Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2023, 13:15

General

  • Target

    TLauncher-2.871-Installer-1.0.6.exe

  • Size

    23.7MB

  • MD5

    49fb0f13cdb8d7cad1487889b6becced

  • SHA1

    b71d98ec45e6f7314f0e33106485beef99b2ee7c

  • SHA256

    7e49e00be1992fbc4ac14f2e5e3c05dccadf8fba3c3936357d8df7f146f5f0a3

  • SHA512

    639fa23294556bf77080d420e7e1b5b7c07a8b1e93897c36a4f8e398c1c58de9b91636420102e68f6957c768793797728664e32dc38aa68315746882b4ebe1d9

  • SSDEEP

    393216:XX921sp/n85Pfs/dQETVlOBbpFEj9GZ1GphRqV56Hpk7IXOzDnKI17fyV5:XN8s18hHExiTI3qqHp6zvKcfyV5

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4308
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6.exe" "__IRCT:3" "__IRTSS:24870711" "__IRSID:S-1-5-21-2386679933-1492765628-3466841596-1000"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4304
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4804
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1840872" "__IRSID:S-1-5-21-2386679933-1492765628-3466841596-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:3748
      • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
        "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3352
        • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
          "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
          4⤵
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          PID:1828
  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
    "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:680
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:3928
  • C:\Windows\System32\GameBarPresenceWriter.exe
    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
    1⤵
      PID:2852
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2036
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
      1⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies registry class
      PID:4964

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

      Filesize

      50B

      MD5

      b7af85c553e4745a4fd62f2855bdd8f6

      SHA1

      4e0a1ac59c124e2589389d48c24ccced011a00f7

      SHA256

      7e23cd9a166f6e9d5916caadb1b34f26b67ccb5a5ceaaa9d9e72cf8cd2d1a20f

      SHA512

      a689a5797a39a1efdb5321ab258b8929e0eae6984cf05e59de0336f026308c7bf7bf16ab76840b25e1cd75d0f1a878f2f9a3c03676aaefc68646ed421d74f55c

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe

      Filesize

      1.8MB

      MD5

      aa4de04ccc16b74a4c2301da8d621ec1

      SHA1

      d05c6d8200f6e6b1283df82d24d687adc47d9664

      SHA256

      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

      SHA512

      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe

      Filesize

      1.8MB

      MD5

      aa4de04ccc16b74a4c2301da8d621ec1

      SHA1

      d05c6d8200f6e6b1283df82d24d687adc47d9664

      SHA256

      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

      SHA512

      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

      Filesize

      1.7MB

      MD5

      1bbf5dd0b6ca80e4c7c77495c3f33083

      SHA1

      e0520037e60eb641ec04d1e814394c9da0a6a862

      SHA256

      bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

      SHA512

      97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

      Filesize

      97KB

      MD5

      da1d0cd400e0b6ad6415fd4d90f69666

      SHA1

      de9083d2902906cacf57259cf581b1466400b799

      SHA256

      7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

      SHA512

      f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

      Filesize

      1.3MB

      MD5

      ec4efe0ebb80b619737bd26180cc76cc

      SHA1

      7fd72c0eb6bee289e4b2714cf1fb8c197754811b

      SHA256

      b1501df2280c557ad1535a504bd43c25611c168fd543008b7949c03b29e70547

      SHA512

      384ae150773cf07322c614459db9db98e1995f6b185579c7b56763ed0352e043f51d0e840f94ac3e832a1378452f090b68ee281c437b16da3762974723e64e1a

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

      Filesize

      1.3MB

      MD5

      ec4efe0ebb80b619737bd26180cc76cc

      SHA1

      7fd72c0eb6bee289e4b2714cf1fb8c197754811b

      SHA256

      b1501df2280c557ad1535a504bd43c25611c168fd543008b7949c03b29e70547

      SHA512

      384ae150773cf07322c614459db9db98e1995f6b185579c7b56763ed0352e043f51d0e840f94ac3e832a1378452f090b68ee281c437b16da3762974723e64e1a

