Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
27/12/2022, 23:39
221227-3nclsabh7y 127/12/2022, 23:35
221227-3k3c2agg92 627/12/2022, 23:31
221227-3hqw8abh6x 4Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27/12/2022, 23:31
Static task
static1
Behavioral task
behavioral1
Sample
LauncherFenix-Minecraft.jar
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
LauncherFenix-Minecraft.jar
Resource
win10v2004-20221111-en
General
-
Target
LauncherFenix-Minecraft.jar
-
Size
56KB
-
MD5
7a61030e60da59eb48d5430a175c38d3
-
SHA1
e21779e2d453397c6a2bbc6090ac49de8f0fe1ea
-
SHA256
2e33e36c9517efe86251a2f4294d822b55f344d189c9606189757f4ad17af38e
-
SHA512
27b143872d411088186fdf8178d3c05710795ceffbe75f227469025d309f845c4db3ad91aad0fce1b01671ef271b9bf0445d083d3c5008af2b8daf688e81320a
-
SSDEEP
1536:Fqv6lGMWvA34iBJZd8HJa3SUwxq7R83taXb:EvXMUA3bJZdwJjU3F1Xb
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1852 chrome.exe 304 chrome.exe 304 chrome.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 664 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 664 AUDIODG.EXE Token: 33 664 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 664 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe 304 chrome.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2036 java.exe 2036 java.exe 2036 java.exe 2036 java.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1252 2036 java.exe 29 PID 2036 wrote to memory of 1252 2036 java.exe 29 PID 2036 wrote to memory of 1252 2036 java.exe 29 PID 304 wrote to memory of 880 304 chrome.exe 33 PID 304 wrote to memory of 880 304 chrome.exe 33 PID 304 wrote to memory of 880 304 chrome.exe 33 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 960 304 chrome.exe 34 PID 304 wrote to memory of 1852 304 chrome.exe 35 PID 304 wrote to memory of 1852 304 chrome.exe 35 PID 304 wrote to memory of 1852 304 chrome.exe 35 PID 304 wrote to memory of 1608 304 chrome.exe 36 PID 304 wrote to memory of 1608 304 chrome.exe 36 PID 304 wrote to memory of 1608 304 chrome.exe 36 PID 304 wrote to memory of 1608 304 chrome.exe 36 PID 304 wrote to memory of 1608 304 chrome.exe 36 PID 304 wrote to memory of 1608 304 chrome.exe 36 PID 304 wrote to memory of 1608 304 chrome.exe 36 PID 304 wrote to memory of 1608 304 chrome.exe 36 PID 304 wrote to memory of 1608 304 chrome.exe 36 PID 304 wrote to memory of 1608 304 chrome.exe 36 PID 304 wrote to memory of 1608 304 chrome.exe 36 PID 304 wrote to memory of 1608 304 chrome.exe 36 PID 304 wrote to memory of 1608 304 chrome.exe 36 PID 304 wrote to memory of 1608 304 chrome.exe 36
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\system32\cmd.execmd.exe /C start "Open file" "C:\Users\Admin\AppData\Roaming\.minecraft"2⤵PID:1252
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4741⤵
- Suspicious use of AdjustPrivilegeToken
PID:664
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:304 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5f34f50,0x7fef5f34f60,0x7fef5f34f702⤵PID:880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1064 /prefetch:22⤵PID:960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1292 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1764 /prefetch:82⤵PID:1608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2088 /prefetch:12⤵PID:520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:12⤵PID:1792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵PID:2152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3300 /prefetch:22⤵PID:2228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1412 /prefetch:12⤵PID:2272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3524 /prefetch:82⤵PID:2352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3536 /prefetch:82⤵PID:2360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3728 /prefetch:82⤵PID:2368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3836 /prefetch:82⤵PID:2404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3904 /prefetch:82⤵PID:2500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3892 /prefetch:82⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3876 /prefetch:82⤵PID:2516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3672 /prefetch:82⤵PID:2532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3692 /prefetch:82⤵PID:2524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4076 /prefetch:82⤵PID:2552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3684 /prefetch:82⤵PID:2540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4144 /prefetch:82⤵PID:2568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4112 /prefetch:82⤵PID:2560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4508 /prefetch:82⤵PID:2584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1052,8512329403083229946,15324482322550161085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4492 /prefetch:82⤵PID:2576
-