ac633dd59504612d9ad6279265f0b40f7fedcfc22e7711c78e869e10b93fba1e

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 03:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
快速启动管理器(CLaunch)4.22.x64汉化绿色便携版/Setup.exe
Size 148KB
Sample260804-d6vsmsvvgy
SHA256 ac633dd59504612d9ad6279265f0b40f7fedcfc22e7711c78e869e10b93fba1e
MD5 1d1cd65fcd04f9c9647a660b57396920
SHA1 8f9456667ba59519456a5acd8f822ff09604ce4f
SHA512 ae6966c9dde2340c9fa4bcaf9076fc26a0f59b402a5855d2235147f615011d0fa7ac31f96e4a6fc9dac01b5e0b631811b3d079173f1e816a37cf2a1969ed593d
SSDEEP 3072:Mgmsvt/Ger8mr2BhEQST0y5aFVpM6PyScOyEWUmSN80:MgmggvtST0GanRlq0
TLSH
T107E34A0772A931EAE176C13985A25601F77378315B219BEF03A48A7A1F237D1FD39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File created	C:\Program Files\CLaunch\Languages\English.dll	Setup.exe
File opened for modification	C:\Program Files\CLaunch\Languages\Language.ini	Setup.exe
File opened for modification	C:\Program Files\CLaunch\Skins\Glass.zip	Setup.exe
File created	C:\Program Files\CLaunch\Skins\Solid Black.zip	Setup.exe
File created	C:\Program Files\CLaunch\ClAdmin.exe	Setup.exe
File opened for modification	C:\Program Files\CLaunch\ClAdmin.exe	Setup.exe
File created	C:\Program Files\CLaunch\Languages\Chinese.dll	Setup.exe
File opened for modification	C:\Program Files\CLaunch\Languages\English.dll	Setup.exe
File opened for modification	C:\Program Files\CLaunch\Skins\Vista-style.zip	Setup.exe
File created	C:\Program Files\CLaunch\CLaunch.exe	Setup.exe
File created	C:\Program Files\CLaunch\Skins\Glass.zip	Setup.exe
File opened for modification	C:\Program Files\CLaunch\CLaunch.exe	Setup.exe
File created	C:\Program Files\CLaunch\Setup.exe	Setup.exe
File created	C:\Program Files\CLaunch\Docs\CLaunch_en.chm	Setup.exe
File opened for modification	C:\Program Files\CLaunch\Docs\CLaunch_en.chm	Setup.exe
File created	C:\Program Files\CLaunch\Languages\Language.ini	Setup.exe
File opened for modification	C:\Program Files\CLaunch\Skins\Solid Black.zip	Setup.exe
File created	C:\Program Files\CLaunch\Skins\Vista-style.zip	Setup.exe
File created	C:\Program Files\CLaunch\ClHook.dll	Setup.exe
File opened for modification	C:\Program Files\CLaunch\ClHook.dll	Setup.exe
File opened for modification	C:\Program Files\CLaunch\Setup.exe	Setup.exe
File opened for modification	C:\Program Files\CLaunch\Languages\Chinese.dll	Setup.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	5736	Setup.exe
Token: SeRestorePrivilege	5736	Setup.exe
Token: SeBackupPrivilege	5736	Setup.exe
Token: SeRestorePrivilege	5736	Setup.exe

C:\Users\Admin\AppData\Local\Temp\快速启动管理器(CLaunch)4.22.x64汉化绿色便携版\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\快速启动管理器(CLaunch)4.22.x64汉化绿色便携版\Setup.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads