e34942601a91672eb0c9895b5a7a71dd4d7ef19acee1e2d6ec85834549b850f8

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 08:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZipNest.exe
Size 4.4MB
Sample261023-kvmffsax6x
SHA256 e34942601a91672eb0c9895b5a7a71dd4d7ef19acee1e2d6ec85834549b850f8
MD5 dbc9793783325436bd953a895df3b8e8
SHA1 e623342c9ba1fcc3a0b7ae36f408000ea0742278
SHA512 33d04a3d09f9023f1ceb52adb31d17ba714708c19f77d460e1ea57209aacc68b88aa82e6ed2e734fc7c5915738bd2a699792ac7187a319cad815a000089a5f57
SSDEEP 49152:joATQ4aoiVQbqCD2C7TpdWYXYFnDBsdYj2xWkEWDHWP1srUH44qHJIU6iRcoX:jxQ4ao6c+OdDmOCOu+aoX
TLSH
T174264A13778A92BCC066C470838E42635B35749E2B36AAEB44C856383F79EF55E3D784
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\PackSync = "C:\\Users\\Admin\\AppData\\Local\\Programs\\ArcTray\\ArcTray.exe"	ArcTray.exe

Executes dropped EXE 2 IoCs

pid	Process
1232	ArcTray.exe
1684	ArcTray.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ArcTray.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ArcTray.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ArcTray.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ArcTray.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ZipNest.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ZipNest.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ArcTray.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings	ZipNest.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1232	ArcTray.exe
1232	ArcTray.exe
1232	ArcTray.exe
1232	ArcTray.exe
1232	ArcTray.exe
1232	ArcTray.exe
1232	ArcTray.exe
1232	ArcTray.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1232	ArcTray.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1612	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 1232	4928	ZipNest.exe	92

C:\Users\Admin\AppData\Local\Temp\ZipNest.exe
"C:\Users\Admin\AppData\Local\Temp\ZipNest.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Users\Admin\AppData\Local\Programs\ArcTray\ArcTray.exe
  "C:\Users\Admin\AppData\Local\Programs\ArcTray\ArcTray.exe"
  2⤵
  - Adds Run key to start application
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1232

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1612

C:\Users\Admin\AppData\Local\Programs\ArcTray\ArcTray.exe
C:\Users\Admin\AppData\Local\Programs\ArcTray\ArcTray.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ArcTray.exe

Path C:\Users\Admin\AppData\Local\Programs\ArcTray\ArcTray.exe
Size 4.4MB
SHA256 e34942601a91672eb0c9895b5a7a71dd4d7ef19acee1e2d6ec85834549b850f8
MD5 dbc9793783325436bd953a895df3b8e8
SHA1 e623342c9ba1fcc3a0b7ae36f408000ea0742278
SHA512 33d04a3d09f9023f1ceb52adb31d17ba714708c19f77d460e1ea57209aacc68b88aa82e6ed2e734fc7c5915738bd2a699792ac7187a319cad815a000089a5f57
SSDEEP 49152:joATQ4aoiVQbqCD2C7TpdWYXYFnDBsdYj2xWkEWDHWP1srUH44qHJIU6iRcoX:jxQ4ao6c+OdDmOCOu+aoX
TLSH
T174264A13778A92BCC066C470838E42635B35749E2B36AAEB44C856383F79EF55E3D784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download