b3e897b190eea64af44f6f0722d8b43d6382b6ef95a4446738728d957e9bb593

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZapretSetup.exe
Size 2.5MB
Sample261107-p2z3cafa38
SHA256 b3e897b190eea64af44f6f0722d8b43d6382b6ef95a4446738728d957e9bb593
MD5 ec870ba94daba1e7da6b8254bb9a47fa
SHA1 59b3674a298a3db4453910cafec64f49cb738667
SHA512 d7cdc512e7a6b5725623dd60a56d3feae85b8e91835c70d6e83fea85302e99e79f216cd7641a0c8676506521491af9920560a18ef8d9479c0d51e4c86abbc699
SSDEEP 24576:6nRiKPpgHLblRqhZr9iVLc2I7iAGekPwbX5jAdaU7Q4TCsIGLV8sYGL9Pcy0:6RiOpgH/g9iVA255tsJsnas3ey0
TLSH
T150C56C37BC915CE5C2BA92318AA951C17E24BC470F3213DB3E94B3782FB26C499B5758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4128	powershell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4128	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 4128	2948	ZapretSetup.exe	90
PID 4128 wrote to memory of 2992	4128	powershell.exe	92
PID 2992 wrote to memory of 3880	2992	csc.exe	93
PID 4128 wrote to memory of 1916	4128	powershell.exe	94
PID 1916 wrote to memory of 3484	1916	csc.exe	95

C:\Users\Admin\AppData\Local\Temp\ZapretSetup.exe
"C:\Users\Admin\AppData\Local\Temp\ZapretSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -STA -WindowStyle Hidden -File C:\Windows\Temp\zapret-setup-1794055817552988500.ps1 -SelfPath C:\Windows\Temp\zapret-setup-1794055817552988500.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g4giujsn\g4giujsn.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9495.tmp" "c:\Users\Admin\AppData\Local\Temp\g4giujsn\CSC3C64F02BDEF440649613B47317556C7.TMP"
      4⤵
      PID:3880
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r0aq2440\r0aq2440.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBD0D.tmp" "c:\Users\Admin\AppData\Local\Temp\r0aq2440\CSCD0EDB0F635954B64A520BD71D7B62C11.TMP"
      4⤵
      PID:3484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES9495.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9495.tmp
Size 1KB
SHA256 6552fe5bfc615b3f3efc55890b7e1c1761841f11b8e55cdc7c5e38681d44f604
MD5 8a4210a24a96c94cdf18c441d074e426
SHA1 ff14f771585bdb35d0c09cc4c648cde8b9d4a9fa
SHA512 74b8fa701414ccee8a20678f96266237e93ec61a770d4f60e58e478c23ab2e817f570153dc21ef444f4145a76ae7429220349ba870abe5b7cf023df028619e71
TLSH
T12121AF0593ED470FF0B3873179F6072FA279FD65DFE1635A844012292C51104EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RESBD0D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBD0D.tmp
Size 1KB
SHA256 b646eefa2d94e9247ab27c8e6ca69d1a00be19d7c11b8fdb9ca70f9a294d54c2
MD5 c920a2f90bcd33b47cca36e069ea5023
SHA1 937e86a61ba05bb8b7d567b151722780386cc20b
SHA512 e7282ed3b4c60b7823fa2eab708157adae434ab05a5f1de52d9042a28ce517c281742a106008d87e0c6fca84386cc564c08b67b34d55df1fd463b40bb25b575d
TLSH
T19E21EF0593EC470FF0B75B31A9F6176F9178FD55EFA1936A8540022C2C51544EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

g4giujsn.dll

Path C:\Users\Admin\AppData\Local\Temp\g4giujsn\g4giujsn.dll
Size 3KB
SHA256 625bc25757b24340d91594b3acb6e39cac6f394ebdd8f7b9b724719889a9beac
MD5 ebaff7fba74ffc0dd6a4467d9366cce6
SHA1 62edb736c0ddd9f3b6d490125272939c1a1a347e
SHA512 b8abea59abae4eac1880b1f8c3ed7c8c8325e94c68e267bafda1013d6ebd99f8b0dd031d48a85a42a573da1b99a1fb6742b88e5fc3ecf20c4159b6b1cc6b6b80
TLSH
T18D51CC1BA3E9466FE4B787306DA3031727B5FC148FB357694980426D9C213245E32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

