f43ab8489546655acc68de51f4442a5b6006a9456f04ca9cc885eaf1283febc5

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZapretSetup.exe
Size 2.5MB
Sample261107-p21zmsfa42
SHA256 f43ab8489546655acc68de51f4442a5b6006a9456f04ca9cc885eaf1283febc5
MD5 9127d64c2593015de8a0198cbb4945c6
SHA1 e21cb9b6c89fee879d9a646c440135d12aee4cf5
SHA512 c7e1dd293b86b2138337b0146b1026cb985a9810aeed2b8dc5055260c81264e3b268a51efd55d5990a092846f74794c93b4baa96bf097b5cb879153cb7f43384
SSDEEP 24576:zAYBCU5QZ0jt1gHGZGHOQhymKViAGekPwbX5jzs0RMUResQ29WsYGL9zcy0:zBBx5QZQUHOQUC5bEMUR6s3Cy0
TLSH
T151C57D37BC911CE5C2BA92318AA951C17E257C470F3213DB3E94B3782FB26C49AB5758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1140	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1140	powershell.exe
1140	powershell.exe
1140	powershell.exe
1140	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1140	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 1140	3872	ZapretSetup.exe	90
PID 1140 wrote to memory of 5848	1140	powershell.exe	92
PID 5848 wrote to memory of 4840	5848	csc.exe	93
PID 1140 wrote to memory of 920	1140	powershell.exe	94
PID 920 wrote to memory of 2672	920	csc.exe	95

C:\Users\Admin\AppData\Local\Temp\ZapretSetup.exe
"C:\Users\Admin\AppData\Local\Temp\ZapretSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -STA -WindowStyle Hidden -File C:\Windows\Temp\zapret-setup-1794055824717289500.ps1 -SelfPath C:\Windows\Temp\zapret-setup-1794055824717289500.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\33n2mq3f\33n2mq3f.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5848
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB22.tmp" "c:\Users\Admin\AppData\Local\Temp\33n2mq3f\CSC17780AE76D054C3B843A37CF481C93A7.TMP"
      4⤵
      PID:4840
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l1bd4hem\l1bd4hem.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:920
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES290A.tmp" "c:\Users\Admin\AppData\Local\Temp\l1bd4hem\CSC25627F0D124A42B5814C336EDDDDE9B.TMP"
      4⤵
      PID:2672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

33n2mq3f.dll

Path C:\Users\Admin\AppData\Local\Temp\33n2mq3f\33n2mq3f.dll
Size 3KB
SHA256 66eeb06a650a54b279537e6c9d38f71b4e75e866446ec1dad2e2fc90ec12309d
MD5 693ba8e5691c07d5448dddc125852c0d
SHA1 469939f03cfcb6c3b17aef0e91b95244468d213f
SHA512 102904aa63ecde17aabd897071391be7b505d197868f1d3fa8f3d90c8036b3d3d082cbad39d9f0f7db856ce7ae657fda0cc74e4ef0a4d4a64f655d7caa06578b
TLSH
T17A51B82B63E9466BE0A747706EA3431727B0FC148F735B6D49804228AC213246E32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES290A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES290A.tmp
Size 1KB
SHA256 2e0ac880756a200ffa3e76c62352fe7e1c37a73d695ad7b29f08685056b8adc7
MD5 9269205fc7271a6a2edcaf50db2d714d
SHA1 89aee0903ad3f362a77170cd52f0bedf45babef0
SHA512 1dabd65ad14de8826692e1ddb311c0db32f7012c7b3d2af4ef2bad71ff08a7ffd04af86d35aa59a748cf42e58e364528f24703dd6c8eba2a12e17d68bcff9444
TLSH
T13321EB0593ED4B4FF0730B32A9F6476F9234FDA4EFA1539A844042292C41604EEE0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESB22.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB22.tmp
Size 1KB
SHA256 7801ba5d192d6d495ee5bc14efa2fd61c24427c9fc1edc974a36c71db42175d2
MD5 3c1d824c0ff4d3b13a0cf964349e2e6e
SHA1 ccc0fcf755445267c9fee042408c9df9c56dd3c7
SHA512 3b1f017b04855c7ff723c2a3c389408f284360c8abb8ed57eb7d9fe72042ec2e77b897c5b037132244a63b93cfeb0de6eeaced2e098ee6b79a92ca80f12486e7
TLSH
T154218C0593F8871FF0734B31A9FA175F9678FD5ADFA2579A554042282C51104EFA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

