1284493b8acda3ec4c96a2960090572c0670c808aa2b41d1d997a03b347e784d

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
qq-bridge-3.3.0\launcher\Launcher.ps1
Size 70KB
Sample261113-yllz8a1v2l
SHA256 1284493b8acda3ec4c96a2960090572c0670c808aa2b41d1d997a03b347e784d
MD5 5dca8303d69b2483343e41f5a4269c6d
SHA1 dc9dd1ce107f49f0c873de2a33de9ecf535873d0
SHA512 e5ce40789ed946e02e575757e2adb721a9cc5084d9f489bb5ae5ceadc219b21336f9f10296d01014b9cd136f4147da90564a183715293dd28a7dbf7a78074001
SSDEEP 1536:zGRJ9886cubct8E2SKylGwg+2TkvphklJfZheCCZ8+2:zGZ8E8UuXkh6lBZc8j
TLSH
T1A463F9296CAAD52501C7D06B1CADD014E8329177A609AD38FDFCC184EF995B8CFBCB94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QQDshLauncher.lnk	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2460	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2460	PowerShell.exe
2460	PowerShell.exe
5100	powershell.exe
5100	powershell.exe
5100	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	PowerShell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeIncreaseQuotaPrivilege	2460	PowerShell.exe
Token: SeSecurityPrivilege	2460	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2460	PowerShell.exe
Token: SeLoadDriverPrivilege	2460	PowerShell.exe
Token: SeSystemProfilePrivilege	2460	PowerShell.exe
Token: SeSystemtimePrivilege	2460	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2460	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2460	PowerShell.exe
Token: SeCreatePagefilePrivilege	2460	PowerShell.exe
Token: SeBackupPrivilege	2460	PowerShell.exe
Token: SeRestorePrivilege	2460	PowerShell.exe
Token: SeShutdownPrivilege	2460	PowerShell.exe
Token: SeDebugPrivilege	2460	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2460	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2460	PowerShell.exe
Token: SeUndockPrivilege	2460	PowerShell.exe
Token: SeManageVolumePrivilege	2460	PowerShell.exe
Token: 33	2460	PowerShell.exe
Token: 34	2460	PowerShell.exe
Token: 35	2460	PowerShell.exe
Token: 36	2460	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2460	PowerShell.exe
Token: SeSecurityPrivilege	2460	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2460	PowerShell.exe
Token: SeLoadDriverPrivilege	2460	PowerShell.exe
Token: SeSystemProfilePrivilege	2460	PowerShell.exe
Token: SeSystemtimePrivilege	2460	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2460	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2460	PowerShell.exe
Token: SeCreatePagefilePrivilege	2460	PowerShell.exe
Token: SeBackupPrivilege	2460	PowerShell.exe
Token: SeRestorePrivilege	2460	PowerShell.exe
Token: SeShutdownPrivilege	2460	PowerShell.exe
Token: SeDebugPrivilege	2460	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2460	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2460	PowerShell.exe
Token: SeUndockPrivilege	2460	PowerShell.exe
Token: SeManageVolumePrivilege	2460	PowerShell.exe
Token: 33	2460	PowerShell.exe
Token: 34	2460	PowerShell.exe
Token: 35	2460	PowerShell.exe
Token: 36	2460	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2460	PowerShell.exe
Token: SeSecurityPrivilege	2460	PowerShell.exe
Token: SeTakeOwnershipPrivilege	2460	PowerShell.exe
Token: SeLoadDriverPrivilege	2460	PowerShell.exe
Token: SeSystemProfilePrivilege	2460	PowerShell.exe
Token: SeSystemtimePrivilege	2460	PowerShell.exe
Token: SeProfSingleProcessPrivilege	2460	PowerShell.exe
Token: SeIncBasePriorityPrivilege	2460	PowerShell.exe
Token: SeCreatePagefilePrivilege	2460	PowerShell.exe
Token: SeBackupPrivilege	2460	PowerShell.exe
Token: SeRestorePrivilege	2460	PowerShell.exe
Token: SeShutdownPrivilege	2460	PowerShell.exe
Token: SeDebugPrivilege	2460	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	2460	PowerShell.exe
Token: SeRemoteShutdownPrivilege	2460	PowerShell.exe
Token: SeUndockPrivilege	2460	PowerShell.exe
Token: SeManageVolumePrivilege	2460	PowerShell.exe
Token: 33	2460	PowerShell.exe
Token: 34	2460	PowerShell.exe
Token: 35	2460	PowerShell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2460	PowerShell.exe
2460	PowerShell.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2460	PowerShell.exe
2460	PowerShell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 4968	2460	PowerShell.exe	90
PID 4968 wrote to memory of 4272	4968	csc.exe	91
PID 2460 wrote to memory of 5688	2460	PowerShell.exe	93
PID 5688 wrote to memory of 5176	5688	csc.exe	95

