Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
31/01/2023, 04:39
Static task
static1
Behavioral task
behavioral1
Sample
Old-TLauncher.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Old-TLauncher.exe
Resource
win10v2004-20230221-en
General
-
Target
Old-TLauncher.exe
-
Size
4.1MB
-
MD5
f592e97f080ae5d323cc0ce2a329a949
-
SHA1
fe998bf6f2f5321af9f756a7a06a01290a97c55a
-
SHA256
5a00afa820039b55d570d5cbdae0ce1167272d314592ad9e951257755ea5bac7
-
SHA512
21b7e4699b357c174288defcae979ad20fbfe83ce56becfeaf44f27fb509c562962a0b61c3d70cb67b07342a393c77547ccbb83d1687cc36a1669151d2fe780b
-
SSDEEP
49152:hoQlo2tuEXgq23ttxCpG7szUMS2h07cNF+zNCkweZQT/nmDHYkmMhOq2zSxxAy:hoh20Jq23ttxH7szY2y7G+zszcv7oy
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1572 javaw.exe 1572 javaw.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2508 wrote to memory of 1572 2508 Old-TLauncher.exe 82 PID 2508 wrote to memory of 1572 2508 Old-TLauncher.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\Old-TLauncher.exe"C:\Users\Admin\AppData\Local\Temp\Old-TLauncher.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Old-TLauncher.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:1572
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\aopalliance\aopalliance\1.0\aopalliance-1.0.jar.tlauncherdownload
Filesize4KB
MD504177054e180d09e3998808efa0401c7
SHA10235ba8b489512805ac13a8f9ea77a1ca5ebe3e8
SHA2560addec670fedcd3f113c5c8091d783280d23f75e3acb841b61a9cdb079376a08
SHA5123f44a932d8c00cfeee2eb057bcd7c301a2d029063e0a916e1e20b3aec4877d19d67a2fd8aaf58fa2d5a00133d1602128a7f50912ffb6cabc7b0fdc7fbda3f8a1
-
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\com\google\inject\guice\4.1.0\guice-4.1.0.jar
Filesize658KB
MD541f66d1d4d250efebde3bbf8b2d55dfa
SHA1eeb69005da379a10071aa4948c48d89250febb07
SHA2569b9df27a5b8c7864112b4137fd92b36c3f1395bfe57be42fedf2f520ead1a93e
SHA512109a1595668293b32376e885ad59e0e4c0e088ea00f58119f0f7d0d2055f03eb93a9f92d974b6dbd56ef721792ac03c889d9add3a2850aa7ccd732c2682d17ef
-
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\javax\inject\javax.inject\1\javax.inject-1.jar
Filesize2KB
MD5289075e48b909e9e74e6c915b3631d2e
SHA16975da39a7040257bd51d21a231b76c915872d38
SHA25691c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff
SHA512e126b7ccf3e42fd1984a0beef1004a7269a337c202e59e04e8e2af714280d2f2d8d2ba5e6f59481b8dcd34aaf35c966a688d0b48ec7e96f102c274dc0d3b381e
-
Filesize
478KB
MD504a41f0a068986f0f73485cf507c0f40
SHA15af35056b4d257e4b64b9e8069c0746e8b08629f
SHA2561d31696445697720527091754369082a6651bd49781b6005deb94e56753406f9
SHA5123f12937a69ba60d0f5e86265168d6a0d069ce20d95b99a3ace463987655e7c63053f4d7e36e32f2b53f86992b888ca477bf81253ad04c721896b397f94ee57fc
-
C:\Users\Admin\AppData\Roaming\.minecraft\tlauncher_libraries\net\sf\jopt-simple\jopt-simple\4.9\jopt-simple-4.9.jar.tlauncherdownload
Filesize64KB
MD539c6476e4de3d4f90ad4ca0ddca48ec2
SHA1ee9e9eaa0a35360dcfeac129ff4923215fd65904
SHA25626c5856e954b5f864db76f13b86919b59c6eecf9fd930b96baa8884626baf2f5
SHA512fd04c19bce810a1548b2d2eaadb915cff2cbc81a81ec5258aafc1ba329100daedc49edad1fc7b254ab892996796124283d7004b5414f662c0efa3979add9ca5f