Analysis
-
max time kernel
120s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-es -
resource tags
-
submitted
03-08-2023 15:38
General
-
Target
LegacyLauncher_legacy.jar
-
Size
9.2MB
-
MD5
45e7627b8542f033fc67ac7fb6d22537
-
SHA1
e6149d3d7d34f1ba3d8214e66433ce7dd25fb0bb
-
SHA256
df2d2516e905cdc87a68ec456f881664a5b158ba810934251d7b70a740679588
-
SHA512
a573ce983c6c93ef53459bffe16b9d442ca1906e58064e53444f74573f43ea2e62c7516823a3eb0f17fc3beadf6dc4fb4ba9b0094b6ef7f02c26d97e0f579f48
-
SSDEEP
196608:91SdSZ9fzJ+vzQWTvG5RORTW5mcqyd+Tt9t4y:9US+TqRZ2yd+h0y
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 12 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 28 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\LegacyLauncher_legacy.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre1.8.0_66\bin\java.exe"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -Xmx128m -Dfile.encoding=UTF-8 -Dtlauncher.systemCharset=windows-1252 -Dtlauncher.logFolder=C:\Users\Admin\AppData\Roaming\.tlauncher\logs -classpath C:\Users\Admin\AppData\Local\Temp\LegacyLauncher_legacy.jar ru.turikhay.tlauncher.bootstrap.Bootstrap2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD51072993f4276d3979693b8a23d9a8349
SHA1fcd3730fd5ad3a78bf26271d48d698b19b0138d3
SHA2565b43c96e1fcffc8511993de7dfc19e497548e8eecef0e77d4ee372a7488759a4
SHA51215b13bea113118af1a529b9b6888a2f21078511c42fef88e35b0b79645f1433907fe99617f7ed5dd8fbd6b1d682407f13736235c554815ca65087e2d399f0605
-
Filesize
9KB
MD5697d496ac9f5aaab8ae025322358c61e
SHA12043eac8cdcc2e24b854af1eacd77a5f2a395a27
SHA256a7273a4cf48ab3413f2c186cc95a3367a73ce99f8d45329383219d4cc27003aa
SHA512b6702cd49a3af9f97f697565136f140692af9f8b271e672f2e91c920a23212b778583786f2377078117113647926338614a92c4a2423318b7a21ba2fe3a89838
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB