Analysis
-
max time kernel
1848s -
max time network
1851s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-02-2023 20:20
Static task
static1
Behavioral task
behavioral1
Sample
TLauncher.lnk
Resource
win7-20220812-en
General
-
Target
TLauncher.lnk
-
Size
1KB
-
MD5
d857b472e0e44470f3a6476a340559b5
-
SHA1
ef3096f7619f4b35afeba3d325e2bd4fd5dc5065
-
SHA256
e34014b3eab2272cdcd65c897d669a4156cb4937a4f558c022a33cadb7baeb56
-
SHA512
33a7844d85726489cb1626e5790c925305b8676e1a6362418f1b55503e0f0a9b5e8862b1c5067648e1f499dc08d5f943891c4be9dd50dad1083727bc4feb8153
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
chrome.exechrome.exepid process 1368 chrome.exe 660 chrome.exe 660 chrome.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
Processes:
chrome.exepid process 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
Processes:
chrome.exepid process 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe 660 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 660 wrote to memory of 1332 660 chrome.exe chrome.exe PID 660 wrote to memory of 1332 660 chrome.exe chrome.exe PID 660 wrote to memory of 1332 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1040 660 chrome.exe chrome.exe PID 660 wrote to memory of 1368 660 chrome.exe chrome.exe PID 660 wrote to memory of 1368 660 chrome.exe chrome.exe PID 660 wrote to memory of 1368 660 chrome.exe chrome.exe PID 660 wrote to memory of 576 660 chrome.exe chrome.exe PID 660 wrote to memory of 576 660 chrome.exe chrome.exe PID 660 wrote to memory of 576 660 chrome.exe chrome.exe PID 660 wrote to memory of 576 660 chrome.exe chrome.exe PID 660 wrote to memory of 576 660 chrome.exe chrome.exe PID 660 wrote to memory of 576 660 chrome.exe chrome.exe PID 660 wrote to memory of 576 660 chrome.exe chrome.exe PID 660 wrote to memory of 576 660 chrome.exe chrome.exe PID 660 wrote to memory of 576 660 chrome.exe chrome.exe PID 660 wrote to memory of 576 660 chrome.exe chrome.exe PID 660 wrote to memory of 576 660 chrome.exe chrome.exe PID 660 wrote to memory of 576 660 chrome.exe chrome.exe PID 660 wrote to memory of 576 660 chrome.exe chrome.exe PID 660 wrote to memory of 576 660 chrome.exe chrome.exe PID 660 wrote to memory of 576 660 chrome.exe chrome.exe PID 660 wrote to memory of 576 660 chrome.exe chrome.exe PID 660 wrote to memory of 576 660 chrome.exe chrome.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\TLauncher.lnk1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefb6c4f50,0x7fefb6c4f60,0x7fefb6c4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1112,16016111466863688265,15144559727328951949,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1132 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1112,16016111466863688265,15144559727328951949,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1264 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1112,16016111466863688265,15144559727328951949,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1684 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,16016111466863688265,15144559727328951949,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2036 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,16016111466863688265,15144559727328951949,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2076 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,16016111466863688265,15144559727328951949,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1112,16016111466863688265,15144559727328951949,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3328 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,16016111466863688265,15144559727328951949,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,16016111466863688265,15144559727328951949,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3552 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,16016111466863688265,15144559727328951949,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3596 /prefetch:82⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\pipe\crashpad_660_DJMKZPAUQEMNQIBNMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2020-54-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmpFilesize
8KB