r0aq2440.dll

Path C:\Users\Admin\AppData\Local\Temp\r0aq2440\r0aq2440.dll
Size 3KB
SHA256 34b264b507c96ea52fec9d10357e360c201d4d031a1ae7507e8fd7743042e9ed
MD5 24ffb514058d96c4a87d36de5838f019
SHA1 4a344346c776ed84878eb0025d84b3a488c13b8a
SHA512 3abebfa7b07160196b7366b333397e2ce18e752f25c34b192d135a096228c8c8f6bfe9c8ae515a4e0f400316fd01875c6ad82e7fc694a9a83efde34240d2c140
TLSH
T193713316D7E88A2BF0AF47386DF3471727B4E850CF3397AF199402256C606A05E35BB0
MD5 SHA1 SHA512 TLSH

Submit Download

zapret-setup-1794055817552988500.ps1

Path C:\Windows\Temp\zapret-setup-1794055817552988500.ps1
Size 692KB
SHA256 d321e8f6f54f355443dcad220d3bf3cfc737174670917e08173d34e29909e642
MD5 0ace7e9bc9e1e8389a4e6e9cac2dfa89
SHA1 7e58f2ea1fed93ce7225fe43a6eec261e230fbba
SHA512 5dabc84744f37e68d25d2c7166e5cbe5e30979da59d6bee470a129732e7e9a27a50e08d7b32263e07a2560ca2e7200246365808b84de5b360b2f368041502638
SSDEEP 12288:UhMLVHwxEotfeOxVE2wJCDpamm8nUvEX9K/bszZaGLV6XslaGL96Dlq0la:EaU7Q4TCsIGLV8sYGL9x
TLSH
T196E49C379E16BCC20BB62A40D8CC2EC54C1C175B57B201A8BACD66DA1BB5548DFE91FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC3C64F02BDEF440649613B47317556C7.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\g4giujsn\CSC3C64F02BDEF440649613B47317556C7.TMP
Size 652B
SHA256 f85210181ce9457b9311260452e26087db91422a9db159889fb3db049cb650ec
MD5 bfe43eaae2e89e1007d45f45e7b51c68
SHA1 8fc39f968e983aa1d299c3b69db61efea4b1a453
SHA512 c7e934afacceec93968693bfef0ee26c8d3430c50f8843e96855d066aa720b4271fc222904d34f1da8ab6beb01f020b5bd2c69b863faab2bb1c15515e7332e63
TLSH
T1A2F05E09A3F8020EF0F38B30BDF6436791A9FC65DEB293ED1440136928645209972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

g4giujsn.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\g4giujsn\g4giujsn.0.cs
Size 319B
SHA256 292a2e9f1832843a54f4a95e4818d813e24644a0ae1f42e0e4cad051859cfe72
MD5 05aa8c1a00367fb49a7f929e794d5d0c
SHA1 087b4a2822a9f5b4ee2101046a2346a516acbca7
SHA512 71a803ce41133141c2efbf0a845d3ecee6e197291887bb1f706490ab82d2afdbac2cdc1fa62c8775a3eab712452049d9b8d174793ad7c023406f6d6792c6350c
TLSH
T1F3E0262485CBAE65418344132C5BF0C8AB23460F05B93C04F7E89110CECB0042236F39
MD5 SHA1 SHA512 TLSH