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

      Filesize

      1.3MB

      MD5

      e801c5847f5f9d207db53aaaf5c6f3a2

      SHA1

      8e6818ce66555e2cca92e5c5f32551fb4a91645e

      SHA256

      196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

      SHA512

      303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

      Filesize

      1.3MB

      MD5

      e801c5847f5f9d207db53aaaf5c6f3a2

      SHA1

      8e6818ce66555e2cca92e5c5f32551fb4a91645e

      SHA256

      196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

      SHA512

      303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

    • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

      Filesize

      649B

      MD5

      a2e85b17fbfcf57ffe2216b9ff9b1c8f

      SHA1

      a8548ac0bed017749c75f03bef799c2139dda6cf

      SHA256

      e98db24fe072218a9b616f8104984ce6201930f7a817e396f1e5683161b02645

      SHA512

      c02b139f76239abeed2602993391893eb3c15397fb52a276a33921d835187d8b62146b616fdac9bf17ec748a3bc54f7d7049add6b23259a25d41d3392c80420f

    • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

      Filesize

      5.2MB

      MD5

      58e22c0ee91280156cdaadacac7acddb

      SHA1

      189c552c94a9b0ae0208763bca77f2801debc224

      SHA256

      765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

      SHA512

      9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

    • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

      Filesize

      5.2MB

      MD5

      58e22c0ee91280156cdaadacac7acddb

      SHA1

      189c552c94a9b0ae0208763bca77f2801debc224

      SHA256

      765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

      SHA512

      9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

    • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

      Filesize

      5.2MB

      MD5

      58e22c0ee91280156cdaadacac7acddb

      SHA1

      189c552c94a9b0ae0208763bca77f2801debc224

      SHA256

      765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

      SHA512

      9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

    • C:\Users\Admin\AppData\Roaming\.tlauncher\doubleRunningProtection.txt

      Filesize

      13B

      MD5

      22063664a925525ed91f694a74671ef7

      SHA1

      f7e5b12c1688793afda204c0bfddec457d16e55c

      SHA256

      f0629a1414d3bae92aecb3dcd6add697ba9e3d88fc18c01a24a97da4cef3e65b

      SHA512

      0722600549a511d8090ba49969a07a6962aee80251698e82dde033f5e8e599eef48dfddf0da0b9571d82a62300c4d0259681ab5bccb9be58f3860a8b3985cde0

    • C:\Users\Admin\AppData\Roaming\.tlauncher\tlauncher-2.0.properties

      Filesize

      51B

      MD5

      213a9044980c462074081c463525cc8b

      SHA1

      e169197ff455acfdc49a016f42fbfb1707d2602a

      SHA256

      3a1e84dba4dd42faeb51d2a895038c81b3c11e043efb9904de9e35b2c4931ee8

      SHA512

      ceef13d14e721bc6bc86dda683fdc5def4c5f2dee5cdc97af082a62cf2bb526475e4bef7d5e4d9423ec3866bc401765e064b9787d7ab37a67ea075aa6d9e17cc

    • memory/1828-178-0x0000000002A90000-0x0000000003A90000-memory.dmp

      Filesize

      16.0MB

    • memory/1828-167-0x0000000002A90000-0x0000000003A90000-memory.dmp

      Filesize

      16.0MB

    • memory/1828-179-0x0000000002A90000-0x0000000003A90000-memory.dmp

      Filesize

      16.0MB

    • memory/3748-152-0x0000000000FF0000-0x00000000013D8000-memory.dmp

      Filesize

      3.9MB

    • memory/3748-153-0x0000000000FF0000-0x00000000013D8000-memory.dmp

      Filesize

      3.9MB

    • memory/3928-199-0x0000000002680000-0x0000000003680000-memory.dmp

      Filesize

      16.0MB

    • memory/3928-198-0x0000000002680000-0x0000000003680000-memory.dmp

      Filesize

      16.0MB

    • memory/3928-202-0x0000000002680000-0x0000000003680000-memory.dmp

      Filesize

      16.0MB

    • memory/3928-201-0x0000000002680000-0x0000000003680000-memory.dmp

      Filesize

      16.0MB

    • memory/3928-200-0x0000000002680000-0x0000000003680000-memory.dmp

      Filesize

      16.0MB

    • memory/3928-191-0x0000000002680000-0x0000000003680000-memory.dmp

      Filesize

      16.0MB

    • memory/4304-140-0x0000000010000000-0x0000000010051000-memory.dmp

      Filesize

      324KB

    • memory/4304-137-0x0000000000AE0000-0x0000000000EC8000-memory.dmp

      Filesize

      3.9MB

    • memory/4304-159-0x0000000000AE0000-0x0000000000EC8000-memory.dmp

      Filesize

      3.9MB

    • memory/4304-141-0x0000000006E10000-0x0000000006E13000-memory.dmp

      Filesize

      12KB

    • memory/4304-142-0x0000000000AE0000-0x0000000000EC8000-memory.dmp

      Filesize

      3.9MB