Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    96s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/07/2023, 23:09

General

  • Target

    Launcher.exe

  • Size

    1125.4MB

  • MD5

    d6bb390dd0e507ab7a21103ce6988f5f

  • SHA1

    e9261d728047872157b3a1d105faa30498568410

  • SHA256

    8e404677b93e7dea53123dd73ec630dfe2b257bca249ba82ca05752db2ec511d

  • SHA512

    e8166a6e571e11bf1b13cc4ccae87729958ed5e9d37af8be1791705875696bd48ff1af17725ae3ec63ae2c4120aa56bedf29a398f9519898f496e03c2db8fde3

  • SSDEEP

    786432:3hCImgE7D9zYx25tBMBliqmvQPMM4LivtgDAXZvo8sqTtLwSTRpf4P1wT1aPrvjs:3WgkY2tC3PMM3yAJvoZrvjs

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:4028

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\.net\Launcher\EGlocfzpWVNj40RP8BgAw8Glrkg6uhc=\D3DCompiler_47_cor3.dll

    Filesize

    4.7MB

    MD5

    2191e768cc2e19009dad20dc999135a3

    SHA1

    f49a46ba0e954e657aaed1c9019a53d194272b6a

    SHA256

    7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

    SHA512

    5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

  • C:\Users\Admin\AppData\Local\Temp\.net\Launcher\EGlocfzpWVNj40RP8BgAw8Glrkg6uhc=\PresentationNative_cor3.dll

    Filesize

    1.2MB

    MD5

    2dfb41d1d9b1f5c9bc4da09f2e295b24

    SHA1

    97ddf4cdad886463c190784d788887b4d01d6e0a

    SHA256

    7e22229f80a3c9e8eddb32ddf54f6a1764ee726998bab475a0ddd9f7ce53aaf0

    SHA512

    b04e1d8f0e9408dcdc7ecc8dcc1de5e7972aab09c60c950ca8a0000d01acd84a85909aec1d702dc2118cd63f35249e25b55a0193eaf2c53a68f8fcc2b38a07dd

  • C:\Users\Admin\AppData\Local\Temp\.net\Launcher\EGlocfzpWVNj40RP8BgAw8Glrkg6uhc=\wpfgfx_cor3.dll

    Filesize

    1.9MB

    MD5

    a27b3f5c4a0b4c6993675bf964533721

    SHA1

    8eabdf3a1abb57c9a3f330bb3c64ede6f487b184

    SHA256

    fce483fc2381a6c58ac46e54209f6bba4b3c17e3883ee5d4e7879644858286cb

    SHA512

    bac51ef7996b1bc2c688e44432a4f869e819e4aeb0871a2067d49ad12cff3f5730ba0a2d31e864f9544621e3ce794a7fffee3306ef3bbe9daec8a0a545a9de90

  • memory/4028-174-0x00000232C1400000-0x00000232C1413000-memory.dmp

    Filesize

    76KB

  • memory/4028-180-0x00000232C1450000-0x00000232C1469000-memory.dmp

    Filesize

    100KB

  • memory/4028-153-0x00000232C11F0000-0x00000232C122C000-memory.dmp

    Filesize

    240KB

  • memory/4028-156-0x00000232C1230000-0x00000232C1274000-memory.dmp

    Filesize

    272KB

  • memory/4028-159-0x00000232C1280000-0x00000232C12BE000-memory.dmp

    Filesize

    248KB

  • memory/4028-162-0x00000232C5530000-0x00000232C5D72000-memory.dmp

    Filesize

    8.3MB

  • memory/4028-165-0x00000232A0BB0000-0x00000232A0C2F000-memory.dmp

    Filesize

    508KB

  • memory/4028-168-0x00000232C13B0000-0x00000232C13BD000-memory.dmp

    Filesize

    52KB

  • memory/4028-171-0x00000232C13A0000-0x00000232C13A5000-memory.dmp

    Filesize

    20KB

  • memory/4028-138-0x0000000180000000-0x0000000180A24000-memory.dmp

    Filesize

    10.1MB

  • memory/4028-177-0x00000232C13E0000-0x00000232C13E7000-memory.dmp

    Filesize

    28KB

  • memory/4028-150-0x00000232C1810000-0x00000232C196E000-memory.dmp

    Filesize

    1.4MB

  • memory/4028-183-0x00000232C1470000-0x00000232C1486000-memory.dmp

    Filesize

    88KB

  • memory/4028-186-0x00000232C1490000-0x00000232C14D0000-memory.dmp

    Filesize

    256KB

  • memory/4028-189-0x00000232C14E0000-0x00000232C14F8000-memory.dmp

    Filesize

    96KB

  • memory/4028-192-0x00000232C1500000-0x00000232C1512000-memory.dmp

    Filesize

    72KB

  • memory/4028-147-0x00000232C15E0000-0x00000232C1808000-memory.dmp

    Filesize

    2.2MB

  • memory/4028-198-0x00000232C1C70000-0x00000232C1D64000-memory.dmp

    Filesize

    976KB

  • memory/4028-201-0x00000232C1440000-0x00000232C1448000-memory.dmp

    Filesize

    32KB

  • memory/4028-204-0x00000232C1580000-0x00000232C15C7000-memory.dmp

    Filesize

    284KB

  • memory/4028-144-0x00000232C2340000-0x00000232C32C6000-memory.dmp

    Filesize

    15.5MB

  • memory/4028-141-0x00000232C12D0000-0x00000232C139B000-memory.dmp

    Filesize

    812KB