Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
70s -
max time network
73s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01/02/2023, 08:03
Static task
static1
Behavioral task
behavioral1
Sample
TLauncher-2.871-Installer-1.0.6-global.exe
Resource
win7-20221111-en
General
-
Target
TLauncher-2.871-Installer-1.0.6-global.exe
-
Size
23.6MB
-
MD5
7a4472a78d0651e11d20aa08e43cc045
-
SHA1
aab1d5f80d7399ae2c1982201733be7681d100b1
-
SHA256
318df7404e6c4d5538a6d31997b95af52bbb8d40caf5553b3cbd9b1bc4f6db96
-
SHA512
c152c9d21b0615548173dcc61accb1a1afd5b6f98e6ec21f6a7119536397f07a54ad4087669716c3344dd338ce4f24cecf9989d472f65eaa18c87d496f23c681
-
SSDEEP
393216:gXQLpnUN/n8IPfs/dQETVlOBbpFEj9GZ1GphRqV56Hpk7IXOzDnKI17fyVS:ggLFUp8aHExiTI3qqHp6zvKcfyVS
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 1596 irsetup.exe 4952 AdditionalExecuteTL.exe 4288 irsetup.exe 4496 TLauncher.exe 3424 TLauncher.exe -
resource yara_rule behavioral2/files/0x0001000000022e0f-133.dat upx behavioral2/files/0x0001000000022e0f-134.dat upx behavioral2/memory/1596-137-0x0000000000990000-0x0000000000D78000-memory.dmp upx behavioral2/memory/1596-142-0x0000000000990000-0x0000000000D78000-memory.dmp upx behavioral2/files/0x000400000001e6ec-147.dat upx behavioral2/files/0x000400000001e6ec-148.dat upx behavioral2/memory/4288-151-0x0000000000F90000-0x0000000001378000-memory.dmp upx behavioral2/memory/4288-153-0x0000000000F90000-0x0000000001378000-memory.dmp upx behavioral2/memory/1596-158-0x0000000000990000-0x0000000000D78000-memory.dmp upx -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation TLauncher-2.871-Installer-1.0.6-global.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation irsetup.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation AdditionalExecuteTL.exe -
Loads dropped DLL 4 IoCs
pid Process 1596 irsetup.exe 1596 irsetup.exe 1596 irsetup.exe 4288 irsetup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb javaw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{F5F7F3B6-B267-42A1-8B9D-B6450A5FE91C} svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2432 OpenWith.exe -
Suspicious use of SetWindowsHookEx 19 IoCs
pid Process 1596 irsetup.exe 1596 irsetup.exe 1596 irsetup.exe 1596 irsetup.exe 1596 irsetup.exe 1596 irsetup.exe 1596 irsetup.exe 4952 AdditionalExecuteTL.exe 4288 irsetup.exe 4288 irsetup.exe 4288 irsetup.exe 4496 TLauncher.exe 4484 javaw.exe 4484 javaw.exe 1316 javaw.exe 1316 javaw.exe 1316 javaw.exe 1316 javaw.exe 2432 OpenWith.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4796 wrote to memory of 1596 4796 TLauncher-2.871-Installer-1.0.6-global.exe 81 PID 4796 wrote to memory of 1596 4796 TLauncher-2.871-Installer-1.0.6-global.exe 81 PID 4796 wrote to memory of 1596 4796 TLauncher-2.871-Installer-1.0.6-global.exe 81 PID 1596 wrote to memory of 4952 1596 irsetup.exe 89 PID 1596 wrote to memory of 4952 1596 irsetup.exe 89 PID 1596 wrote to memory of 4952 1596 irsetup.exe 89 PID 4952 wrote to memory of 4288 4952 AdditionalExecuteTL.exe 90 PID 4952 wrote to memory of 4288 4952 AdditionalExecuteTL.exe 90 PID 4952 wrote to memory of 4288 4952 AdditionalExecuteTL.exe 90 PID 1596 wrote to memory of 4496 1596 irsetup.exe 95 PID 1596 wrote to memory of 4496 1596 irsetup.exe 95 PID 1596 wrote to memory of 4496 1596 irsetup.exe 95 PID 4496 wrote to memory of 4484 4496 TLauncher.exe 96 PID 4496 wrote to memory of 4484 4496 TLauncher.exe 96 PID 3424 wrote to memory of 1316 3424 TLauncher.exe 104 PID 3424 wrote to memory of 1316 3424 TLauncher.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.871-Installer-1.0.6-global.exe" "__IRCT:3" "__IRTSS:24771453" "__IRSID:S-1-5-21-929662420-1054238289-2961194603-1000"2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\AdditionalExecuteTL.exe" "__IRCT:3" "__IRTSS:1840872" "__IRSID:S-1-5-21-929662420-1054238289-2961194603-1000"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4288
-
-
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"4⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4484
