67e3619843384f1b69f0c9af9f8a212fe19d71be3d3bc2e116d429f866b273c3

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PrintMQClient(202106)/MQPrintClientApp.exe
Size 1.4MB
Sample260729-mcap2sdr7w
SHA256 67e3619843384f1b69f0c9af9f8a212fe19d71be3d3bc2e116d429f866b273c3
MD5 53f3758e3a20ab278820f36a00036059
SHA1 ce68851a0d98470b72f77682d131829cbc35fedf
SHA512 5fb7e5a1c626c1c1c133ca912bd0d8022172646408af82a42cecee44d81bf71cebe23cfa5828d07ba9c00fcf2a2cb03a5b259b1148e02c11d47833c60ddcaeb0
SSDEEP 6144:1+5yZL5yZLKsVs7oCaxJax0ttrSlONKNANKNZN:+aO27oCaxJax0ttrpM6Mn
TLSH
T165657494B9409486D89A7E33C01785FC1B1B3C56D25160CB7B463BEA3FB8F43693668E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	MQPrintClientApp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MQPrintClientProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MQPrintClientProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MQPrintClientProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MQPrintClientApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MQPrintClientProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MQPrintClientProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MQPrintClientProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MQPrintClientProcess.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
2228	MQPrintClientApp.exe
2280	MQPrintClientProcess.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
1664	MQPrintClientProcess.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2316	MQPrintClientProcess.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
4664	MQPrintClientProcess.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
4724	MQPrintClientProcess.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
3164	MQPrintClientProcess.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
2228	MQPrintClientApp.exe
1352	MQPrintClientProcess.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	MQPrintClientApp.exe
Token: SeDebugPrivilege	2280	MQPrintClientProcess.exe
Token: SeDebugPrivilege	1664	MQPrintClientProcess.exe
Token: SeDebugPrivilege	2316	MQPrintClientProcess.exe
Token: SeDebugPrivilege	4664	MQPrintClientProcess.exe
Token: SeDebugPrivilege	4724	MQPrintClientProcess.exe
Token: SeDebugPrivilege	3164	MQPrintClientProcess.exe
Token: SeDebugPrivilege	1352	MQPrintClientProcess.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2280	2228	MQPrintClientApp.exe	85
PID 2228 wrote to memory of 1664	2228	MQPrintClientApp.exe	89
PID 2228 wrote to memory of 2316	2228	MQPrintClientApp.exe	93
PID 2228 wrote to memory of 4664	2228	MQPrintClientApp.exe	95
PID 2228 wrote to memory of 4724	2228	MQPrintClientApp.exe	97
PID 2228 wrote to memory of 3164	2228	MQPrintClientApp.exe	105
PID 2228 wrote to memory of 1352	2228	MQPrintClientApp.exe	107

C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientApp.exe
"C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientApp.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe
  "C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2280
- C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe
  "C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe
  "C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe
  "C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4664
- C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe
  "C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4724
- C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe
  "C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3164
- C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe
  "C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MQPrintClientProcess.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MQPrintClientProcess.exe.log
Size 1KB
SHA256 cbed0ae68c942941add892faf25fdc368cb124fe5679cabb729434e41f46c18f
MD5 90c8dfebd594591d90ba0dd36a69d8a9
SHA1 5634f6c34f0e9558e0ce1e6ed6b7ebbc27e00216
SHA512 217b879f17fa21995b33de14da667b627ecc5d7d4c8e69af96bccc86376f1c47bb3e9095d59a43d49110896c596176873370436b8b5dc4278868ffe9b4b661ee
TLSH
T1282160303222B5D44D422F530C5869C522FF47497774EE2C7999235EDE2645B9B311F3
MD5 SHA1 SHA512 TLSH

