Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

LauncherFe...ft.jar

windows7-x64

1

LauncherFe...ft.jar

windows10-2004-x64

1

Resubmissions

27/12/2022, 23:39 UTC

221227-3nclsabh7y 1

27/12/2022, 23:35 UTC

221227-3k3c2agg92 6

27/12/2022, 23:31 UTC

221227-3hqw8abh6x 4

Analysis

  • max time kernel
    49s
  • max time network
    51s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27/12/2022, 23:39 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    LauncherFenix-Minecraft.jar

  • Size

    56KB

  • MD5

    7a61030e60da59eb48d5430a175c38d3

  • SHA1

    e21779e2d453397c6a2bbc6090ac49de8f0fe1ea

  • SHA256

    2e33e36c9517efe86251a2f4294d822b55f344d189c9606189757f4ad17af38e

  • SHA512

    27b143872d411088186fdf8178d3c05710795ceffbe75f227469025d309f845c4db3ad91aad0fce1b01671ef271b9bf0445d083d3c5008af2b8daf688e81320a

  • SSDEEP

    1536:Fqv6lGMWvA34iBJZd8HJa3SUwxq7R83taXb:EvXMUA3bJZdwJjU3F1Xb

Score
1/10

Malware Config

Signatures

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Windows\system32\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft.jar
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:828

Network

  • flag-unknown
    DNS
    www.dropbox.com
    java.exe
    Remote address:
    8.8.8.8:53
    Request
    www.dropbox.com
    IN A
    Response
    www.dropbox.com
    IN CNAME
    www-env.dropbox-dns.com
    www-env.dropbox-dns.com
    IN A
    162.125.8.18
  • flag-unknown
    DNS
    files.launcherfenix.com.ar
    java.exe
    Remote address:
    8.8.8.8:53
    Request
    files.launcherfenix.com.ar
    IN A
    Response
    files.launcherfenix.com.ar
    IN A
    104.21.72.175
    files.launcherfenix.com.ar
    IN A
    172.67.153.84
  • flag-unknown
    DNS
    launchermeta.mojang.com
    java.exe
    Remote address:
    8.8.8.8:53
    Request
    launchermeta.mojang.com
    IN A
    Response
    launchermeta.mojang.com
    IN CNAME
    launcher-meta-cdn.azureedge.net
    launcher-meta-cdn.azureedge.net
    IN CNAME
    launcher-meta-cdn.afd.azureedge.net
    launcher-meta-cdn.afd.azureedge.net
    IN CNAME
    star-azureedge-prod.trafficmanager.net
    star-azureedge-prod.trafficmanager.net
    IN CNAME
    shed.dual-low.part-0039.t-0009.fdv2-t-msedge.net
    shed.dual-low.part-0039.t-0009.fdv2-t-msedge.net
    IN CNAME
    part-0039.t-0009.fdv2-t-msedge.net
    part-0039.t-0009.fdv2-t-msedge.net
    IN A
    13.107.237.67
    part-0039.t-0009.fdv2-t-msedge.net
    IN A
    13.107.238.67
  • flag-unknown
    DNS
    profile.launcherfenix.com.ar
    java.exe
    Remote address:
    8.8.8.8:53
    Request
    profile.launcherfenix.com.ar
    IN A
    Response
    profile.launcherfenix.com.ar
    IN A
    172.67.153.84
    profile.launcherfenix.com.ar
    IN A
    104.21.72.175
  • flag-unknown
    DNS
    iniciolauncherfx.tumblr.com
    java.exe
    Remote address:
    8.8.8.8:53
    Request
    iniciolauncherfx.tumblr.com
    IN A
    Response
    iniciolauncherfx.tumblr.com
    IN A
    74.114.154.22
    iniciolauncherfx.tumblr.com
    IN A
    74.114.154.18
  • flag-unknown
    GET
    http://iniciolauncherfx.tumblr.com/
    java.exe
    Remote address:
    74.114.154.22:80
    Request
    GET / HTTP/1.1
    Accept-Language: en-us,en;q=0.5
    Accept-Encoding: gzip
    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/535.14 (KHTML, like Gecko) JavaFX/2.2 Safari/535.14
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Cache-Control: no-cache
    Pragma: no-cache
    Host: iniciolauncherfx.tumblr.com
    Connection: keep-alive
    Response
    HTTP/1.1 302 Found
    Server: openresty
    Date: Tue, 27 Dec 2022 23:39:54 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 0
    Connection: keep-alive
    X-Rid: 95849d0e125657d5e45e951162747765
    P3p: CP="Tumblr's privacy policy is available here: https://www.tumblr.com/policy/en/privacy"
    X-Frame-Options: deny
    X-Xss-Protection: 1; mode=block
    X-Content-Type-Options: nosniff
    Strict-Transport-Security: max-age=15552001
    Location: https://iniciolauncherfx.tumblr.com/
    X-UA-Compatible: IE=Edge,chrome=1
    X-UA-Device: desktop
    Vary: X-UA-Device, Accept
  • flag-unknown
    DNS
    assets.tumblr.com
    java.exe
    Remote address:
    8.8.8.8:53
    Request
    assets.tumblr.com
    IN A
    Response
    assets.tumblr.com
    IN A
    192.0.77.40
  • flag-unknown
    DNS
    px.srvcs.tumblr.com
    java.exe
    Remote address:
    8.8.8.8:53
    Request
    px.srvcs.tumblr.com
    IN A
    Response
    px.srvcs.tumblr.com
    IN A
    192.0.77.40
  • flag-unknown
    DNS
    static.tumblr.com
    java.exe
    Remote address:
    8.8.8.8:53
    Request
    static.tumblr.com
    IN A
    Response
    static.tumblr.com
    IN A
    192.0.77.40
  • 162.125.8.18:443
    www.dropbox.com
    tls
    java.exe
    408 B
     219 B
     5
    5
  • 162.125.8.18:443
    www.dropbox.com
    tls
    java.exe
    408 B
     219 B
     5
    5
  • 162.125.8.18:443
    www.dropbox.com
    tls
    java.exe
    408 B
     219 B
     5
    5
  • 104.21.72.175:443
    files.launcherfenix.com.ar
    tls
    java.exe
    4.6kB
     171.9kB
     82
    148
  • 13.107.237.67:443
    launchermeta.mojang.com
    tls
    java.exe
    354 B
     132 B
     3
    3
  • 74.114.154.22:80
    http://iniciolauncherfx.tumblr.com/
    http
    java.exe
    697 B
     1.3kB
     6
    5

