c7509871f4f011ceaaefc0243c758a6596c8191d84ad9a9da3959c79a03d6792

Analysis

user interaction
yes
max time kernel
898s
max time network
563s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/05/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Test.zip
Size 1.3MB
Sample260507-pcbcpads5s
SHA256 c7509871f4f011ceaaefc0243c758a6596c8191d84ad9a9da3959c79a03d6792
MD5 1f5fd79d28ece53279c4d8db8896d18f
SHA1 98080f50febb6c6a8469b616efe00bfb0dc34b01
SHA512 c89838d5f976693aacea17e489bdf91134026718250b5e5ff16b5139d3e4de056aad50820d97e16ac04ea4f21845d2a9e0320f912b0849207bbc460fb3f09940
SSDEEP 24576:P0ugtW/GWtVmkP/qntUNtgdhbT+UZ7AC+L3aw7v5yygYaUdjxGJq/PyLoI:Pbr/GWTmI4uN+hbTd7ACQ3aEhsa1AcDI
TLSH
T1E86533C8F60767F1B7FB09246F4DB41F6C994EA16A2946FD10B276099F7CC98382A740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4376	QDecrypt.exe
1628	QDecrypt.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QDecrypt.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zG.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2084	7zG.exe
Token: 35	2084	7zG.exe
Token: SeSecurityPrivilege	2084	7zG.exe
Token: SeSecurityPrivilege	2084	7zG.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	7zG.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Test.zip
1⤵
PID:4524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:5268

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5300

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\Test\" -ad -an -ai#7zMap7887:88:7zEvent15599
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2084

C:\Users\Admin\Desktop\Test\Test\QDecrypt.exe
"C:\Users\Admin\Desktop\Test\Test\QDecrypt.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4376

C:\Users\Admin\Desktop\Test\Test\QDecrypt.exe
"C:\Users\Admin\Desktop\Test\Test\QDecrypt.exe"
1⤵
- Executes dropped EXE
PID:1628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QDecrypt.exe

Path C:\Users\Admin\Desktop\Test\Test\QDecrypt.exe
Size 2.7MB
SHA256 6a7c5676594dfc44bb5c2d3363cc4006ae57a2ac16cad6cd088aba96434a52ab
MD5 c694c93801796870df895aaa4f07722b
SHA1 ecf845c3833a0c36ef3d8309d2cddaf25198070a
SHA512 c6f2cc9b61c8eee80ad1634171a000d766dcf809d5924be568437e05d571b6bc02d680cdf8316dcd6f395809ae284f0f437a88392beab168d3a42f72d925ba96
SSDEEP 49152:dnYi6rOCgUUCz5i1+yRbVqdjNCm9X9RcUKUsjVLdcmkTwbx:x17uMxM9XSzx
TLSH
T14FD55C01FBDBC1B4DEB712B00461C61F5929BE4517389FD7E3983E1E99326C2AC36269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5268-0-0x000001A51D7F0000-0x000001A51D7FC000-memory.dmp

Download