1284493b8acda3ec4c96a2960090572c0670c808aa2b41d1d997a03b347e784d

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
qq-bridge-3.3.0\launcher\Launcher.ps1
Size 70KB
Sample261113-yllz8a1v2l
SHA256 1284493b8acda3ec4c96a2960090572c0670c808aa2b41d1d997a03b347e784d
MD5 5dca8303d69b2483343e41f5a4269c6d
SHA1 dc9dd1ce107f49f0c873de2a33de9ecf535873d0
SHA512 e5ce40789ed946e02e575757e2adb721a9cc5084d9f489bb5ae5ceadc219b21336f9f10296d01014b9cd136f4147da90564a183715293dd28a7dbf7a78074001
SSDEEP 1536:zGRJ9886cubct8E2SKylGwg+2TkvphklJfZheCCZ8+2:zGZ8E8UuXkh6lBZc8j
TLSH
T1A463F9296CAAD52501C7D06B1CADD014E8329177A609AD38FDFCC184EF995B8CFBCB94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QQDshLauncher.lnk	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4848	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4848	powershell.exe
4848	powershell.exe
4336	powershell.exe
4336	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeIncreaseQuotaPrivilege	4848	powershell.exe
Token: SeSecurityPrivilege	4848	powershell.exe
Token: SeTakeOwnershipPrivilege	4848	powershell.exe
Token: SeLoadDriverPrivilege	4848	powershell.exe
Token: SeSystemProfilePrivilege	4848	powershell.exe
Token: SeSystemtimePrivilege	4848	powershell.exe
Token: SeProfSingleProcessPrivilege	4848	powershell.exe
Token: SeIncBasePriorityPrivilege	4848	powershell.exe
Token: SeCreatePagefilePrivilege	4848	powershell.exe
Token: SeBackupPrivilege	4848	powershell.exe
Token: SeRestorePrivilege	4848	powershell.exe
Token: SeShutdownPrivilege	4848	powershell.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeSystemEnvironmentPrivilege	4848	powershell.exe
Token: SeRemoteShutdownPrivilege	4848	powershell.exe
Token: SeUndockPrivilege	4848	powershell.exe
Token: SeManageVolumePrivilege	4848	powershell.exe
Token: 33	4848	powershell.exe
Token: 34	4848	powershell.exe
Token: 35	4848	powershell.exe
Token: 36	4848	powershell.exe
Token: SeIncreaseQuotaPrivilege	4848	powershell.exe
Token: SeSecurityPrivilege	4848	powershell.exe
Token: SeTakeOwnershipPrivilege	4848	powershell.exe
Token: SeLoadDriverPrivilege	4848	powershell.exe
Token: SeSystemProfilePrivilege	4848	powershell.exe
Token: SeSystemtimePrivilege	4848	powershell.exe
Token: SeProfSingleProcessPrivilege	4848	powershell.exe
Token: SeIncBasePriorityPrivilege	4848	powershell.exe
Token: SeCreatePagefilePrivilege	4848	powershell.exe
Token: SeBackupPrivilege	4848	powershell.exe
Token: SeRestorePrivilege	4848	powershell.exe
Token: SeShutdownPrivilege	4848	powershell.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeSystemEnvironmentPrivilege	4848	powershell.exe
Token: SeRemoteShutdownPrivilege	4848	powershell.exe
Token: SeUndockPrivilege	4848	powershell.exe
Token: SeManageVolumePrivilege	4848	powershell.exe
Token: 33	4848	powershell.exe
Token: 34	4848	powershell.exe
Token: 35	4848	powershell.exe
Token: 36	4848	powershell.exe
Token: SeIncreaseQuotaPrivilege	4848	powershell.exe
Token: SeSecurityPrivilege	4848	powershell.exe
Token: SeTakeOwnershipPrivilege	4848	powershell.exe
Token: SeLoadDriverPrivilege	4848	powershell.exe
Token: SeSystemProfilePrivilege	4848	powershell.exe
Token: SeSystemtimePrivilege	4848	powershell.exe
Token: SeProfSingleProcessPrivilege	4848	powershell.exe
Token: SeIncBasePriorityPrivilege	4848	powershell.exe
Token: SeCreatePagefilePrivilege	4848	powershell.exe
Token: SeBackupPrivilege	4848	powershell.exe
Token: SeRestorePrivilege	4848	powershell.exe
Token: SeShutdownPrivilege	4848	powershell.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeSystemEnvironmentPrivilege	4848	powershell.exe
Token: SeRemoteShutdownPrivilege	4848	powershell.exe
Token: SeUndockPrivilege	4848	powershell.exe
Token: SeManageVolumePrivilege	4848	powershell.exe
Token: 33	4848	powershell.exe
Token: 34	4848	powershell.exe
Token: 35	4848	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4848	powershell.exe
4848	powershell.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4848	powershell.exe
4848	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4588	4848	powershell.exe	84
PID 4588 wrote to memory of 1484	4588	csc.exe	85
PID 4848 wrote to memory of 4296	4848	powershell.exe	87
PID 4296 wrote to memory of 1628	4296	csc.exe	88

