67e3619843384f1b69f0c9af9f8a212fe19d71be3d3bc2e116d429f866b273c3

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PrintMQClient(202106)/MQPrintClientApp.exe
Size 1.4MB
Sample260729-mcap2sdr7w
SHA256 67e3619843384f1b69f0c9af9f8a212fe19d71be3d3bc2e116d429f866b273c3
MD5 53f3758e3a20ab278820f36a00036059
SHA1 ce68851a0d98470b72f77682d131829cbc35fedf
SHA512 5fb7e5a1c626c1c1c133ca912bd0d8022172646408af82a42cecee44d81bf71cebe23cfa5828d07ba9c00fcf2a2cb03a5b259b1148e02c11d47833c60ddcaeb0
SSDEEP 6144:1+5yZL5yZLKsVs7oCaxJax0ttrSlONKNANKNZN:+aO27oCaxJax0ttrpM6Mn
TLSH
T165657494B9409486D89A7E33C01785FC1B1B3C56D25160CB7B463BEA3FB8F43693668E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MQPrintClientProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MQPrintClientApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MQPrintClientProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MQPrintClientProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MQPrintClientProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MQPrintClientProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MQPrintClientProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MQPrintClientProcess.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
2444	MQPrintClientApp.exe
5612	MQPrintClientProcess.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
5576	MQPrintClientProcess.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
5568	MQPrintClientProcess.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
5344	MQPrintClientProcess.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
3884	MQPrintClientProcess.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
3348	MQPrintClientProcess.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
2444	MQPrintClientApp.exe
3532	MQPrintClientProcess.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2444	MQPrintClientApp.exe
Token: SeDebugPrivilege	5612	MQPrintClientProcess.exe
Token: SeDebugPrivilege	5576	MQPrintClientProcess.exe
Token: SeDebugPrivilege	5568	MQPrintClientProcess.exe
Token: SeDebugPrivilege	5344	MQPrintClientProcess.exe
Token: SeDebugPrivilege	3884	MQPrintClientProcess.exe
Token: SeDebugPrivilege	3348	MQPrintClientProcess.exe
Token: SeDebugPrivilege	3532	MQPrintClientProcess.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 5612	2444	MQPrintClientApp.exe	89
PID 2444 wrote to memory of 5576	2444	MQPrintClientApp.exe	91
PID 2444 wrote to memory of 5568	2444	MQPrintClientApp.exe	94
PID 2444 wrote to memory of 5344	2444	MQPrintClientApp.exe	96
PID 2444 wrote to memory of 3884	2444	MQPrintClientApp.exe	98
PID 2444 wrote to memory of 3348	2444	MQPrintClientApp.exe	100
PID 2444 wrote to memory of 3532	2444	MQPrintClientApp.exe	102

C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientApp.exe
"C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientApp.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe
  "C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5612
- C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe
  "C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5576
- C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe
  "C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5568
- C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe
  "C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5344
- C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe
  "C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3884
- C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe
  "C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3348
- C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe
  "C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\MQPrintClientProcess.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MQPrintClientProcess.log

Path C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\Log\20260729\MQPrintClientProcess.log
Size 2KB
SHA256 3ee3c1d97a1e084ba5d78d71a14ffe64dcd94b5c3fa774942db07e9ecaa6d593
MD5 0b5a23460bcdb4770557dc11904c4a84
SHA1 13e8fd05c39035d21f1844ab46c250f7cd221365
SHA512 0a1d9045deb17c3f0f28e28e2fb53b4e32c6d55ca6e4b048b756ca91bed336c352d40e189d0cbd27cbef30c05cd7ebf7911818b760ad92a4bf3f7274fc28fd95
TLSH
T1CE413F18AB0910B633E79231F10D8995F57E861016A51812B3FD84ACBC3218B2FBD7DB
MD5 SHA1 SHA512 TLSH

