Overview

overview

7

Static

static

3

PrismLaunc....3.exe

windows7-x64

7

PrismLaunc....3.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    135s
  • max time network
    37s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    08/05/2023, 20:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PrismLauncher-Windows-MSVC-Setup-6.3.exe

  • Size

    15.5MB

  • MD5

    cdafdb2c5d1671ec3953b32172ccdb80

  • SHA1

    06ca76295dd916a1f12a9f34a088426450a643ce

  • SHA256

    f0dbf35b026acb481bb42d8fc6155d952c521792ebc1bdd52e3152342a317f92

  • SHA512

    4a09c540a3c831453af56613c2a8272a4c15d661f0e3c8343488c2606e7c594783e888ae2d5521a12a0736f6bb922a74751f1f36fd25a24281e59528e10c96fa

  • SSDEEP

    196608:LCiFgS9OWiVxhbStnh3nDohlG3fxkIIdfwbdo0ctmVwKyZCGdYcpH84aPsX0Twfu:LbgYohEhqk3ARw0moC6bNFX/DX+DtGJS

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 16 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies registry class 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MSVC-Setup-6.3.exe
    "C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MSVC-Setup-6.3.exe"
    1⤵
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Windows\SysWOW64\TaskKill.exe
      TaskKill /IM prismlauncher.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:788
    • C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
      "C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1700
  • C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
    "C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    PID:616
  • C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
    "C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    PID:1516

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Gui.dll
    Filesize

    7.3MB

    MD5

    d9d28c74bf6331296ba2dfcf2b9c95f6

    SHA1

    9f966b77751e2681916f165f348e1b598c71bd8e

    SHA256

    97e9cbc396e54fcba316c3b8f0383ec526159ae70bb63f7ebdd9ffc0f511c143

    SHA512

    554dba9b59d5ea6043a4cce9fe74b87f7cbd0dc341b6df78f2f5e3778e6a35f05cb03a9ff84d91753e4685936b74bcac550c4fc87f9fc671b73507d47b924592

    Download Submit

  • C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Widgets.dll
    Filesize

    5.8MB

    MD5

    fdc4fc0eaa7a6cfc8712a1c65f7592ad

    SHA1

    f43f709d373a70f3b3a895d08114f0dcdab79db0

    SHA256

    31336c26f42b274187dc473da01e4e1c1f0f2a6250313eb4822656d94b420264

    SHA512

    25cc93a6eac7a73fdeaa61ee874fd5f1998a8574255ecb57bbef8d72743eee47862468d714117f62493431e49720951c2fc00988f6a9888687f8425d73599094

    Download Submit

  • C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
    Filesize

    7.7MB

    MD5

    6eee4fe0679ff858adfd4de9b3bb1892

    SHA1

    c536cfb7d4025cc4971389e9bddc3bfb06920ab4

    SHA256

    071d3b45a03c20867cc2bf1f8d4576cd8bfb76655531a09a296229d8b32a285b

    SHA512

    2a24a94a5ca4b93d964de894847a270af094fe7ff6d28d3ee7b3d947fd956706a8a69057f5d0af743024d8eb14f0e04ef8e3116128ccace5a09bcb99867fe32e

    Download Submit

  • C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
    Filesize

    7.7MB

    MD5

    6eee4fe0679ff858adfd4de9b3bb1892

    SHA1

    c536cfb7d4025cc4971389e9bddc3bfb06920ab4

    SHA256

    071d3b45a03c20867cc2bf1f8d4576cd8bfb76655531a09a296229d8b32a285b

    SHA512

    2a24a94a5ca4b93d964de894847a270af094fe7ff6d28d3ee7b3d947fd956706a8a69057f5d0af743024d8eb14f0e04ef8e3116128ccace5a09bcb99867fe32e

    Download Submit

  • C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
    Filesize

    7.7MB

    MD5

    6eee4fe0679ff858adfd4de9b3bb1892

    SHA1

    c536cfb7d4025cc4971389e9bddc3bfb06920ab4

    SHA256

    071d3b45a03c20867cc2bf1f8d4576cd8bfb76655531a09a296229d8b32a285b

    SHA512

    2a24a94a5ca4b93d964de894847a270af094fe7ff6d28d3ee7b3d947fd956706a8a69057f5d0af743024d8eb14f0e04ef8e3116128ccace5a09bcb99867fe32e

    Download Submit

  • C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
    Filesize

    7.7MB

    MD5

    6eee4fe0679ff858adfd4de9b3bb1892

    SHA1

    c536cfb7d4025cc4971389e9bddc3bfb06920ab4

    SHA256

    071d3b45a03c20867cc2bf1f8d4576cd8bfb76655531a09a296229d8b32a285b

    SHA512

    2a24a94a5ca4b93d964de894847a270af094fe7ff6d28d3ee7b3d947fd956706a8a69057f5d0af743024d8eb14f0e04ef8e3116128ccace5a09bcb99867fe32e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsyA9D.tmp\System.dll
    Filesize

    12KB

    MD5

    cff85c549d536f651d4fb8387f1976f2

    SHA1

    d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    SHA256

    8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    SHA512

    531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsyA9D.tmp\modern-wizard.bmp
    Filesize

    25KB

    MD5

    cbe40fd2b1ec96daedc65da172d90022

    SHA1

    366c216220aa4329dff6c485fd0e9b0f4f0a7944

    SHA256

    3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

    SHA512

    62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsyA9D.tmp\nsDialogs.dll
    Filesize

    9KB

    MD5

    6c3f8c94d0727894d706940a8a980543

    SHA1

    0d1bcad901be377f38d579aafc0c41c0ef8dcefd

    SHA256

    56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

    SHA512

    2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsyA9D.tmp\nsExec.dll
    Filesize

    7KB

    MD5

    675c4948e1efc929edcabfe67148eddd

    SHA1

    f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

    SHA256

    1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

    SHA512

    61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

    Download Submit

  • \Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Gui.dll
    Filesize

    7.3MB

    MD5

    d9d28c74bf6331296ba2dfcf2b9c95f6

    SHA1

    9f966b77751e2681916f165f348e1b598c71bd8e

    SHA256

    97e9cbc396e54fcba316c3b8f0383ec526159ae70bb63f7ebdd9ffc0f511c143

    SHA512

    554dba9b59d5ea6043a4cce9fe74b87f7cbd0dc341b6df78f2f5e3778e6a35f05cb03a9ff84d91753e4685936b74bcac550c4fc87f9fc671b73507d47b924592

    Download Submit

  • \Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Gui.dll
    Filesize

    7.3MB

    MD5

    d9d28c74bf6331296ba2dfcf2b9c95f6

    SHA1

    9f966b77751e2681916f165f348e1b598c71bd8e

    SHA256

    97e9cbc396e54fcba316c3b8f0383ec526159ae70bb63f7ebdd9ffc0f511c143

    SHA512

    554dba9b59d5ea6043a4cce9fe74b87f7cbd0dc341b6df78f2f5e3778e6a35f05cb03a9ff84d91753e4685936b74bcac550c4fc87f9fc671b73507d47b924592

    Download Submit

  • \Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Gui.dll
    Filesize

    7.3MB

    MD5

    d9d28c74bf6331296ba2dfcf2b9c95f6

    SHA1

    9f966b77751e2681916f165f348e1b598c71bd8e

    SHA256

    97e9cbc396e54fcba316c3b8f0383ec526159ae70bb63f7ebdd9ffc0f511c143

    SHA512

    554dba9b59d5ea6043a4cce9fe74b87f7cbd0dc341b6df78f2f5e3778e6a35f05cb03a9ff84d91753e4685936b74bcac550c4fc87f9fc671b73507d47b924592

    Download Submit

  • \Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Widgets.dll
    Filesize

    5.8MB

    MD5

    fdc4fc0eaa7a6cfc8712a1c65f7592ad

    SHA1

    f43f709d373a70f3b3a895d08114f0dcdab79db0

    SHA256

    31336c26f42b274187dc473da01e4e1c1f0f2a6250313eb4822656d94b420264

    SHA512

    25cc93a6eac7a73fdeaa61ee874fd5f1998a8574255ecb57bbef8d72743eee47862468d714117f62493431e49720951c2fc00988f6a9888687f8425d73599094

    Download Submit

  • \Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Widgets.dll
    Filesize

    5.8MB

    MD5

    fdc4fc0eaa7a6cfc8712a1c65f7592ad

    SHA1

    f43f709d373a70f3b3a895d08114f0dcdab79db0

    SHA256

    31336c26f42b274187dc473da01e4e1c1f0f2a6250313eb4822656d94b420264

    SHA512

    25cc93a6eac7a73fdeaa61ee874fd5f1998a8574255ecb57bbef8d72743eee47862468d714117f62493431e49720951c2fc00988f6a9888687f8425d73599094

    Download Submit

  • \Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Widgets.dll
    Filesize

    5.8MB

    MD5

    fdc4fc0eaa7a6cfc8712a1c65f7592ad

    SHA1

    f43f709d373a70f3b3a895d08114f0dcdab79db0

    SHA256

    31336c26f42b274187dc473da01e4e1c1f0f2a6250313eb4822656d94b420264

    SHA512

    25cc93a6eac7a73fdeaa61ee874fd5f1998a8574255ecb57bbef8d72743eee47862468d714117f62493431e49720951c2fc00988f6a9888687f8425d73599094