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\qq-bridge-3.3.0\launcher\Launcher.ps1
1⤵
- Creates a file in the Startup directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fnzgkt1j\fnzgkt1j.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF70.tmp" "c:\Users\Admin\AppData\Local\Temp\fnzgkt1j\CSC2E4F36AEF0134E68984ECFEF9D34EA65.TMP"
    3⤵
    PID:1484
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r3be1kl3\r3be1kl3.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD3E5.tmp" "c:\Users\Admin\AppData\Local\Temp\r3be1kl3\CSC23C4CC161CA248329CFFE4C9C6925C1A.TMP"
    3⤵
    PID:1628

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESCF70.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESCF70.tmp
Size 1KB
SHA256 e192f2257485bb6e209817981aae5cd772cf10525869f35aeea5c4eadeb5b7ec
MD5 9afdf3b9d9b69d9e19c81c6c5b949a22
SHA1 50e28b0eb86e74a8e8a0d31bee31156a774190c2
SHA512 6cc563ae49e42a4881c712451b4194ff8bf89174fa6450b881cb76124c11baf77b87c90410c4fd85f568dce4fc759809f68391a052c5a6305847d8db8f847d42
TLSH
T1E821CC0493E9871FF0B35732ADF5072F9234FD65EFA2935AC444422C2C41148EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RESD3E5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD3E5.tmp
Size 1KB
SHA256 48000beeab2978a668d2e6a627e65bc8e315088e2413a6072455f17e012d42a0
MD5 195222ff4e039cb0f0a9dd89862f7076
SHA1 d8fbfff68c9310eab1ee66c194ef3cd3c103df60
SHA512 930c863e825bf11e6cc96848bb3f0a692e4fc4b2df179e8b0c99b320208c4caa15999493468c72bb0f3047606e68b4a824c0a78f0fbf54e7bec14de229216ef1
TLSH
T16921CC0553E9871FF07317326DFA176FA238FD69EF62A72B844402292C51548DEA0A72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_r3nh3e14.ohv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r3nh3e14.ohv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

fnzgkt1j.dll

Path C:\Users\Admin\AppData\Local\Temp\fnzgkt1j\fnzgkt1j.dll
Size 3KB
SHA256 f5a97f1c24d12f9f25ba0e42a9057f8c6b1ef890cd7ef319a36a9c80e763e204
MD5 90df2565513d33105b74a9a9940dd37d
SHA1 de5bc53e4f14ad802dc0cb382ef7fe7bcaefa1d9
SHA512 78bcb2d1c74589fa358f04b34ae3e07b19ac976a451481ec77b18f6b552423032d56b2e65e42c3db0a68fa167b72a222f879e7d966aa96b6937f7a26e3a8ec78
TLSH
T18A51CA16A3E8466BF0B74734AEF3436623B8FC109FB2876D5AC00229AC602245D31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

r3be1kl3.dll

Path C:\Users\Admin\AppData\Local\Temp\r3be1kl3\r3be1kl3.dll
Size 9KB
SHA256 5da67bc9fce4a836d50c32bae96a78dbd4bc2c9c9ceedaab9b0fddc04753f3cb
MD5 1da3a4d8914c34588ca5d6ac069490f5
SHA1 af49ab96e642a262ecdddcadb3c1e72c4d65ff12
SHA512 2077445e36a7f80b48802d862b0cab3a4fbae32cebb81b9bdc8ffd0716f21a1784c1eef3578a22c7a1251463138a686147c3650eb0719a9b280f88522a55b732
SSDEEP 192:61KN+h3u/NLG57jXt0jQRn89Z8LVG/l2fS:UK4h3uQ7TNRn8EL82a
TLSH
T12412E65193E9D26FDE6F1F3C77E6160213B0C8015412DB8F1DA982A89D9BB084A993D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC2E4F36AEF0134E68984ECFEF9D34EA65.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\fnzgkt1j\CSC2E4F36AEF0134E68984ECFEF9D34EA65.TMP
Size 652B
SHA256 d8350e6ff6cb6168f29a172096a36892fdf16c040e7e6fddd96ca6082251d7c8
MD5 24b3121229ddc30abb02f68592ff663b
SHA1 3fdbcf4373c37e9b5b1e66db295bdcf6404976a2
SHA512 59faa54f1013bc5c080bc5291e8251322a5a8b0eac73d5958ecac30bca8feeb523f43346f517aa95c06396b1d0634c65871ab294b073d5bb251e5820fbd3ce4e
TLSH
T11AF05E0963F8021EF0F79B30FEF643A391A8BC65DE7293ED1484431D28645148962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

fnzgkt1j.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\fnzgkt1j\fnzgkt1j.0.cs
Size 271B
SHA256 fceeefe9c6e685251f094d86d0cec8d20c92e676948641cfd57eda913654c34b
MD5 ab55a74729f576f0ff672235f8a7ce54
SHA1 0579f6ac0573691be479079c7da0c6e59d7a0c46
SHA512 d4eb12924b0f7ea39279d408687f9b6e5ae2ac1d8944306b4c1286176a8a85e0bd6cf0fb9ce25352c5d5a52db2862ea4d54fa60aa2e6a652e8e9c441a50f10d9
TLSH
T1ACD02B1863E7DD26415244172C69F8D49F33511A156E6C00FAF90221CECB1041B31E15
MD5 SHA1 SHA512 TLSH