Submit Download

g4giujsn.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\g4giujsn\g4giujsn.cmdline
Size 369B
SHA256 5975fbe64f5eba8235efe14c1ec527f54aa7ef6db72c8fb0529abdde1d8ac6dd
MD5 338a7c42f9bc1a3f65d01a0ff6dbc655
SHA1 8325e17fe951fadcec77fec0d24bd9f547e12492
SHA512 f85ab2397dd7621f727228051772e25f1a17513121a465dec752409f0add5d0c605614117f4c0cda7bca3ef91fd5fe558352cbe3bc101bd2721c4cb5523b9b1e
TLSH
T15FE0682F9257D6BD21DA60473169CCAC8676064369403FC4504C440DD0570042BD3B41
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD0EDB0F635954B64A520BD71D7B62C11.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\r0aq2440\CSCD0EDB0F635954B64A520BD71D7B62C11.TMP
Size 652B
SHA256 ea1f392998e8184352513f208748378d0cde19fd65b6d811c5fbabb2f885b099
MD5 5c46d0b2c6d1f9155fdb28ecb3cb1123
SHA1 b621e638b51a907f0b0d876ac9b4fac296f2c341
SHA512 01bf9c77de4d4421755568b72c5ad7bc11fc3bfdcd1b1233e82e944eb280669ceede1fff3b92b42c59993c6197800669ba0ff0ac4ca0288e40dad217d61bee98
TLSH
T1CDF05E0963F8420EF0F75B30BDF6436395ACBC65DE3293ED259403192C646109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

r0aq2440.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\r0aq2440\r0aq2440.0.cs
Size 1KB
SHA256 046aab9666613a8bf02f8c255c0a0655fd08051925e9dc98646a4c811cb50a08
MD5 1f757f2cadd46c38744b96aa24b7e3b2
SHA1 96437975795db341cac21fcae1a44f0eb42bd005
SHA512 979571f4a847fbd945e4210810e71f664835426c30c1bcd37a13b2064b9c81d1bc880b658e40f222cc3c27c992c896a4d21d978ea4f554d607b2c05a9b91193f
TLSH
T18E11C90A33A692B00961732DEEC1D15EFE27012817FB3C20F5BD96722FAB122C531E18
MD5 SHA1 SHA512 TLSH

Submit Download

r0aq2440.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\r0aq2440\r0aq2440.cmdline
Size 369B
SHA256 cb111e9c1f848b27607d11eb706fdac48328de765c6b321e4edae92ffcb54746
MD5 654c612f5aa70c05c6e8b26ae18bae5d
SHA1 b07f6cc8e39503e1e8702bf5ebc30a65e793511a
SHA512 d27f3531ed6a7e2505bcbad655ce2ab0dc03b694a63069caab160e6376333d97dc82491eafad51c9b0ac9368c6c047773a48611dfb5c8a9f10a442ac68c6947d
TLSH
T1ADE0DF3A6356C67E96FD202B23AAC6ACC2B20687B9817F86D160845DE0670046BD37D5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4128-25-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp

Download

memory/4128-35-0x00000259C24D0000-0x00000259C24D8000-memory.dmp

Download

memory/4128-13-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp

Download

memory/4128-21-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp

Download

memory/4128-24-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp

Download

memory/4128-1-0x00007FF99BCFF000-0x00007FF99BD00000-memory.dmp

Download

memory/4128-14-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp

Download

memory/4128-31-0x00000259A9DD0000-0x00000259A9DD8000-memory.dmp

Download

memory/4128-12-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp

Download

memory/4128-11-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp

Download

memory/4128-10-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp

Download

memory/4128-15-0x00000259C22C0000-0x00000259C22CA000-memory.dmp

Download

memory/4128-36-0x00000259C35A0000-0x00000259C35DE000-memory.dmp

Download

memory/4128-37-0x00000259C3560000-0x00000259C356E000-memory.dmp

Download

memory/4128-9-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp

Download

memory/4128-7-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp

Download

memory/4128-6-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp

Download

memory/4128-2-0x00000259C22F0000-0x00000259C2312000-memory.dmp

Download

memory/4128-3-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp

Download

memory/4128-50-0x00000259C3570000-0x00000259C3578000-memory.dmp

Download

memory/4128-52-0x00007FF99BB70000-0x00007FF99C514000-memory.dmp

Download