    HTTP Request

    GET http://iniciolauncherfx.tumblr.com/

    HTTP Response

    302
  • 172.67.153.84:80
    profile.launcherfenix.com.ar
    java.exe
    190 B
     92 B
     4
    2
  • 74.114.154.22:443
    iniciolauncherfx.tumblr.com
    tls
    java.exe
    1.6kB
     16.1kB
     17
    19
  • 192.0.77.40:443
    assets.tumblr.com
    tls
    java.exe
    1.5kB
     6.8kB
     13
    12
  • 192.0.77.40:443
    assets.tumblr.com
    tls
    java.exe
    1.4kB
     6.5kB
     12
    10
  • 192.0.77.40:443
    px.srvcs.tumblr.com
    tls
    java.exe
    1.7kB
     7.0kB
     13
    14
  • 192.0.77.40:443
    px.srvcs.tumblr.com
    tls
    java.exe
    2.2kB
     7.0kB
     13
    14
  • 192.0.77.40:443
    static.tumblr.com
    tls
    java.exe
    1.5kB
     5.8kB
     12
    10
  • 8.8.8.8:53
    www.dropbox.com
    dns
    java.exe
    61 B
     111 B
     1
    1

    DNS Request

    www.dropbox.com

    DNS Response

    162.125.8.18

  • 8.8.8.8:53
    files.launcherfenix.com.ar
    dns
    java.exe
    72 B
     104 B
     1
    1

    DNS Request

    files.launcherfenix.com.ar

    DNS Response

    104.21.72.175
    172.67.153.84

  • 8.8.8.8:53
    launchermeta.mojang.com
    dns
    java.exe
    69 B
     304 B
     1
    1

    DNS Request

    launchermeta.mojang.com

    DNS Response

    13.107.237.67
    13.107.238.67

  • 8.8.8.8:53
    profile.launcherfenix.com.ar
    dns
    java.exe
    74 B
     106 B
     1
    1

    DNS Request

    profile.launcherfenix.com.ar

    DNS Response

    172.67.153.84
    104.21.72.175

  • 8.8.8.8:53
    iniciolauncherfx.tumblr.com
    dns
    java.exe
    73 B
     105 B
     1
    1

    DNS Request

    iniciolauncherfx.tumblr.com

    DNS Response

    74.114.154.22
    74.114.154.18

  • 8.8.8.8:53
    assets.tumblr.com
    dns
    java.exe
    63 B
     79 B
     1
    1

    DNS Request

    assets.tumblr.com

    DNS Response

    192.0.77.40

  • 8.8.8.8:53
    px.srvcs.tumblr.com
    dns
    java.exe
    65 B
     81 B
     1
    1

    DNS Request

    px.srvcs.tumblr.com

    DNS Response

    192.0.77.40

  • 8.8.8.8:53
    static.tumblr.com
    dns
    java.exe
    63 B
     79 B
     1
    1

    DNS Request

    static.tumblr.com

    DNS Response

    192.0.77.40

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/828-54-0x000007FEFB881000-0x000007FEFB883000-memory.dmp

    Filesize

    8KB

    Download

  • memory/828-64-0x0000000002210000-0x0000000005210000-memory.dmp

    Filesize

    48.0MB

    Download

  • memory/828-68-0x0000000000280000-0x000000000028A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/828-69-0x0000000000280000-0x000000000028A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/828-70-0x0000000001D80000-0x0000000001D8A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/828-71-0x0000000001D80000-0x0000000001D8A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/828-74-0x0000000002210000-0x0000000005210000-memory.dmp

    Filesize

    48.0MB

    Download

  • memory/828-75-0x0000000000280000-0x000000000028A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/828-76-0x0000000000280000-0x000000000028A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/828-77-0x0000000001D80000-0x0000000001D8A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/828-78-0x0000000001D80000-0x0000000001D8A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/828-79-0x0000000001D80000-0x0000000001D8A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/828-80-0x0000000001D80000-0x0000000001D8A000-memory.dmp

    Filesize

    40KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.