Analysis
- max time kernel
148s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 13:51
General
- Target ZapretUI.vbs
- Size 3KB
- Sample261027-q52wsaev2n
- SHA256 82b94f7fb679b62001563b3096e77601853a222d965942b4df7dad7b7d7ac83c
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ZapretUI.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File "C:\Users\Admin\AppData\Local\Temp\ZapretUI\ZapretUI.Launcher.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4428-1-0x00007FFBDEF4F000-0x00007FFBDEF50000-memory.dmp
memory/4428-4-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
memory/4428-5-0x0000020AFC690000-0x0000020AFC6B2000-memory.dmp
memory/4428-6-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
memory/4428-7-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
memory/4428-8-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
memory/4428-9-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
memory/4428-10-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
memory/4428-11-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
memory/4428-12-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
memory/4428-13-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
memory/4428-14-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
memory/4428-15-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
memory/4428-16-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
memory/4428-17-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
memory/4428-18-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
memory/4428-19-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp
memory/4428-21-0x00007FFBDEDC0000-0x00007FFBDF764000-memory.dmp