Submit Download

fnzgkt1j.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\fnzgkt1j\fnzgkt1j.cmdline
Size 369B
SHA256 052d3dfdbb01f75a811792bbb1b6fe54d41e277296d2f5baf8135cb2e9b09c13
MD5 bfe26121fd2ad72c9e2fca98bf203680
SHA1 2f9abd01db0d911b15dec8068911cb6d62e8fd5e
SHA512 ef7800df268cb40fc400eae3218fe54d10a524d90cbbc4ac4c76396dbea86af3899a487d28be9a7bc48581bee7e12c122dfc633975d3105f82fe4fdfd2f1b9d5
TLSH
T136E0D82A935AC6BD19D920072779C6AC82724A4729417F849151449DE0370067BF2755
MD5 SHA1 SHA512 TLSH

Submit Download

CSC23C4CC161CA248329CFFE4C9C6925C1A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\r3be1kl3\CSC23C4CC161CA248329CFFE4C9C6925C1A.TMP
Size 652B
SHA256 0183bf30a093b1dbccb00529f7e9bebdf07854a68b504d40cd385cb9c536d102
MD5 a4cc391f93cb754b71a020955c2cbedd
SHA1 c44ebb09d5ad424ae92772a6e7d4ff1018f27e3b
SHA512 7c81de1d650ffff23d38346c64bd7aaeb534b49227cca9f49228025ddfba9a8addb4f4f2f7af14bf4a0db2638a4fd0b536eb237b96ac261895ceed5e89941bb7
TLSH
T1E6F05E0963F8020EF0F35B70BDF643A791A8BC65DE32A7ED1444035928645148962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

r3be1kl3.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\r3be1kl3\r3be1kl3.0.cs
Size 8KB
SHA256 2592bfffce1f2ae0a2e0234082862c17c678ed386327f31632d2079c680efa24
MD5 a7421ee3c653d2b029dc2a5464da4336
SHA1 9c0b47002bc880f12db6e90d27cdf1c848a04480
SHA512 f4a076e30a0f931c145c1494670ac54ce7225a6a4475b03eaa5753fe8eb6976acfdef9bcf6e6774bc314b542fe57627c84eb2e954d4349851fade79494ea80d0
SSDEEP 192:VrcKqwmqWbqqqqqrqnqgrFNrR7RNMqArdZqeqF8mExpOtb:VrcKqwmqWbqqqqq2HgjQF9
TLSH
T1290262566523672C8EA3E2398F9F40097F2A1007925F9D2C3B9E0125BF89428D5FDBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r3be1kl3.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\r3be1kl3\r3be1kl3.cmdline
Size 607B
SHA256 2b18f1f58ac5b27ec117e1925b6588ed17a0b907527bace15d02d48ec15c8881
MD5 2b98060288b3cef17bb70672ceddda51
SHA1 2bdc7fc580fadb04e138e3dd978fd47bf2142327
SHA512 ae71bbabc7e4227973232329b1cba8631607223a406b0a81632de0b30545285bd61ab6b62fa27bdb9af977dce0210e9f0d7e8aa54a77e67e2205cf2d99bc0001
TLSH
T162F0AC39033BC5BE41E93403166F8AECC273034B30CAAF487584881EE5A71604BD1B99
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4336-53-0x000001DEFB600000-0x000001DEFB644000-memory.dmp

Download

memory/4336-54-0x000001DEFB6D0000-0x000001DEFB746000-memory.dmp

Download

memory/4848-45-0x0000022F7B410000-0x0000022F7B418000-memory.dmp

Download

memory/4848-10-0x0000022F7A080000-0x0000022F7A090000-memory.dmp

Download

memory/4848-7-0x0000022F79B70000-0x0000022F79B92000-memory.dmp

Download

memory/4848-1-0x0000022F7A080000-0x0000022F7A090000-memory.dmp

Download

memory/4848-26-0x0000022F7A080000-0x0000022F7A090000-memory.dmp

Download

memory/4848-23-0x0000022F79BC0000-0x0000022F79BC8000-memory.dmp

Download

memory/4848-0-0x0000022F7A080000-0x0000022F7A090000-memory.dmp

Download

memory/4848-57-0x0000022F7B5E0000-0x0000022F7B60A000-memory.dmp

Download

memory/4848-58-0x0000022F7B5E0000-0x0000022F7B604000-memory.dmp

Download

memory/4848-61-0x0000022F7A080000-0x0000022F7A090000-memory.dmp

Download

memory/4848-62-0x0000022F7A080000-0x0000022F7A090000-memory.dmp

Download

memory/4848-63-0x0000022F7A080000-0x0000022F7A090000-memory.dmp

Download

memory/4848-64-0x0000022F7A080000-0x0000022F7A090000-memory.dmp

Download