File name:

Zenith.exe

Full analysis: https://app.any.run/tasks/38facf73-2361-4ba2-9466-45a3505dff7c
Verdict: Malicious activity
Analysis date: March 30, 2025, 13:01:22
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 12 sections
MD5:

62D18F5930A2A51057EA4515F1D27D22

SHA1:

60814789A39E9377D37CDEF05DC72D49630AD94B

SHA256:

509AE1F5BF21B6208A8E9CAE8E6E5B94075EEC76B499E2877F38D940576E2272

SSDEEP:

196608:oXYb0p61n6nb+iJE+cdUoIn37Y4/VA4bi:lcb+iJnc+337Y4tA4W

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6768)
      • powershell.exe (PID: 4776)
      • powershell.exe (PID: 1348)

  • SUSPICIOUS

    • Reads the BIOS version

      • Zenith.exe (PID: 2236)

    • The process bypasses the loading of PowerShell profile settings

      • Zenith.exe (PID: 2236)

    • The process hide an interactive prompt from the user

      • Zenith.exe (PID: 2236)

    • Starts POWERSHELL.EXE for commands execution

      • Zenith.exe (PID: 2236)

    • Reads security settings of Internet Explorer

      • GameBar.exe (PID: 4068)

  • INFO

    • Reads the computer name

      • Zenith.exe (PID: 2236)
      • GameBar.exe (PID: 4068)

    • Process checks whether UAC notifications are on

      • Zenith.exe (PID: 2236)

    • Checks supported languages

      • Zenith.exe (PID: 2236)
      • GameBar.exe (PID: 4068)

    • Reads product name

      • Zenith.exe (PID: 2236)

    • Reads Environment values

      • Zenith.exe (PID: 2236)

    • Checks proxy server information

      • slui.exe (PID: 5328)

    • Reads the software policy settings

      • slui.exe (PID: 5328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | DOS Executable Generic (100)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:03:27 17:27:13+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 12774400
InitializedDataSize: 8047104
UninitializedDataSize: -
EntryPoint: 0x28c8058
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 0.1.0.0
ProductVersionNumber: 0.1.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileVersion: 1.1.0
ProductVersion: 1.1.0
ProductName: Zenith
FileDescription: Zenith
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
10
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start zenith.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs gamebar.exe no specs slui.exe zenith.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
728\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1180\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1348"C:\Users\admin\Desktop\Zenith.exe" C:\Users\admin\Desktop\Zenith.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Zenith
Exit code:
3221226540
Version:
1.1.0
Modules
Images
c:\users\admin\desktop\zenith.exe
c:\windows\system32\ntdll.dll
1348"powershell" -WindowStyle Hidden -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\admin\Desktop\AutoExec.lnk'); $Shortcut.TargetPath = 'C:\Users\admin\AppData\Roaming\Zenith\AutoExec'; $Shortcut.Save()"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Zenith.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2236"C:\Users\admin\Desktop\Zenith.exe" C:\Users\admin\Desktop\Zenith.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Zenith
Version:
1.1.0
Modules
Images
c:\users\admin\desktop\zenith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
4068"C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe" -ServerName:App.AppXbdkk0yrkwpcgeaem8zk81k8py1eaahny.mcaC:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\program files\windowsapps\microsoft.xboxgamingoverlay_2.34.28001.0_x64__8wekyb3d8bbwe\gamebar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
4776"powershell" -WindowStyle Hidden -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\admin\Desktop\Workspace.lnk'); $Shortcut.TargetPath = 'C:\Users\admin\AppData\Roaming\Zenith\Workspace'; $Shortcut.Save()"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Zenith.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
5324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5328C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6768"powershell" -WindowStyle Hidden -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\admin\Desktop\Scripts.lnk'); $Shortcut.TargetPath = 'C:\Users\admin\AppData\Roaming\Zenith\Scripts'; $Shortcut.Save()"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Zenith.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
17 473
Read events
17 466
Write events
7
Delete events
0

Modification events

(PID) Process:(4068) GameBar.exeKey:\REGISTRY\A\{dc7b87a2-3c8b-00cd-8087-bfe62b7c09b3}\LocalState
Operation:writeName:StartupTipIndex
Value:
01000000000000003ABD70E773A1DB01
(PID) Process:(4068) GameBar.exeKey:\REGISTRY\A\{dc7b87a2-3c8b-00cd-8087-bfe62b7c09b3}\LocalState
Operation:writeName:InstalledVersionMajor
Value:
0200387A62E773A1DB01
(PID) Process:(4068) GameBar.exeKey:\REGISTRY\A\{dc7b87a2-3c8b-00cd-8087-bfe62b7c09b3}\LocalState
Operation:writeName:InstalledVersionMinor
Value:
2200387A62E773A1DB01
(PID) Process:(4068) GameBar.exeKey:\REGISTRY\A\{dc7b87a2-3c8b-00cd-8087-bfe62b7c09b3}\LocalState
Operation:writeName:InstalledVersionBuild
Value:
616D387A62E773A1DB01
(PID) Process:(4068) GameBar.exeKey:\REGISTRY\A\{dc7b87a2-3c8b-00cd-8087-bfe62b7c09b3}\LocalState
Operation:writeName:InstalledVersionRevision
Value:
0000387A62E773A1DB01
(PID) Process:(4068) GameBar.exeKey:\REGISTRY\A\{dc7b87a2-3c8b-00cd-8087-bfe62b7c09b3}\LocalState
Operation:writeName:PreviousAppTerminationFromSuspended
Value:
00387A62E773A1DB01
(PID) Process:(4068) GameBar.exeKey:\REGISTRY\A\{dc7b87a2-3c8b-00cd-8087-bfe62b7c09b3}\LocalState
Operation:writeName:CurrentDisplayMonitor
Value:
670061006D0065000000BE4167E773A1DB01
Executable files
0
Suspicious files
4
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
6768powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_tbzhratd.1xz.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6768powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_r4gljnme.xxd.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1348powershell.exeC:\Users\admin\Desktop\AutoExec.lnkbinary
MD5:9C651FC36FD187AA14782E73557EAF9D
SHA256:EDE4AD2A665B72C890278A7707AE290C522F10FC2238B10A0433282F6C6C9132
6768powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:BC15E794168A1E360176A4194D64450C
SHA256:E3DC590D5FC026B15A55FBA785DE15C86B344716EE879CF433344FE1D76AA68A
4776powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_03y5le1x.lhq.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1348powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_jjlzy2el.dxc.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4776powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ngqeifwn.q3u.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6768powershell.exeC:\Users\admin\Desktop\Scripts.lnkbinary
MD5:993EFF4F1FF6AC2123C83BC9FC566BC7
SHA256:BAED32485B2A1A3FC74F69E46C7E710F20FB29C60C9CDA4C0FD3F34C508EF52F
1348powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_oka4aggn.a4j.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4776powershell.exeC:\Users\admin\Desktop\Workspace.lnkbinary
MD5:120E63A7425C2BA8072DE3223239BDD4
SHA256:2BF59BF488862F2CD971C7A5CE81AA3A77A078638ED7816FAB80FAC69DB8C1E1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
21
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.189:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.48.23.189:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
23.48.23.189:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.48.23.189:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4008
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5328
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 23.48.23.189
  • 23.48.23.191
  • 23.48.23.176
  • 23.48.23.183
  • 23.48.23.181
  • 23.48.23.185
  • 23.48.23.177
  • 23.48.23.188
  • 23.48.23.192
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Zenith.exe