Submit Download

MQPrintClientProcess.log

Path C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\Log\20260729\MQPrintClientProcess.log
Size 2KB
SHA256 75156321c58b5d7bc6daaa67fee008d57a2be641913ea300af7582e4c3eff03e
MD5 99954b72b92422ea662e0607ac2a8c6c
SHA1 66fbd3e1a18ce181e08b162a8b417255ff49ae0d
SHA512 d5ea2cef3b847c364ad1496b0c9c00065d67fea21f92437eaa6a032eed30e9944942a2db5d2d7b8d0f756be14739c519b3e26aa2049dfee6ae178eb7c538bd07
TLSH
T12F411E18AB0510B633E39531F11A8995F57E871117A91413A6FD88BCBC3218B2FBD7DB
MD5 SHA1 SHA512 TLSH

Submit Download

MQPrintClientProcess.log

Path C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\Log\20260729\MQPrintClientProcess.log
Size 4KB
SHA256 19aab644ad047185b936b9098a44c04d082ae6ff726c85138e98950b9248548d
MD5 84e2423a57989c1b459d6b9675199d18
SHA1 45713e8fe4e92c2b83c888e96dd5fd01daa1426a
SHA512 6a6f05d1248828c4fcee2743f8d5abd3802aee76a661a8ce459995161d8f75007d324005791e3e1da96225a6c9248322417756768a0be6defac5c2e9834eb4bc
SSDEEP 96:JWM9yxMduM1MPWGPWRDW9hW9eWWlxClxNzNZWq9qXbM9yxMduM1MPWGPWRDW9hWe:JWMcxMduM1MPWGPWRDW9hW9eWWlxClxy
TLSH
T183912C18A70910B633E35631F11E8995F57E871112A90813A6FC88BCBC3208B2FBD7CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MQPrintClientProcess.log

Path C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\Log\20260729\MQPrintClientProcess.log
Size 6KB
SHA256 a2b6f28b7220177f9eb65a33abc9e5aa1d29e21406628aa3c381ab66476ac72a
MD5 cf99de0d32afaf1da780a2ac1c2559eb
SHA1 26e3a4d92b44c16771790631185e19073d30bd56
SHA512 58cfccb6fba71243f3c403c72f748f58403153b675d9bffcabaa6f716db89391612515244adc4dab0a9f2e871354936dc7adb440aa52d3221b5172a065317a58
SSDEEP 192:JWMcxMduM1MPWGPWRDW9hW9eWWlxClxNzNZj4XbMcxMduM1MPWGPWRDW9hW9eWWj:IjxMduM1M3SguwWBB2jxMduM1M3Sguwj
TLSH
T13BD1FC18A31910B632E31531F11E8995F57E871116A90813A6FD88BCBC3618B6EBD7DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MQPrintClientProcess.log

Path C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\Log\20260729\MQPrintClientProcess.log
Size 6KB
SHA256 bc686c225a5bb335c4bf15b148751b6393f482c4c85fb4d97ee87ff79c378128
MD5 a842d53080572ee369515a1dabf4996e
SHA1 0d80b26674462b5fd263a297dfd41b628d6bb73d
SHA512 dfb42634b16e044f5999df6301cd3847a4c27b64c97bc9f5f3b0e80b6620a6473ce84bf8332d1358b936a981997c7e1455f8948cad564804c13cef104f9b0fc6
SSDEEP 192:JWMcxMduM1MPWGPWRDW9hW9eWWlxClxNzNZj4XbMcxMduM1MPWGPWRDW9hW9eWWN:IjxMduM1M3SguwWBB2jxMduM1M3SguwN
TLSH
T173D10C18A70910B633E35531F11E8995F57E871116A90813A6FD88BCBC3218B6FBD7DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MQPrintClientProcess.log

Path C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\Log\20260729\MQPrintClientProcess.log
Size 8KB
SHA256 b54126c796387dffd5dd476b3724cf93523ff4dabded8ab411ca8b6ec32c60c2
MD5 5aab15e8242488c6e15cfca45374cdc6
SHA1 6fbdf0677bbf0e5b44a9461183a5096eed976c36
SHA512 2cb55574bafdf34ff5e9a63d7ae3363a52f5dcd0234e3c726a039e5365ea565e8fd37c82e3a3085f599cb0eba94273e0e9932e37e73669952b75e16da978051f
SSDEEP 192:JWMcxMduM1MPWGPWRDW9hW9eWWlxClxNzNZj4XbMcxMduM1MPWGPWRDW9hW9eWWY:IjxMduM1M3SguwWBB2jxMduM1M3SguwY
TLSH
T19D020C18A70910B633E35531F11E8995F57E871116E90813A6FD88BCBC3218B6EBDBDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MQPrintClientProcess.log