    Download Submit

  • \Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
    Filesize

    7.7MB

    MD5

    6eee4fe0679ff858adfd4de9b3bb1892

    SHA1

    c536cfb7d4025cc4971389e9bddc3bfb06920ab4

    SHA256

    071d3b45a03c20867cc2bf1f8d4576cd8bfb76655531a09a296229d8b32a285b

    SHA512

    2a24a94a5ca4b93d964de894847a270af094fe7ff6d28d3ee7b3d947fd956706a8a69057f5d0af743024d8eb14f0e04ef8e3116128ccace5a09bcb99867fe32e

    Download Submit

  • \Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
    Filesize

    7.7MB

    MD5

    6eee4fe0679ff858adfd4de9b3bb1892

    SHA1

    c536cfb7d4025cc4971389e9bddc3bfb06920ab4

    SHA256

    071d3b45a03c20867cc2bf1f8d4576cd8bfb76655531a09a296229d8b32a285b

    SHA512

    2a24a94a5ca4b93d964de894847a270af094fe7ff6d28d3ee7b3d947fd956706a8a69057f5d0af743024d8eb14f0e04ef8e3116128ccace5a09bcb99867fe32e

    Download Submit

  • \Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
    Filesize

    7.7MB

    MD5

    6eee4fe0679ff858adfd4de9b3bb1892

    SHA1

    c536cfb7d4025cc4971389e9bddc3bfb06920ab4

    SHA256

    071d3b45a03c20867cc2bf1f8d4576cd8bfb76655531a09a296229d8b32a285b

    SHA512

    2a24a94a5ca4b93d964de894847a270af094fe7ff6d28d3ee7b3d947fd956706a8a69057f5d0af743024d8eb14f0e04ef8e3116128ccace5a09bcb99867fe32e

    Download Submit

  • \Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
    Filesize

    7.7MB

    MD5

    6eee4fe0679ff858adfd4de9b3bb1892

    SHA1

    c536cfb7d4025cc4971389e9bddc3bfb06920ab4

    SHA256

    071d3b45a03c20867cc2bf1f8d4576cd8bfb76655531a09a296229d8b32a285b

    SHA512

    2a24a94a5ca4b93d964de894847a270af094fe7ff6d28d3ee7b3d947fd956706a8a69057f5d0af743024d8eb14f0e04ef8e3116128ccace5a09bcb99867fe32e

    Download Submit

  • \Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
    Filesize

    7.7MB

    MD5

    6eee4fe0679ff858adfd4de9b3bb1892

    SHA1

    c536cfb7d4025cc4971389e9bddc3bfb06920ab4

    SHA256

    071d3b45a03c20867cc2bf1f8d4576cd8bfb76655531a09a296229d8b32a285b

    SHA512

    2a24a94a5ca4b93d964de894847a270af094fe7ff6d28d3ee7b3d947fd956706a8a69057f5d0af743024d8eb14f0e04ef8e3116128ccace5a09bcb99867fe32e

    Download Submit

  • \Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
    Filesize

    7.7MB

    MD5

    6eee4fe0679ff858adfd4de9b3bb1892

    SHA1

    c536cfb7d4025cc4971389e9bddc3bfb06920ab4

    SHA256

    071d3b45a03c20867cc2bf1f8d4576cd8bfb76655531a09a296229d8b32a285b

    SHA512

    2a24a94a5ca4b93d964de894847a270af094fe7ff6d28d3ee7b3d947fd956706a8a69057f5d0af743024d8eb14f0e04ef8e3116128ccace5a09bcb99867fe32e

    Download Submit

  • \Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
    Filesize

    7.7MB

    MD5

    6eee4fe0679ff858adfd4de9b3bb1892

    SHA1

    c536cfb7d4025cc4971389e9bddc3bfb06920ab4

    SHA256

    071d3b45a03c20867cc2bf1f8d4576cd8bfb76655531a09a296229d8b32a285b

    SHA512

    2a24a94a5ca4b93d964de894847a270af094fe7ff6d28d3ee7b3d947fd956706a8a69057f5d0af743024d8eb14f0e04ef8e3116128ccace5a09bcb99867fe32e

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsyA9D.tmp\System.dll
    Filesize

    12KB

    MD5

    cff85c549d536f651d4fb8387f1976f2

    SHA1

    d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    SHA256

    8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    SHA512

    531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsyA9D.tmp\nsDialogs.dll
    Filesize

    9KB

    MD5

    6c3f8c94d0727894d706940a8a980543

    SHA1

    0d1bcad901be377f38d579aafc0c41c0ef8dcefd

    SHA256

    56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

    SHA512

    2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsyA9D.tmp\nsExec.dll
    Filesize

    7KB

    MD5

    675c4948e1efc929edcabfe67148eddd

    SHA1

    f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

    SHA256

    1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

    SHA512

    61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

    Download Submit