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\qq-bridge-3.3.0\launcher\Launcher.ps1
1⤵
- Creates a file in the Startup directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cqg5yeqs\cqg5yeqs.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES57EA.tmp" "c:\Users\Admin\AppData\Local\Temp\cqg5yeqs\CSCADADCE161C4145B6B8B8A81B5BD4E7C.TMP"
    3⤵
    PID:4272
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gv4uz4um\gv4uz4um.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5688
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5EB0.tmp" "c:\Users\Admin\AppData\Local\Temp\gv4uz4um\CSC625DF1262E41C8B5C576C6FC9BEB7.TMP"
    3⤵
    PID:5176

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES57EA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES57EA.tmp
Size 1KB
SHA256 6748122a5ab264d706a2feadb633bac760f9a94f2d5a1848233c58653ad65bc3
MD5 68ab488ce41ca11f5f5eba36d38fcaec
SHA1 b800021661dd97c34625c70c428f1adb1339560f
SHA512 a0a633db559d6d344c496c56133f660c1fd7903746d9da9076040efd8aae445450519bdf42c8fe306a18e7f1076c82218834d34bc47f82437c958372958bb485
TLSH
T1C221AD0153E9871FF0774F32A9F5676BA275FE64EFA2976A844842282C41504EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES5EB0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5EB0.tmp
Size 1KB
SHA256 c32ceefa0363d84f743f1270e0429ba5b0c60e521416308434ec281478214825
MD5 0a734aebe5b09a10b72977b2ecd74491
SHA1 62c8d0b716846b7661c09469acceaca3337ebd59
SHA512 f882186dd336504f8c43fdfc1c31dea3fce006dd0e9e70fc7ddc1ecfaf22a9a3d73d9a5786b3b37b7c7e2464135fe297c6f868ffe1d6bfebaa42c479d1a8e99f
TLSH
T1ED21FC0183EE471FF0730731A9F6572F9175FDA5DFA2A36AC44002281C11204EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_sxooncdg.ghm.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sxooncdg.ghm.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cqg5yeqs.dll

Path C:\Users\Admin\AppData\Local\Temp\cqg5yeqs\cqg5yeqs.dll
Size 3KB
SHA256 b357966c8ff2bb364e2d631d3c37b00d121d897f953997271cf03c2780b9e24e
MD5 ccc198a3e2eca0fe4d415ec264ea64ad
SHA1 c30508a7e8c0157c7e1c1f3dce081b54960f7537
SHA512 07b1f14627b2fa30228870c785040bfbf8a6eb6090f445fe3a6f4cff09d3a33e70e34bdb3ad0a2659af663420b386a74c1b6d49dab259627a3f7e5e5a571ea3d
TLSH
T1A351AC0AA3E9856BE5B70B30AEF3435377B4F8109FB2976D5990022D6C207245E31FB0
MD5 SHA1 SHA512 TLSH

Submit Download

gv4uz4um.dll

Path C:\Users\Admin\AppData\Local\Temp\gv4uz4um\gv4uz4um.dll
Size 9KB
SHA256 81a629b2ac5040b666f2dfc54e46a3bd075743f931ba80b9fccb4bcf06949b02
MD5 3664e3be9daa68b38cef3912427ae621
SHA1 2f3d8a0bef73b381af5b8541367bbbb48402a203
SHA512 bb321eb552847bd2b7b3dc1bba1ad82f5b0e33ebe3fb319c6cc566820621a59458b1cf162d782b79784fde5d7f747fc3b3e2b14ac384e71466d06453a9cda04d
SSDEEP 192:G1KN+h3u/NLG57jXt0jQRa89ZTLVGOl2fh:4K4h3uQ7TNRa87Ll2p
TLSH
T19B12F75293E9D26FDE7F1F3C77E6160213B0C8025112D78F1DA942A8DD9BB084A9A3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCADADCE161C4145B6B8B8A81B5BD4E7C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\cqg5yeqs\CSCADADCE161C4145B6B8B8A81B5BD4E7C.TMP
Size 652B
SHA256 2df79b4be43a32588c4dbb58b27b6a8d6035394332ff9009a41092d9b74b14d0
MD5 c7cb7bb6b2224408120a236aad3d3d63
SHA1 b2175571807ecb6c3a796b4a14aa1bad9cf61ed3
SHA512 854dfe735ace799e28441ae1219752492812cb4b055bedd8f2a2f00c5a55f8137c4f9f1e8c73945541fc8c07e05c9b304b8b2ff59594987e2cc3c9e0491c885c
TLSH
T17DF03A0963F8420EF0F34F31F9F693A395A8BD64DE3293ED1444431D28649109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

cqg5yeqs.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\cqg5yeqs\cqg5yeqs.0.cs
Size 271B
SHA256 fceeefe9c6e685251f094d86d0cec8d20c92e676948641cfd57eda913654c34b
MD5 ab55a74729f576f0ff672235f8a7ce54
SHA1 0579f6ac0573691be479079c7da0c6e59d7a0c46
SHA512 d4eb12924b0f7ea39279d408687f9b6e5ae2ac1d8944306b4c1286176a8a85e0bd6cf0fb9ce25352c5d5a52db2862ea4d54fa60aa2e6a652e8e9c441a50f10d9
TLSH
T1ACD02B1863E7DD26415244172C69F8D49F33511A156E6C00FAF90221CECB1041B31E15
MD5 SHA1 SHA512 TLSH