l1bd4hem.dll

Path C:\Users\Admin\AppData\Local\Temp\l1bd4hem\l1bd4hem.dll
Size 3KB
SHA256 9026bdb181def04a5f2eb8512320b888e0db4b46b6de689fabc909eedc8b564a
MD5 0a04dda1c92728867af6f871a0f2c23d
SHA1 a804d97dea4f96873a6c6ec37b73e5817de03cbf
SHA512 8b6af939e183982674ecdfbf676370288e5da99d31a8ecad8c322cffa83d7b981fa31dd7eab954a9b6ebe61fb542a43678b1183a2a3b78df8273affb559d3a6d
TLSH
T12171201697EC8A2BF0AB47786DF3071727B4E850CB339B5F198002267C606605E35BB0
MD5 SHA1 SHA512 TLSH

Submit Download

zapret-setup-1794055824717289500.ps1

Path C:\Windows\Temp\zapret-setup-1794055824717289500.ps1
Size 691KB
SHA256 fcc6832946d1528a7aa86cd550b9e3cfca596503e8e5cc454a9070b22669fa94
MD5 e87d30d5a6ae058eb8688b26aa219f04
SHA1 da7244a2da3bec2d04d4e34d59f54c66d3fe566f
SHA512 41be0f30d92bbd497f12f0ab7a3649227b3d69ec5c672a49877901c7bd43c0c3284a4a8502c954a6c34e931fdd45a802be4119e24f49a0f3fc185fbe22805c70
SSDEEP 12288:z94pXoXBxzgRelotfR1p10GDpnmm8nLhW0gq1ubJWslaGL96Mlq0la:h0RMUResQ29WsYGL98
TLSH
T15AE49D379E16BCC60BB62A41D8CC2AC51C1C075B57B201A8FECD66CA1BB5548DFE91EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33n2mq3f.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\33n2mq3f\33n2mq3f.0.cs
Size 319B
SHA256 292a2e9f1832843a54f4a95e4818d813e24644a0ae1f42e0e4cad051859cfe72
MD5 05aa8c1a00367fb49a7f929e794d5d0c
SHA1 087b4a2822a9f5b4ee2101046a2346a516acbca7
SHA512 71a803ce41133141c2efbf0a845d3ecee6e197291887bb1f706490ab82d2afdbac2cdc1fa62c8775a3eab712452049d9b8d174793ad7c023406f6d6792c6350c
TLSH
T1F3E0262485CBAE65418344132C5BF0C8AB23460F05B93C04F7E89110CECB0042236F39
MD5 SHA1 SHA512 TLSH

Submit Download

33n2mq3f.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\33n2mq3f\33n2mq3f.cmdline
Size 369B
SHA256 5307e41b261228a2651398dac79a4878b4346f2d13d73a5da9a98753632f6549
MD5 9b6e3276af98dde1bf027a904e0eb546
SHA1 8b252973152cb7c9bfc5bf8f37edf550b4a3b1f1
SHA512 c2a8ee22fd3caae3daac58ee7c6ea985efd9c5014bfe1ad9a72c9fda3d74e17e383ddfce1c985fe7a7f0b0880d8b546fc480a4f992df41fab3873441a63153a2
TLSH
T148E0683A4746C6BD01E910872A69C4AC82F21B4FAD407F845064482ED0170242FD1B41
MD5 SHA1 SHA512 TLSH

Submit Download

CSC17780AE76D054C3B843A37CF481C93A7.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\33n2mq3f\CSC17780AE76D054C3B843A37CF481C93A7.TMP
Size 652B
SHA256 07e86769d81a4eb89c13a09646ba10d2b27e1fa5c7b007b357250cca684e3a39
MD5 c56387c95b43ad7ad979bff8b3155665
SHA1 473e84218435913da38f536667bc1db243df2458
SHA512 816e25afd8e0592e8ef1595f4cec9c5385e062824cb40fc3609fef5a4993e764b5a148aadf890a0871b802bf0869409ea4bcdb8fb07c2d3d8c51e8ac2be7943d
TLSH
T13FF05E0A63F8820EF0F74B70BDF64363A1A8BC66DE3297ED1480431928645109A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC25627F0D124A42B5814C336EDDDDE9B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\l1bd4hem\CSC25627F0D124A42B5814C336EDDDDE9B.TMP
Size 652B
SHA256 d3c6f631075380f502879e8c11a63668499db9bea0e2de80dfcf4dc77f72afa3
MD5 554b2101b8387ca89eb09e1b1b150d1f
SHA1 2410e5d4cb19abeb00f89d4a6d8e8729a35c5850
SHA512 d1e0a39c8be0cff51b1dbaddb1512ea7f0b0d0886f8f49cd859eac9dad4ee0682d699207f9beb4bda19c62f6a44a53886be84e78bba46ca1e0ffc1925849579c
TLSH
T1CBF05E0963FC020EF0F34B70BDF683A795A9BC64DE3293ED158003192C64A108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

