Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

01/02/2023, 08:03

230201-jx7zhaec6y 8

01/02/2023, 08:02

230201-jw8veacd94 8

Analysis

  • max time kernel
    70s
  • max time network
    73s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/02/2023, 08:03

General

  • Target

    TLauncher-2.871-Installer-1.0.6-global.exe

  • Size

    23.6MB

  • MD5

    7a4472a78d0651e11d20aa08e43cc045

  • SHA1

    aab1d5f80d7399ae2c1982201733be7681d100b1

  • SHA256

    318df7404e6c4d5538a6d31997b95af52bbb8d40caf5553b3cbd9b1bc4f6db96

  • SHA512

    c152c9d21b0615548173dcc61accb1a1afd5b6f98e6ec21f6a7119536397f07a54ad4087669716c3344dd338ce4f24cecf9989d472f65eaa18c87d496f23c681

  • SSDEEP

    393216:gXQLpnUN/n8IPfs/dQETVlOBbpFEj9GZ1GphRqV56Hpk7IXOzDnKI17fyVS:ggLFUp8aHExiTI3qqHp6zvKcfyVS

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4796
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe" "__IRCT:3" "__IRTSS:24771453" "__IRSID:S-1-5-21-929662420-1054238289-2961194603-1000"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1596
      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe
        "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4952
        • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1840872" "__IRSID:S-1-5-21-929662420-1054238289-2961194603-1000"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:4288
      • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
        "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4496
        • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
          "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
          4⤵
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          PID:4484
  • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe
    "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3424
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1316
  • C:\Windows\System32\GameBarPresenceWriter.exe
    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
    1⤵
      PID:1976
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2432
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
      1⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies registry class
      PID:2760

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

      Filesize

      50B

      MD5

      b57553f8b73d02d6c9fc9a7073f44ee3

      SHA1

      7387b0cedc403cd263f9094084a51045ea82c6d1

      SHA256

      e20afa23404ff31ffd55ad78d95c436eb2aefd45b7d2dd056d77c13a3f3204d6

      SHA512

      bcbb25b02b188fd20bc3f1c6dcbc3a053cecaefc6a1892724f77298e2a5514b49d61ef5551ee4df6fd32573e291729fa1cbf6c6129bd55145792df11b1584712

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe

      Filesize

      1.8MB

      MD5

      aa4de04ccc16b74a4c2301da8d621ec1

      SHA1

      d05c6d8200f6e6b1283df82d24d687adc47d9664

      SHA256

      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

      SHA512

      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe

      Filesize

      1.8MB

      MD5

      aa4de04ccc16b74a4c2301da8d621ec1

      SHA1

      d05c6d8200f6e6b1283df82d24d687adc47d9664

      SHA256

      e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b

      SHA512

      28d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

      Filesize

      1.7MB

      MD5

      1bbf5dd0b6ca80e4c7c77495c3f33083

      SHA1

      e0520037e60eb641ec04d1e814394c9da0a6a862

      SHA256

      bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

      SHA512

      97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

      Filesize

      97KB

      MD5

      da1d0cd400e0b6ad6415fd4d90f69666

      SHA1

      de9083d2902906cacf57259cf581b1466400b799

      SHA256

      7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

      SHA512

      f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

      Filesize

      1.3MB

      MD5

      7e08af319c9eb3297e09ca7bb8387de4

      SHA1

      4cf091f77a3eb9437ef33985e64bd10c1257284f

      SHA256

      6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

      SHA512

      bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

      Filesize

      1.3MB

      MD5

      7e08af319c9eb3297e09ca7bb8387de4

      SHA1

      4cf091f77a3eb9437ef33985e64bd10c1257284f

      SHA256

      6c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8

      SHA512

      bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

      Filesize

      1.3MB

      MD5

      e801c5847f5f9d207db53aaaf5c6f3a2

      SHA1

      8e6818ce66555e2cca92e5c5f32551fb4a91645e

      SHA256

      196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

      SHA512

      303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

      Filesize

      1.3MB

      MD5

      e801c5847f5f9d207db53aaaf5c6f3a2

      SHA1

      8e6818ce66555e2cca92e5c5f32551fb4a91645e

      SHA256

      196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03

      SHA512

      303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll

      Filesize

      326KB

      MD5

      80d93d38badecdd2b134fe4699721223

      SHA1

      e829e58091bae93bc64e0c6f9f0bac999cfda23d

      SHA256

      c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

      SHA512

      9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

    • C:\Users\Admin\AppData\Local\Temp\setuparguments.ini

      Filesize

      648B

      MD5

      1fa896b035b176cf695bc243ced0a2b1

      SHA1

      95e086e6dd6e79280cb232d0326eed47be534a22

      SHA256

      063647f1611dcc33bc6fb9f9011f6878b6b37dc75ee595413aa9a655a65f65ae

      SHA512

      b05bdc3f1576b5ed7d9497ef3280058d6755f054f014dc4f181b692f62ea1f96d13d957e99bc73132266a9c03c53295dc84828b5d197cc9d8b2d2583d11c0257

    • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

      Filesize

      5.2MB

      MD5

      58e22c0ee91280156cdaadacac7acddb

      SHA1

      189c552c94a9b0ae0208763bca77f2801debc224

      SHA256

      765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

      SHA512

      9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

    • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

      Filesize

      5.2MB

      MD5

      58e22c0ee91280156cdaadacac7acddb

      SHA1

      189c552c94a9b0ae0208763bca77f2801debc224

      SHA256

      765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

      SHA512

      9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

    • C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe

      Filesize

      5.2MB

      MD5

      58e22c0ee91280156cdaadacac7acddb

      SHA1

      189c552c94a9b0ae0208763bca77f2801debc224

      SHA256

      765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714

      SHA512

      9f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6

    • C:\Users\Admin\AppData\Roaming\.tlauncher\doubleRunningProtection.txt

      Filesize

      13B

      MD5

      cb2c98c12474af104a69423c0810a085

      SHA1

      6f256f7d0e297605feef569b0c47a30864545cdb

      SHA256

      eabc7e08c1d5089c81d17cf37da83a04d0f2bc55c40941c6ecd96a811a178fa1

      SHA512

      c6a84fb0782d63b4122e3bc8c120b7886361e8e380bdaa06d5e1269e14197b88bd712d28afc28e212109977d6af751b589cbbb637281c47e5e09078cef92bd0c

    • C:\Users\Admin\AppData\Roaming\.tlauncher\tlauncher-2.0.properties

      Filesize

      51B

      MD5

      d6e175aa92e9c75e056f719591d6f03f

      SHA1

      b4c173218c99ac32087b850ff23d30552e4f5ee4

      SHA256

      a53c1cbc9ff02ca5ed524f7c5b6ad15d6884e78c1018256bdc5c929e97f77bc2

      SHA512

      c3fd1c6620cb9c4d8fabb283af530129a1f5b431eb051f8142761063043601a2f35fc2b54717fb046f2e9a70ea288a0f7d23cb97cf12e4a3bbc7200df124a9ca

    • memory/1316-201-0x0000000002750000-0x0000000003750000-memory.dmp

      Filesize

      16.0MB

    • memory/1316-203-0x0000000002750000-0x0000000003750000-memory.dmp

      Filesize

      16.0MB

    • memory/1316-204-0x0000000002750000-0x0000000003750000-memory.dmp

      Filesize

      16.0MB

    • memory/1316-207-0x0000000002750000-0x0000000003750000-memory.dmp

      Filesize

      16.0MB

    • memory/1316-193-0x0000000002750000-0x0000000003750000-memory.dmp

      Filesize

      16.0MB

    • memory/1316-208-0x0000000002750000-0x0000000003750000-memory.dmp

      Filesize

      16.0MB

    • memory/1596-142-0x0000000000990000-0x0000000000D78000-memory.dmp

      Filesize

      3.9MB

    • memory/1596-137-0x0000000000990000-0x0000000000D78000-memory.dmp

      Filesize

      3.9MB

    • memory/1596-140-0x0000000010000000-0x0000000010051000-memory.dmp

      Filesize

      324KB

    • memory/1596-141-0x0000000006380000-0x0000000006383000-memory.dmp

      Filesize

      12KB

    • memory/1596-158-0x0000000000990000-0x0000000000D78000-memory.dmp

      Filesize

      3.9MB

    • memory/4288-151-0x0000000000F90000-0x0000000001378000-memory.dmp

      Filesize

      3.9MB

    • memory/4288-153-0x0000000000F90000-0x0000000001378000-memory.dmp

      Filesize

      3.9MB

    • memory/4484-179-0x00000000024C0000-0x00000000034C0000-memory.dmp

      Filesize

      16.0MB

    • memory/4484-168-0x00000000024C0000-0x00000000034C0000-memory.dmp

      Filesize

      16.0MB

    • memory/4484-175-0x00000000024C0000-0x00000000034C0000-memory.dmp

      Filesize

      16.0MB

    • memory/4484-171-0x00000000024C0000-0x00000000034C0000-memory.dmp

      Filesize

      16.0MB