Analysis
-
max time kernel
137s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-01-2023 11:50
Static task
static1
Behavioral task
behavioral1
Sample
TLauncher-2.871-Installer-1.0.6-global.exe
Resource
win7-20220812-en
General
-
Target
TLauncher-2.871-Installer-1.0.6-global.exe
-
Size
23.6MB
-
MD5
7a4472a78d0651e11d20aa08e43cc045
-
SHA1
aab1d5f80d7399ae2c1982201733be7681d100b1
-
SHA256
318df7404e6c4d5538a6d31997b95af52bbb8d40caf5553b3cbd9b1bc4f6db96
-
SHA512
c152c9d21b0615548173dcc61accb1a1afd5b6f98e6ec21f6a7119536397f07a54ad4087669716c3344dd338ce4f24cecf9989d472f65eaa18c87d496f23c681
-
SSDEEP
393216:gXQLpnUN/n8IPfs/dQETVlOBbpFEj9GZ1GphRqV56Hpk7IXOzDnKI17fyVS:ggLFUp8aHExiTI3qqHp6zvKcfyVS
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
irsetup.exeAdditionalExecuteTL.exeirsetup.exeTLauncher.exepid process 856 irsetup.exe 2512 AdditionalExecuteTL.exe 2568 irsetup.exe 2844 TLauncher.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx behavioral1/memory/856-67-0x00000000001C0000-0x00000000005A8000-memory.dmp upx behavioral1/memory/856-72-0x00000000001C0000-0x00000000005A8000-memory.dmp upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe upx behavioral1/memory/2568-94-0x0000000000E50000-0x0000000001238000-memory.dmp upx behavioral1/memory/2568-101-0x0000000000E50000-0x0000000001238000-memory.dmp upx behavioral1/memory/856-102-0x00000000001C0000-0x00000000005A8000-memory.dmp upx -
Loads dropped DLL 19 IoCs
Processes:
TLauncher-2.871-Installer-1.0.6-global.exeirsetup.exeAdditionalExecuteTL.exeirsetup.exepid process 1520 TLauncher-2.871-Installer-1.0.6-global.exe 1520 TLauncher-2.871-Installer-1.0.6-global.exe 1520 TLauncher-2.871-Installer-1.0.6-global.exe 1520 TLauncher-2.871-Installer-1.0.6-global.exe 856 irsetup.exe 856 irsetup.exe 856 irsetup.exe 856 irsetup.exe 856 irsetup.exe 856 irsetup.exe 856 irsetup.exe 856 irsetup.exe 2512 AdditionalExecuteTL.exe 2512 AdditionalExecuteTL.exe 2512 AdditionalExecuteTL.exe 2512 AdditionalExecuteTL.exe 2568 irsetup.exe 2568 irsetup.exe 2568 irsetup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Processes:
iexplore.exeIEXPLORE.EXEirsetup.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3BDD5BF1-9CAF-11ED-9F1A-42A98B637845} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0730b14bc30d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main irsetup.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004728d7d8b8195d47a0fac26ebcc077e60000000002000000000010660000000100002000000013c0857efab7de95e9861d52a435ed26ad2671e1a11c63b3197731518ead0436000000000e8000000002000020000000e98edca05fc75ce290921da962823685c3941c8ed57334f34bf30eb5e242c53090000000bcf20639e2b168f13cfe0d06e1123919721b2f73dd68be3e6e7ab011b04d368ff73947bf8c38d105ad63b142cb18114afe762b5b4e486ff0912f52368846227629a18371ccd9eeb6f87dfc60cb0a746be64da660f94bcbf5e26436061e8bf74d1a6931269add4da773c8c61d3a9f6ed6d5a790a479bfb501abe73868db3979bcb7e78011ec8b47904c21decd3f53ef64400000002e0c02add662cd35e2eeb888c414ca3497f006c80f310fdadb5735533db6832351f349cb56000f94de15917fda048721b73b4e1d8fbadd549d5254fce116de09 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004728d7d8b8195d47a0fac26ebcc077e6000000000200000000001066000000010000200000006aa954f3bc86d4e16cbf2832be6eceabc6107afadbc3fbe84774a165d4518548000000000e800000000200002000000006cd8cc9b1f92b0b6b00cbae69ebe2dce13b3a92ca4b809197d8686500b2a2c2200000005c0d721403a3fff8a0b51c4b39c66e75be61228b7a3b0fe6e795eee1b2fc442640000000194d917700092d952e1199a440701175861e641546467a9b818c509ca38cb3906a5e870e97d28015aeb0456eae623c38f3d76a570582ae8acf76263690b81094 iexplore.exe -