Submit Download

cqg5yeqs.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\cqg5yeqs\cqg5yeqs.cmdline
Size 369B
SHA256 3a7154234e03d818c3d27f8edde2189c02c48c7b420894aa998fda93c9d7fef4
MD5 3e41974565fedae1a04fc3c116e16ed5
SHA1 26b712fd946cd85b8ac5503eb3cd21d135db061e
SHA512 cb50f1c8a503b23d3d4d5c9a8e7a0aff5799c60ccd547f56e7a25242083db77622ed2aacf205ffbb29e582743387cc5a981efab3388ecebbd4e87e1bba830b16
TLSH
T1A2E0202AD257C67F15DD50076169C5ECE273074729C17F847550446EF01B01477D1B65
MD5 SHA1 SHA512 TLSH

Submit Download

CSC625DF1262E41C8B5C576C6FC9BEB7.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\gv4uz4um\CSC625DF1262E41C8B5C576C6FC9BEB7.TMP
Size 652B
SHA256 735e2abc36536adcfb6df7b125a536be9bc039b32b08a968cc40b9333833cea3
MD5 38ba97d71474b790dee372cc7c71382b
SHA1 cb55c18a71be8ce5bf2afd7ccd3c2756934d0ef7
SHA512 cb738cb6d33f3546c059e18f750652d8948c31181e198355ad3031fba6e72b8b43de98027a6c0647f9b90039a6809714375de08b68a8b2c7562b2d1cb3c97222
TLSH
T1D8F05E0AA3F8020EF5F34B30FDF6836791AAFC65DE3293ED5440131968645208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

gv4uz4um.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\gv4uz4um\gv4uz4um.0.cs
Size 8KB
SHA256 2592bfffce1f2ae0a2e0234082862c17c678ed386327f31632d2079c680efa24
MD5 a7421ee3c653d2b029dc2a5464da4336
SHA1 9c0b47002bc880f12db6e90d27cdf1c848a04480
SHA512 f4a076e30a0f931c145c1494670ac54ce7225a6a4475b03eaa5753fe8eb6976acfdef9bcf6e6774bc314b542fe57627c84eb2e954d4349851fade79494ea80d0
SSDEEP 192:VrcKqwmqWbqqqqqrqnqgrFNrR7RNMqArdZqeqF8mExpOtb:VrcKqwmqWbqqqqq2HgjQF9
TLSH
T1290262566523672C8EA3E2398F9F40097F2A1007925F9D2C3B9E0125BF89428D5FDBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gv4uz4um.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\gv4uz4um\gv4uz4um.cmdline
Size 607B
SHA256 c40ac6e9ae7e494b935342cd9e86210330fe88760d3aa5dc22c6b523b943a9a6
MD5 5b508a20187c312f0b14d345ad42a652
SHA1 4072d05e3571c7c1ad22407dc7d2dee3d8753b05
SHA512 ecda6bec3e4fa87402d784f8ca5d1f80166943080c815b0b7a391489561582bdcadd3652d14e611469b537949b793876f087633fc1dafc347b2b2c478808b566
TLSH
T183F04C75033BC5BF45E9340719AE8F9CC23303EB3486AF587AC5885EE5A75022B91B98
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2460-11-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp

Download

memory/2460-51-0x0000018F49EC0000-0x0000018F49EC8000-memory.dmp

Download

memory/2460-19-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp

Download

memory/2460-12-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp

Download

memory/2460-0-0x00007FFE7C94F000-0x00007FFE7C950000-memory.dmp

Download

memory/2460-10-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp

Download

memory/2460-28-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp

Download

memory/2460-27-0x0000018F49A70000-0x0000018F49A78000-memory.dmp

Download

memory/2460-31-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp

Download

memory/2460-32-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp

Download

memory/2460-9-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp

Download

memory/2460-8-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp

Download

memory/2460-7-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp

Download

memory/2460-17-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp

Download

memory/2460-6-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp

Download

memory/2460-5-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp

Download

memory/2460-4-0x0000018F499D0000-0x0000018F499F2000-memory.dmp

Download

memory/2460-1-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp

Download

memory/2460-59-0x0000018F4A1F0000-0x0000018F4A20E000-memory.dmp

Download

memory/2460-60-0x0000018F4F790000-0x0000018F4F842000-memory.dmp

Download

memory/2460-61-0x0000018F4A210000-0x0000018F4A21A000-memory.dmp

Download

memory/2460-63-0x0000018F4F880000-0x0000018F4F8A4000-memory.dmp

Download

memory/2460-62-0x0000018F4F880000-0x0000018F4F8AA000-memory.dmp

Download

memory/2460-66-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp

Download

memory/2460-67-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp

Download

memory/2460-69-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp

Download

memory/5100-54-0x000001F27B140000-0x000001F27B188000-memory.dmp

Download