
  • SHA256 252fcec67588dbdc8d686c112575d0a242b1fa8ab38081ba9c35ffb6fef12ed0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe
    "C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe"
    1⤵
    • Checks computer location settings
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe
      "C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --use-angle=d3d11 --user-data-dir="C:\Users\Admin\AppData\Roaming\zuhls-macro" --gpu-preferences=WAAAAAAAAADgAQAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=1716 --field-trial-handle=1720,i,4531473962276369598,18171653186446122666,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:4736
      • C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe
        "C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --use-angle=d3d11 --ignore-certificate-errors --user-data-dir="C:\Users\Admin\AppData\Roaming\zuhls-macro" --mojo-platform-channel-handle=1904 --field-trial-handle=1720,i,4531473962276369598,18171653186446122666,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
        • Reads the TCP/IP host and domain name from the registry
        PID:3080
      • C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe
        "C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\zuhls-macro" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --first-renderer-process --no-sandbox --force-color-profile=srgb --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2260 --field-trial-handle=1720,i,4531473962276369598,18171653186446122666,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
        2⤵
        • Checks computer location settings
        PID:3732
      • C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe
        "C:\Users\Admin\AppData\Local\Temp\Zuhls Macro.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\zuhls-macro" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --no-sandbox --force-color-profile=srgb --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3252 --field-trial-handle=1720,i,4531473962276369598,18171653186446122666,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
        2⤵
        • Checks computer location settings
        PID:4856

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          default.dic
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512
          Submit Download

          temp-index
          • Path C:\Users\Admin\AppData\Roaming\zuhls-macro\Code Cache\js\index-dir\temp-index
          • Size 48B
          • SHA256 3b93c46fb67ed55f790d5e9b27704d57b4a2b39be82ac0199a95a99d1c585979
          • MD5 SHA1 SHA512
          Submit Download

          CURRENT
          • Path C:\Users\Admin\AppData\Roaming\zuhls-macro\Local Storage\leveldb\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512
          Submit Download

          53b0cce5-cc71-4bc6-b903-9051ed6637fe.tmp
          • Path C:\Users\Admin\AppData\Roaming\zuhls-macro\Network\53b0cce5-cc71-4bc6-b903-9051ed6637fe.tmp
          • Size 300B
          • SHA256 05545113c8f1bcee2423e107ec0dd9852d54bd0b1d4113e1d4c35d6a40a916ab
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Network Persistent State
          • Path C:\Users\Admin\AppData\Roaming\zuhls-macro\Network\Network Persistent State
          • Size 59B
          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MANIFEST-000001
          • Path C:\Users\Admin\AppData\Roaming\zuhls-macro\Session Storage\MANIFEST-000001
          • Size 41B
          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
          • MD5 SHA1 SHA512
          Submit Download