Modifies registry class 2 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache firefox.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 868 firefox.exe Token: SeDebugPrivilege 868 firefox.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
Processes:
firefox.exeiexplore.exepid process 868 firefox.exe 868 firefox.exe 868 firefox.exe 868 firefox.exe 2872 iexplore.exe 868 firefox.exe 868 firefox.exe -
Suspicious use of SendNotifyMessage 5 IoCs
Processes:
firefox.exepid process 868 firefox.exe 868 firefox.exe 868 firefox.exe 868 firefox.exe 868 firefox.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
irsetup.exeirsetup.exeiexplore.exeIEXPLORE.EXEpid process 856 irsetup.exe 856 irsetup.exe 856 irsetup.exe 856 irsetup.exe 856 irsetup.exe 856 irsetup.exe 2568 irsetup.exe 2568 irsetup.exe 2872 iexplore.exe 2872 iexplore.exe 2928 IEXPLORE.EXE 2928 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
TLauncher-2.871-Installer-1.0.6-global.exefirefox.exefirefox.exedescription pid process target process PID 1520 wrote to memory of 856 1520 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 1520 wrote to memory of 856 1520 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 1520 wrote to memory of 856 1520 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 1520 wrote to memory of 856 1520 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 1520 wrote to memory of 856 1520 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 1520 wrote to memory of 856 1520 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 1520 wrote to memory of 856 1520 TLauncher-2.871-Installer-1.0.6-global.exe irsetup.exe PID 780 wrote to memory of 868 780 firefox.exe firefox.exe PID 780 wrote to memory of 868 780 firefox.exe firefox.exe PID 780 wrote to memory of 868 780 firefox.exe firefox.exe PID 780 wrote to memory of 868 780 firefox.exe firefox.exe PID 780 wrote to memory of 868 780 firefox.exe firefox.exe PID 780 wrote to memory of 868 780 firefox.exe firefox.exe PID 780 wrote to memory of 868 780 firefox.exe firefox.exe PID 780 wrote to memory of 868 780 firefox.exe firefox.exe PID 780 wrote to memory of 868 780 firefox.exe firefox.exe PID 780 wrote to memory of 868 780 firefox.exe firefox.exe PID 868 wrote to memory of 1136 868 firefox.exe firefox.exe PID 868 wrote to memory of 1136 868 firefox.exe firefox.exe PID 868 wrote to memory of 1136 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe PID 868 wrote to memory of 1924 868 firefox.exe firefox.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe" "__IRCT:3" "__IRTSS:24771453" "__IRSID:S-1-5-21-2292972927-2705560509-2768824231-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1840872" "__IRSID:S-1-5-21-2292972927-2705560509-2768824231-1000"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="868.0.2051261042\785331634" -parentBuildID 20200403170909 -prefsHandle 1196 -prefMapHandle 1188 -prefsLen 1 -prefMapSize 220106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 868 "\\.\pipe\gecko-crash-server-pipe.868" 1300 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="868.3.266911516\1270929834" -childID 1 -isForBrowser -prefsHandle 1752 -prefMapHandle 1660 -prefsLen 156 -prefMapSize 220106 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 868 "\\.\pipe\gecko-crash-server-pipe.868" 1576 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="868.13.488697707\956023299" -childID 2 -isForBrowser -prefsHandle 2640 -prefMapHandle 2636 -prefsLen 6938 -prefMapSize 220106 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 868 "\\.\pipe\gecko-crash-server-pipe.868" 2652 tab3⤵
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://java-for-minecraft.com/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