Submit Download

MQPrintClientProcess.log

Path C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\Log\20260729\MQPrintClientProcess.log
Size 4KB
SHA256 1a8faa974eec91e5dca8bfcc46c6116e3127b4f02fd46e1187d39f4c58531ea1
MD5 195bd24f4e40adcf734bfcbdc3c9398f
SHA1 8fe3a9901310e90975a4655ccf13c4003cbbcf1c
SHA512 8031675894bffe330e1546e765dded13ec28c9413ac5aa6f435fd289835565200f6f7088faef447bf24278bcd5bd56b0110c072b4dd8847b3975b4538d97bedb
SSDEEP 96:9tM9yxMduM1MPWGPWRDW9hW9eWWlxClxNzNZWq9qzdM9yxMduM1MPWGPWRDW9hWh:9tMcxMduM1MPWGPWRDW9hW9eWWlxClxv
TLSH
T136912C18A70910B633E35531F11E8995F57E871112A50823A6FC88BCBC3208B2FBD7CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MQPrintClientProcess.log

Path C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\Log\20260729\MQPrintClientProcess.log
Size 6KB
SHA256 7112d7c340b107b221d821890274fa4e020b2bf59c9ea7533828abcdb2f10f9b
MD5 e52e3bac833d592e3465e0c26a660303
SHA1 8278c46cef641aa7d8168216f52777d4fd70855f
SHA512 470ec4995797e3d403e58c3a9b00c8d8df0d054742649e0e7a119cb3245667a3e0f95014f8cedacb39a684ea8a04cfd0f4ce4306607cd957c0030568b71a6952
SSDEEP 192:9tMcxMduM1MPWGPWRDW9hW9eWWlxClxNzNZj4zdMcxMduM1MPWGPWRDW9hW9eWWM:vjxMduM1M3SguwWBB4jxMduM1M3SguwM
TLSH
T1DDD1FC18A30910B632E31531F11E8995F57E871116A51823A6FD88BCBC3618B6FBD7DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MQPrintClientProcess.log

Path C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\Log\20260729\MQPrintClientProcess.log
Size 6KB
SHA256 730dfa6300695bbe07a27c601888c8ebc43478744bcfde951f6746d12a53a184
MD5 1a99ce5c0e68881b3279c3fd5d37e6ec
SHA1 e8c400b4afbaec61fde63b669a0c62870265f700
SHA512 7587ec18c850d0e5e80ac7d535492b6ba0afdd6c36124de527b83411944ba65e91ad1930446e5b55120e77eedc16788e145ff1037b5e566475dd674444210f58
SSDEEP 192:9tMcxMduM1MPWGPWRDW9hW9eWWlxClxNzNZj4zdMcxMduM1MPWGPWRDW9hW9eWWu:vjxMduM1M3SguwWBB4jxMduM1M3Sguwu
TLSH
T1AAD11C18A70910B633E35531F11E8995F57E871116A50823A6FD88BCBC3218B6FBD7DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MQPrintClientProcess.log

Path C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\Log\20260729\MQPrintClientProcess.log
Size 8KB
SHA256 b41a1507e01164c5c1762838c9308b778673d242a0e6e13bc58f062d950b241b
MD5 e9a2dd49a8eaed7419936c83d21b813a
SHA1 3be3ac43ba3cd2ab3f1f064d2009d8ac1d5ba313
SHA512 575cb4c85e3a024aba8bab14fbc390f3be7a414a6fdcece49f06e64d5de0a2727826f59f572bccaadc9966df34ff7157fc3f625cf95274d2b6a39e4e6f7d2f87
SSDEEP 192:9tMcxMduM1MPWGPWRDW9hW9eWWlxClxNzNZj4zdMcxMduM1MPWGPWRDW9hW9eWWH:vjxMduM1M3SguwWBB4jxMduM1M3SguwH
TLSH
T173020C18A70910B632E35531F11E8995F57E871116E90813A6FD88BCBC3218B6FBDBDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MQPrintClientProcess.log