-
-
-
-
C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.minecraft\TLauncher.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:1316
-
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵PID:1976
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2432
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:2760
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD5b57553f8b73d02d6c9fc9a7073f44ee3
SHA17387b0cedc403cd263f9094084a51045ea82c6d1
SHA256e20afa23404ff31ffd55ad78d95c436eb2aefd45b7d2dd056d77c13a3f3204d6
SHA512bcbb25b02b188fd20bc3f1c6dcbc3a053cecaefc6a1892724f77298e2a5514b49d61ef5551ee4df6fd32573e291729fa1cbf6c6129bd55145792df11b1584712
-
Filesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
Filesize
1.8MB
MD5aa4de04ccc16b74a4c2301da8d621ec1
SHA1d05c6d8200f6e6b1283df82d24d687adc47d9664
SHA256e2b0c8e54983b6fcd847a891c5443cb321fb4f0c9106ec8ed6a37cab5ebcc81b
SHA51228d62bbe394bc2300d60263971cdee15fa417c6fcc7e44ecd2b3b567821e99953377383d137b0827f3f904d30deb508732bcb77cd37d444032d6ffc25c60712e
-
Filesize
1.7MB
MD51bbf5dd0b6ca80e4c7c77495c3f33083
SHA1e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA51297bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab
-
Filesize
97KB
MD5da1d0cd400e0b6ad6415fd4d90f69666
SHA1de9083d2902906cacf57259cf581b1466400b799
SHA2567a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a
-
Filesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
Filesize
1.3MB
MD57e08af319c9eb3297e09ca7bb8387de4
SHA14cf091f77a3eb9437ef33985e64bd10c1257284f
SHA2566c006c982746826a613bc0f09890955a1cdca309d9d98572aed35ad782dd11c8
SHA512bb7aaebd3f6c1ff18bd0cb9eb9347894f0785dc011ec9765d9bc180de9b60769c891151626fdef88aa3fd53ae6246c1cb91f723933da54920bfbc8a5a24f8851
-
Filesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
Filesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
Filesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
Filesize
1.3MB
MD5e801c5847f5f9d207db53aaaf5c6f3a2
SHA18e6818ce66555e2cca92e5c5f32551fb4a91645e
SHA256196eb4b81988326f6b44b1efcc4fa7a31a289bcf3893a16c3db6f889aa439b03
SHA512303ab54112fd38a36c10484037f8ff4eeadd0c6f7dde18cf4f3b7f64bf7f7756b30f634427be1cf596ec995f41923c8678040a9a06244129f2337a3fe2f9bab3
-
Filesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
Filesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
Filesize
648B
MD51fa896b035b176cf695bc243ced0a2b1
SHA195e086e6dd6e79280cb232d0326eed47be534a22
SHA256063647f1611dcc33bc6fb9f9011f6878b6b37dc75ee595413aa9a655a65f65ae
SHA512b05bdc3f1576b5ed7d9497ef3280058d6755f054f014dc4f181b692f62ea1f96d13d957e99bc73132266a9c03c53295dc84828b5d197cc9d8b2d2583d11c0257
-
Filesize
5.2MB
MD558e22c0ee91280156cdaadacac7acddb
SHA1189c552c94a9b0ae0208763bca77f2801debc224
SHA256765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714
SHA5129f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6
-
Filesize
5.2MB
MD558e22c0ee91280156cdaadacac7acddb
SHA1189c552c94a9b0ae0208763bca77f2801debc224
SHA256765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714
SHA5129f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6
-
Filesize
5.2MB
MD558e22c0ee91280156cdaadacac7acddb
SHA1189c552c94a9b0ae0208763bca77f2801debc224
SHA256765cab48564743844b057e21eab768d5d84194a635b09d02d9d2909f632f5714
SHA5129f510c896d641919b037e201f5ba9de476241e7cab1004d92a85df4b9240ff947737619921b1223cd926c8c5a6e667dc76cad37e818d2a9d144b826836d562c6
-
Filesize
13B
MD5cb2c98c12474af104a69423c0810a085
SHA16f256f7d0e297605feef569b0c47a30864545cdb
SHA256eabc7e08c1d5089c81d17cf37da83a04d0f2bc55c40941c6ecd96a811a178fa1
SHA512c6a84fb0782d63b4122e3bc8c120b7886361e8e380bdaa06d5e1269e14197b88bd712d28afc28e212109977d6af751b589cbbb637281c47e5e09078cef92bd0c
-
Filesize
51B
MD5d6e175aa92e9c75e056f719591d6f03f
SHA1b4c173218c99ac32087b850ff23d30552e4f5ee4
SHA256a53c1cbc9ff02ca5ed524f7c5b6ad15d6884e78c1018256bdc5c929e97f77bc2
SHA512c3fd1c6620cb9c4d8fabb283af530129a1f5b431eb051f8142761063043601a2f35fc2b54717fb046f2e9a70ea288a0f7d23cb97cf12e4a3bbc7200df124a9ca