Path C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\Log\20260729\MQPrintClientProcess.log
Size 10KB
SHA256 6caea5fdf826a4f61e7fb1f5f2c4c69e8f74396894940854c99ae50b1af5dd0c
MD5 90e4c240a16d74b218485698730d9ea0
SHA1 070426613b2152a3dbec9e23ea44b24ddc342225
SHA512 c9be9921c737a69a1ee8f5b861ad60feaab852c790b0ad4f33529952e3cd9aee3c281efe9fba69c32a292440ba1dc0456ac481276c7fcd3bfa10bdefc3946b03
SSDEEP 192:JWMcxMduM1MPWGPWRDW9hW9eWWlxClxNzNZj4XbMcxMduM1MPWGPWRDW9hW9eWW4:IjxMduM1M3SguwWBB2jxMduM1M3Sguw4
TLSH
T1BB320D18A70910B633E35531F11E8995F57E871116E90813A6FD88BCBC3218B6EBDBDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MQPrintClientProcess.log

Path C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\Log\20260729\MQPrintClientProcess.log
Size 13KB
SHA256 d8cf10d3da47045b5299b59f22157e1a1f7b5cc02d5cca5a4001da56f2734a8c
MD5 ef8455917d171331dea6aa255d0072f9
SHA1 7ec0138107e9ef72368554eac22846791a5b88d3
SHA512 fae33c805d6815b6b5ae17b64dcba962d4528af6919e74eadf4120ae24a0a22a0768c88a14a56b2f363a46f74caa58ac65cf7f5be3038653ef293adf8ac6f528
SSDEEP 384:IjxMduM1M3SguwWBB2jxMduM1M3SguwWBBJjxMduM1M3SguwWBBAjxMduM1M3Sgu:ixHx2xZxNxYxz
TLSH
T12F520D18A70910B633E35531F11E8994F57E871116E90813A6FD88BCBC3218B6EBDBDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2228-7-0x00000000065F0000-0x0000000006944000-memory.dmp

Download

memory/2228-24-0x0000000005820000-0x0000000005830000-memory.dmp

Download

memory/2228-12-0x0000000006B90000-0x0000000006C22000-memory.dmp

Download

memory/2228-13-0x0000000006B50000-0x0000000006B5A000-memory.dmp

Download

memory/2228-14-0x0000000005820000-0x0000000005830000-memory.dmp

Download

memory/2228-11-0x00000000069B0000-0x00000000069D2000-memory.dmp

Download

memory/2228-1-0x0000000005E40000-0x00000000063E4000-memory.dmp

Download

memory/2228-3-0x0000000005740000-0x00000000057CA000-memory.dmp

Download

memory/2228-25-0x0000000005820000-0x0000000005830000-memory.dmp

Download

memory/2228-2-0x00000000056A0000-0x000000000573C000-memory.dmp

Download

memory/2228-9-0x0000000006950000-0x0000000006972000-memory.dmp

Download

memory/2228-8-0x0000000005820000-0x0000000005830000-memory.dmp

Download

memory/2228-0-0x0000000000CC0000-0x0000000000E32000-memory.dmp

Download

memory/2228-4-0x0000000003230000-0x0000000003240000-memory.dmp

Download

memory/2228-5-0x0000000003240000-0x0000000003250000-memory.dmp

Download

memory/2280-19-0x0000000004890000-0x00000000048DC000-memory.dmp

Download

memory/2280-26-0x0000000005210000-0x0000000005220000-memory.dmp

Download

memory/2280-20-0x0000000005210000-0x0000000005220000-memory.dmp

Download