Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    55s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02/02/2023, 21:55

General

  • Target

    LauncherFenix-Minecraft-v7.exe

  • Size

    397KB

  • MD5

    d99bb55b57712065bc88be297c1da38c

  • SHA1

    fb6662dd31e8e5be380fbd7a33a50a45953fe1e7

  • SHA256

    122bfbb9f67e355340991deeacb167be9c12ad726b5a7c5779448dd0cc4af0cb

  • SHA512

    3eb5d57faea4c0146c2af40102deaac18235b379f5e81fe35a977b642e3edf70704c8cedd835e94f27b04c8413968f7469fccf82c1c9339066d38d3387c71b17

  • SSDEEP

    3072:puzvch1rugYc4wqYSRR756K7ItBjgXHUYCnlK:Wch1aIqYSRVM+unlK

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe
    "C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:2804
  • C:\Windows\System32\GameBarPresenceWriter.exe
    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
    1⤵
      PID:3908
    • C:\Windows\System32\GamePanel.exe
      "C:\Windows\System32\GamePanel.exe" 000000000004013E /startuptips
      1⤵
      • Checks SCSI registry key(s)
      PID:4892
    • C:\Windows\System32\bcastdvr.exe
      "C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer
      1⤵
      • Drops desktop.ini file(s)
      PID:1332

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Videos\Captures\desktop.ini

      Filesize

      190B

      MD5

      b0d27eaec71f1cd73b015f5ceeb15f9d

      SHA1

      62264f8b5c2f5034a1e4143df6e8c787165fbc2f

      SHA256

      86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

      SHA512

      7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

    • memory/2444-120-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-121-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-122-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-123-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-124-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-125-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-126-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-127-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-128-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-129-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-130-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-131-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-132-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-133-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-134-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-135-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-136-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-137-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-138-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-139-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-140-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-141-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-142-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-144-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-145-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-146-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-147-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-148-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-150-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-151-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-152-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-154-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-156-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-158-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-157-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-155-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-160-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-159-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-153-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-149-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-143-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-161-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-164-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-166-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-165-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-163-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-162-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2444-167-0x00000000774F0000-0x000000007767E000-memory.dmp

      Filesize

      1.6MB

    • memory/2804-178-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB

    • memory/2804-199-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB

    • memory/2804-202-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB

    • memory/2804-203-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB

    • memory/2804-205-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB

    • memory/2804-206-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB

    • memory/2804-209-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB

    • memory/2804-212-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB

    • memory/2804-216-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB

    • memory/2804-218-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB

    • memory/2804-220-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB

    • memory/2804-221-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB

    • memory/2804-224-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB

    • memory/2804-227-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB

    • memory/2804-230-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB

    • memory/2804-231-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB

    • memory/2804-232-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB

    • memory/2804-233-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB

    • memory/2804-234-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB

    • memory/2804-235-0x0000000003240000-0x0000000004240000-memory.dmp

      Filesize

      16.0MB