b2604c1fb412bbc5f7be84075ebbab56e488395f2d5b0201cb70e927fb439da9

Analysis

user interaction
yes
max time kernel
31s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZxMacro Crack (run first).exe
Size 352KB
Sample261006-sedglsfc85
SHA256 b2604c1fb412bbc5f7be84075ebbab56e488395f2d5b0201cb70e927fb439da9
MD5 9a9d273f9038227d0a63a277863ad2e9
SHA1 2ac415423cc1a756c550e9228990a3c386e92339
SHA512 549adaeb91bebeedd76ae389dbd7cf052be273088a906a36e10d1c21117f0fa535eb13079fa72535d8eea9fd84e0d0569ec29231dedcc0de664bf16139f1e0f8
SSDEEP 6144:bfkvXq++gsFBulPdIy8SH2jlUSBqpXQCGYGAQWTkEIuc5oc9Oob:bf7+ABupmaMqqCGSN4Wa9O
TLSH
T1B97423C55749F45FF0F0587D2A354B15DAF8E304A1971793CECC36809C8B9AEE2A6E22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	ZxMacro Crack (run first).exe

Executes dropped EXE 2 IoCs

pid	Process
1100	AMCRACK.exe
5420	zxmacro.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	zxmacro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	zxmacro.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxmacro.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5420	zxmacro.exe
5420	zxmacro.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5420	zxmacro.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5268 wrote to memory of 1100	5268	ZxMacro Crack (run first).exe	85
PID 5268 wrote to memory of 5420	5268	ZxMacro Crack (run first).exe	87

C:\Users\Admin\AppData\Local\Temp\ZxMacro Crack (run first).exe
"C:\Users\Admin\AppData\Local\Temp\ZxMacro Crack (run first).exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5268
- C:\Users\Admin\AppData\Local\Temp\AMCRACK.exe
  "C:\Users\Admin\AppData\Local\Temp\AMCRACK.exe"
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Users\Admin\AppData\Local\Temp\zxmacro.exe
  "C:\Users\Admin\AppData\Local\Temp\zxmacro.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AMCRACK.exe

Path C:\Users\Admin\AppData\Local\Temp\AMCRACK.exe
Size 10KB
SHA256 93770202bd151660c9e6277c863f3e89cd797852d809514532315907d12efcf8
MD5 2b1dde15530d58da02fb35c6168b5de7
SHA1 a51421684aec930088424f6cf5d0ee2d1c8d3087
SHA512 58d8f5948d9cc8289c93044ba14f2f7ea1809f83d5d3947fd0f076b8e8fd5eaf0b1cda83bffd29b7c066a2e2f1452527dd1fbc5ecfe5eae6956a0a87f6ddc131
SSDEEP 192:NMKJBrMuj/wSUwlFDZQSNQFva8HrvUsZaQa8aeamwwRXXfobAPB0:Jv8sCFvzMskNhDmwwRXXfobu
TLSH
T18122B45AABE88904F4FF5B34E8724B01AA71B82B4E7AC74E04C504FD0E617E489D37A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxmacro.exe

Path C:\Users\Admin\AppData\Local\Temp\zxmacro.exe
Size 332KB
SHA256 cc952fb0744a6f075d6111953e5289575351d2894131118554ae5869f4e484c7
MD5 a92dd06b451fb37680ea2ca39aa11e91
SHA1 399f39cd8696c6d895246f987af61f9948e3c6fd
SHA512 8e6aebb4e082bb4b398474597729746614d10ae13769a92e3d923996262539ccf0c5c8daa45c3d9d428f069297882e43bdcfab4f87bd0e100bb2df29e3a40120
SSDEEP 6144:fsALcQoiqn3tTXO1rI33fEsvEQ9uPtuy+4uWJV21ElMHtZ:fbo73FXOe/EwEfPtkSJV2uM
TLSH
T1DF74F10036EA8DCAC13653BA57A6CBA80B33D0131713C7DD2E91D24B7699BC65F172B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1100-26-0x00000000000F0000-0x00000000000F8000-memory.dmp

Download

memory/5268-0-0x00000000003E0000-0x000000000043E000-memory.dmp

Download

memory/5420-27-0x00000000006E0000-0x000000000073A000-memory.dmp

Download

memory/5420-28-0x0000000002BC0000-0x0000000002BD4000-memory.dmp

Download

memory/5420-29-0x0000000002BE0000-0x0000000002BE8000-memory.dmp

Download

memory/5420-30-0x0000000005470000-0x00000000054BC000-memory.dmp

Download

memory/5420-33-0x0000000006560000-0x0000000006B04000-memory.dmp

Download

memory/5420-34-0x00000000060B0000-0x0000000006142000-memory.dmp

Download