Path C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\Log\20260729\MQPrintClientProcess.log
Size 10KB
SHA256 a69d66484378b447900d2694b895db8171a59d97439f6792344cdbb73432ea7e
MD5 84fdd77c5660b4b1f0d9e9fca4d6d4f9
SHA1 46444fccf80f8f661a2bf1f08678cd23e488a87e
SHA512 0a0fa7dd8af8d8fc8b431cfd9089c54a7a7f57b41e3acc53790db80f52fd93ee375c8e83b71bb92c880d09a7a799980bfedc807590988da992be2d8cf7b5b336
SSDEEP 192:9tMcxMduM1MPWGPWRDW9hW9eWWlxClxNzNZj4zdMcxMduM1MPWGPWRDW9hW9eWWX:vjxMduM1M3SguwWBB4jxMduM1M3SguwX
TLSH
T1C7320C18A30910B632E35531F11E8994F57E871116E90813A6FD88BCBC3218B6FBDBDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MQPrintClientProcess.log

Path C:\Users\Admin\AppData\Local\Temp\PrintMQClient(202106)\Log\20260729\MQPrintClientProcess.log
Size 13KB
SHA256 9814599d0bf58a1e4eb5a3c31a83e9a70ddb30946706c18fcb95b218844acb68
MD5 b83b82bbd328d905ed791d877c315e3b
SHA1 d4bcf00a886d70d1e31545879d246f56fdc471e3
SHA512 31834fe3b63255064d09d73c5173fc6e87139144c0e9663d45e420d2b036b206c2d07f9a10a7a4e2c9fbdf6433d7b18a463fb9436640f3090ee77a1f38e37267
SSDEEP 384:vjxMduM1M3SguwWBB4jxMduM1M3SguwWBBSjxMduM1M3SguwWBB0pKcjxMduM1Mu:rxdx7xTpKuxRPxYx3
TLSH
T12D520C18A31910B632E35531F11E8994F57E871116E90813A6FD88BCBC3218B6FBDBDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2444-14-0x0000000006BE0000-0x0000000006BEA000-memory.dmp

Download

memory/2444-5-0x0000000005700000-0x0000000005710000-memory.dmp

Download

memory/2444-10-0x00000000069F0000-0x0000000006A82000-memory.dmp

Download

memory/2444-11-0x0000000074680000-0x0000000074E3C000-memory.dmp

Download

memory/2444-13-0x00000000069B0000-0x00000000069D2000-memory.dmp

Download

memory/2444-8-0x0000000006540000-0x000000000689B000-memory.dmp

Download

memory/2444-15-0x0000000074680000-0x0000000074E3C000-memory.dmp

Download

memory/2444-0-0x0000000074692000-0x0000000074693000-memory.dmp

Download

memory/2444-6-0x0000000005C80000-0x0000000005C90000-memory.dmp

Download

memory/2444-9-0x0000000006920000-0x0000000006942000-memory.dmp

Download

memory/2444-26-0x0000000074692000-0x0000000074693000-memory.dmp

Download

memory/2444-27-0x0000000074680000-0x0000000074E3C000-memory.dmp

Download

memory/2444-28-0x0000000074680000-0x0000000074E3C000-memory.dmp

Download

memory/2444-4-0x0000000005670000-0x00000000056FA000-memory.dmp

Download

memory/2444-3-0x0000000005720000-0x00000000057BC000-memory.dmp

Download

memory/2444-2-0x0000000005CE0000-0x000000000629A000-memory.dmp

Download

memory/2444-1-0x0000000000B20000-0x0000000000C92000-memory.dmp

Download

memory/5612-20-0x0000000074680000-0x0000000074E3C000-memory.dmp

Download

memory/5612-31-0x0000000074680000-0x0000000074E3C000-memory.dmp

Download

memory/5612-29-0x0000000074680000-0x0000000074E3C000-memory.dmp

Download

memory/5612-22-0x0000000074680000-0x0000000074E3C000-memory.dmp

Download

memory/5612-21-0x0000000004B70000-0x0000000004BBC000-memory.dmp

Download