340B
MD5c212dbbb1fa75f555b09de9f9a939d85
SHA10683225fdc6a0ba564ac370dc95b360c7c09645e
SHA256e49c52acdf39352b5f0e8e8650b73094a975a3946935800fe95120bccf029f03
SHA512cc5a0289cd0de7c6c7b25b2f53e81918e085e8c59e8bbc7e2aaa3bc50a538997a4d5736b519933dcaa7218a87138a8081caae310146a64b1131dcc830fde7761
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lwrmjt1\imagestore.datFilesize
32KB
MD5f11b8d3735c04221978ffb83b6056cda
SHA15152029c667fefa8a658b056f3c51873a80cf5a9
SHA256a4a038e3e44901a985f8d44a684fcd95ce5530a2a80f1903994e480c1dd51589
SHA5121c8f8953ec39963ae769e566cd9571cc34bb8d1c8f41e99e191443999c64d18fc4e3cd530047d721733a4327ab3912afde5fd5a4535fd56f3f67a493b88b9ab8
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dllFilesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dllFilesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
C:\Users\Admin\AppData\Local\Temp\setuparguments.iniFilesize
603B
MD5c62a8c5f62bc23752ff590cba5fc98ef
SHA146e8d03de139e8974e7fb94bcc762eeeaa7c3991
SHA256f83dbdbc3166c5b04b198f42651f3b7d6385c5c48cd16acc0a52176e9eaec8d4
SHA51242fa775e4fb2e6e24c3dbe6804c544ef1b845418070b25bfd228d8c03b664a0bc9dec52b5f0b8c4acfd1365e4811cffc3a27597395c8dab036f0efe174444b94
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exeFilesize
5.2MB
MD558e22c0ee91280156cdaadacac7acddb
SHA1189c552c94a9b0ae0208763bca77f2801debc224
SHA256765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714
SHA5129f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exeFilesize
5.2MB
MD558e22c0ee91280156cdaadacac7acddb
SHA1189c552c94a9b0ae0208763bca77f2801debc224
SHA256765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714
SHA5129f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exeFilesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmdFilesize
1.7MB
MD51bbf5dd0b6ca80e4c7c77495c3f33083
SHA1e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA51297bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmdFilesize
97KB
MD5da1d0cd400e0b6ad6415fd4d90f69666
SHA1de9083d2902906cacf57259cf581b1466400b799
SHA2567a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeFilesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dllFilesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exeFilesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dllFilesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
memory/856-88-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/856-70-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/856-72-0x00000000001C0000-0x00000000005A8000-memory.dmpFilesize
3.9MB
-
memory/856-67-0x00000000001C0000-0x00000000005A8000-memory.dmpFilesize
3.9MB
-
memory/856-59-0x0000000000000000-mapping.dmp
-
memory/856-102-0x00000000001C0000-0x00000000005A8000-memory.dmpFilesize
3.9MB
-
memory/856-71-0x0000000000800000-0x0000000000803000-memory.dmpFilesize
12KB
-
memory/856-99-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/1520-66-0x0000000002A30000-0x0000000002E18000-memory.dmpFilesize
3.9MB
-
memory/1520-65-0x0000000002A30000-0x0000000002E18000-memory.dmpFilesize
3.9MB
-
memory/1520-54-0x0000000074D61000-0x0000000074D63000-memory.dmpFilesize
8KB
-
memory/2512-91-0x0000000002B70000-0x0000000002F58000-memory.dmpFilesize
3.9MB
-
memory/2512-100-0x0000000002B70000-0x0000000002F58000-memory.dmpFilesize
3.9MB
-
memory/2512-93-0x0000000002B70000-0x0000000002F58000-memory.dmpFilesize
3.9MB
-
memory/2512-78-0x0000000000000000-mapping.dmp
-
memory/2568-101-0x0000000000E50000-0x0000000001238000-memory.dmpFilesize
3.9MB
-
memory/2568-94-0x0000000000E50000-0x0000000001238000-memory.dmpFilesize
3.9MB
-
memory/2568-86-0x0000000000000000-mapping.dmp