l1bd4hem.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\l1bd4hem\l1bd4hem.0.cs
Size 1KB
SHA256 046aab9666613a8bf02f8c255c0a0655fd08051925e9dc98646a4c811cb50a08
MD5 1f757f2cadd46c38744b96aa24b7e3b2
SHA1 96437975795db341cac21fcae1a44f0eb42bd005
SHA512 979571f4a847fbd945e4210810e71f664835426c30c1bcd37a13b2064b9c81d1bc880b658e40f222cc3c27c992c896a4d21d978ea4f554d607b2c05a9b91193f
TLSH
T18E11C90A33A692B00961732DEEC1D15EFE27012817FB3C20F5BD96722FAB122C531E18
MD5 SHA1 SHA512 TLSH

Submit Download

l1bd4hem.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\l1bd4hem\l1bd4hem.cmdline
Size 369B
SHA256 dea7c761d606980b80a74bd6629efff6695e307ab3f3ed1018e86e26a59d92c6
MD5 12f96eb17931dc9a06316d4c571b239c
SHA1 0caf5fd3f0c08c48fbeeddf2fc37f1ad0e14d7d3
SHA512 39161b046455bb0f1a9c24fd327d4b6bdb6c3102724ac0756b135b65fa616af129f0ba00e5d43aee2b09f4c9b527deedfef0370c41f15aa45ce5bdc4315b235f
TLSH
T176E0202A5296CAFF95DD2007216DCDACC3764F472A817FA4D150845FF02740467F2765
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1140-22-0x00007FFB253E0000-0x00007FFB25D84000-memory.dmp

Download

memory/1140-35-0x00000208C1600000-0x00000208C1608000-memory.dmp

Download

memory/1140-10-0x00000208A8660000-0x00000208A866A000-memory.dmp

Download

memory/1140-8-0x00007FFB253E0000-0x00007FFB25D84000-memory.dmp

Download

memory/1140-26-0x00000208A8650000-0x00000208A8658000-memory.dmp

Download

memory/1140-6-0x00007FFB253E0000-0x00007FFB25D84000-memory.dmp

Download

memory/1140-27-0x00007FFB253E0000-0x00007FFB25D84000-memory.dmp

Download

memory/1140-28-0x00007FFB253E0000-0x00007FFB25D84000-memory.dmp

Download

memory/1140-29-0x00007FFB253E0000-0x00007FFB25D84000-memory.dmp

Download

memory/1140-31-0x00007FFB253E0000-0x00007FFB25D84000-memory.dmp

Download

memory/1140-32-0x00007FFB253E0000-0x00007FFB25D84000-memory.dmp

Download

memory/1140-21-0x00007FFB253E0000-0x00007FFB25D84000-memory.dmp

Download

memory/1140-36-0x00000208C1650000-0x00000208C168E000-memory.dmp

Download

memory/1140-37-0x00000208C1610000-0x00000208C161E000-memory.dmp

Download

memory/1140-18-0x00007FFB253E0000-0x00007FFB25D84000-memory.dmp

Download

memory/1140-9-0x00007FFB253E0000-0x00007FFB25D84000-memory.dmp

Download

memory/1140-1-0x00007FFB2556F000-0x00007FFB25570000-memory.dmp

Download

memory/1140-5-0x00007FFB253E0000-0x00007FFB25D84000-memory.dmp

Download

memory/1140-50-0x00000208C1620000-0x00000208C1628000-memory.dmp

Download

memory/1140-4-0x00000208C07B0000-0x00000208C07D2000-memory.dmp

Download

memory/1140-52-0x00007FFB253E0000-0x00007FFB25D84000-memory.dmp

Download

memory/1140-53-0x00007FFB253E0000-0x00007FFB25D84000-memory.dmp

Download