Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 03:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe
- Size 4.5MB
- Sample260529-dnmdjsbw6n
- SHA256 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52
- MD5 016ba8702b0da624f7bc5072e9c409f3
- SHA1 ec5f94ad4a7909805cc9cfcb0868408238ea4253
- SHA512 9cf8abaefd8279c979c23e5d5f4b820569873fe13ff135b5b14037cb0a0acc1ef27565fdea8947353e6969651b69eaaeb7b9850573bc4502bcfcc8026c21f98d
- SSDEEP 49152:8r893YdYqxgHFjeFKhwadOhfId/VkZ47qOff56mZVgrdT9dqx4746PEv4qBt7Evl:NWdbxgHB8IJL7ZIymTyOE68v+v1v
- TLSH T1EF266C32F0318077E652057658257B2988AB5EA1432995CBB3EC3C791F34BD326F673A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.xar\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\qzipgui.exe\" /open:\"%1\"" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe\OpenWithProgids dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "zip万能压缩" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.bzip2\shell\open\command dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bzip2\qzipgui = "7-Zip\\.bzip2" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.gzip\shell\open dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (int) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe\OpenWithProgids\qzipgui.exe.wim = "0" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (int) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe\OpenWithProgids\qzipgui.exe.cpio = "0" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.fat\DefaultIcon dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.7z dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.cpio\shell\open dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.iso\qzipgui = "Windows.IsoFile" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.lzma\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\qzipgui.exe\",1" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.xar\shell dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.z\shell\open\command dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.z\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\qzipgui.exe\" /open:\"%1\"" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.dmg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\qzipgui.exe\",1" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (int) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe\OpenWithProgids\qzipgui.exe.7z = "0" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.rar\shell\open\command dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.rar\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\qzipgui.exe\" /open:\"%1\"" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.gzip\shell dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cab\ = "zip万能压缩" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.dmg\DefaultIcon dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.hfs\shell\open dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.ntfs\shell\open\command dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.xz\shell dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.bzip2\DefaultIcon dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (int) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe\OpenWithProgids\qzipgui.exe.dmg = "0" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.dmg\shell dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.hfs\shell\open\command dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.z\DefaultIcon dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "zip万能压缩" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.bzip2 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.gzip\shell\open\FriendlyAppName = "zip万能压缩" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.wim dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.gz\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\qzipgui.exe\",1" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.hfs\DefaultIcon dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.iso\shell\open\command dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.zip\DefaultIcon dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.7z\qzipgui = "7-Zip\\.7z" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.rar\shell\open dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.bzip2\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\qzipgui.exe\" /open:\"%1\"" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.wim\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\qzipgui.exe\",1" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.dmg\shell\open\FriendlyAppName = "zip万能压缩" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.lzh\shell\open\FriendlyAppName = "zip万能压缩" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.ntfs dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (int) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe\OpenWithProgids\qzipgui.exe.tar = "0" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.gz dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.cab\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\qzipgui.exe\" /open:\"%1\"" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (int) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe\OpenWithProgids\qzipgui.exe.fat = "0" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.iso\ = "zip万能压缩" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.lzh\shell\open dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lzh\ = "zip万能压缩" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.xar\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\qzipgui.exe\",1" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.7z\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\qzipgui.exe\" /open:\"%1\"" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.tar\DefaultIcon dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.cab\DefaultIcon dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.cab\shell\open dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.cpio\shell\open\command dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.fat dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe.fat\shell dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (int) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\qzipgui.exe\OpenWithProgids\qzipgui.exe.zip = "0" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tar\qzipgui = "7-Zip\\.tar" dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe Token: SeTakeOwnershipPrivilege 2404 dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe"C:\Users\Admin\AppData\Local\Temp\dce12ff5d5c0200e4b7622adee190d5b69beb0dfe7144c3132ff586714287d52.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2404
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\data\local.dat
- Size 19B
- SHA256 c96eb1ae5289e9a99dcad7b2da810d0ca985473e437724aea9219ae9825e7f12
- MD5 b0e23aa159c532ffc16ef44936cafbe3
- SHA1 f3b2b45e51a7da56ebdb04bdbff65c58e1843047
- SHA512 a5b5e1c8ec4df9a2bb59f1b25d44cb2ecfaa50ea963bb9e25f352355db441d5a0d854450379e8f89dc34030b59ddbd81da26251a4a6d7d15300fa9ed18031519
- MD5 SHA1 SHA512