Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
26/11/2023, 19:12
Static task
static1
Behavioral task
behavioral1
Sample
TLauncher-2.885-Installer-1.1.3.exe
Resource
win7-20231020-en
General
-
Target
TLauncher-2.885-Installer-1.1.3.exe
-
Size
22.6MB
-
MD5
bd3eefe3f5a4bb0c948251a5d05727e7
-
SHA1
b18722304d297aa384a024444aadd4e5f54a115e
-
SHA256
f1b132f7ecf06d2aa1dd007fc7736166af3ee7c177c91587ae43930c65e531e0
-
SHA512
d7df966eeda90bf074249ba983aac4ba32a7f09fe4bb6d95811951df08f24e55e01c790ffebc3bc50ce7b1c501ff562f0de5e01ca340c8596881f69f8fed932d
-
SSDEEP
393216:KXGWOLBh2NPfs/dQETVlOBbpFEjdGphRqV56HpkoaH3D8P2Q6YS6x9DOc:K2/BhSHExi73qqHpu34kYbzOc
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2240 irsetup.exe -
Loads dropped DLL 7 IoCs
pid Process 2332 TLauncher-2.885-Installer-1.1.3.exe 2332 TLauncher-2.885-Installer-1.1.3.exe 2332 TLauncher-2.885-Installer-1.1.3.exe 2332 TLauncher-2.885-Installer-1.1.3.exe 2240 irsetup.exe 2240 irsetup.exe 2240 irsetup.exe -
resource yara_rule behavioral1/files/0x00080000000120eb-3.dat upx behavioral1/memory/2332-5-0x0000000002C60000-0x0000000003048000-memory.dmp upx behavioral1/files/0x00080000000120eb-7.dat upx behavioral1/files/0x00080000000120eb-13.dat upx behavioral1/files/0x00080000000120eb-11.dat upx behavioral1/files/0x00080000000120eb-8.dat upx behavioral1/files/0x00080000000120eb-17.dat upx behavioral1/files/0x00080000000120eb-20.dat upx behavioral1/memory/2240-333-0x0000000000BD0000-0x0000000000FB8000-memory.dmp upx behavioral1/memory/2240-341-0x0000000000BD0000-0x0000000000FB8000-memory.dmp upx behavioral1/files/0x00080000000120eb-396.dat upx behavioral1/files/0x000500000001cfec-427.dat upx behavioral1/memory/1064-438-0x0000000002CE0000-0x00000000030C8000-memory.dmp upx behavioral1/files/0x000500000001cfec-436.dat upx behavioral1/files/0x000500000001cfec-434.dat upx behavioral1/files/0x000500000001cfec-431.dat upx behavioral1/files/0x000500000001cfec-430.dat upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main irsetup.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 irsetup.exe 2240 irsetup.exe 2240 irsetup.exe 2240 irsetup.exe 2240 irsetup.exe 2240 irsetup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2332 wrote to memory of 2240 2332 TLauncher-2.885-Installer-1.1.3.exe 28 PID 2332 wrote to memory of 2240 2332 TLauncher-2.885-Installer-1.1.3.exe 28 PID 2332 wrote to memory of 2240 2332 TLauncher-2.885-Installer-1.1.3.exe 28 PID 2332 wrote to memory of 2240 2332 TLauncher-2.885-Installer-1.1.3.exe 28 PID 2332 wrote to memory of 2240 2332 TLauncher-2.885-Installer-1.1.3.exe 28 PID 2332 wrote to memory of 2240 2332 TLauncher-2.885-Installer-1.1.3.exe 28 PID 2332 wrote to memory of 2240 2332 TLauncher-2.885-Installer-1.1.3.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\TLauncher-2.885-Installer-1.1.3.exe"C:\Users\Admin\AppData\Local\Temp\TLauncher-2.885-Installer-1.1.3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.885-Installer-1.1.3.exe" "__IRCT:3" "__IRTSS:23661420" "__IRSID:S-1-5-21-2084844033-2744876406-2053742436-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe"C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini3⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1841988" "__IRSID:S-1-5-21-2084844033-2744876406-2053742436-1000"4⤵PID:1756
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5cb50d496ae05fa1c8bfbcb3b7f910bfe
SHA13ec4d77b73c4d7e9858b11224314e99d082497a8
SHA2567616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34
SHA51222051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d
-
Filesize
1.8MB
MD5cb50d496ae05fa1c8bfbcb3b7f910bfe
SHA13ec4d77b73c4d7e9858b11224314e99d082497a8
SHA2567616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34
SHA51222051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d
-
Filesize
116KB
MD5e043a9cb014d641a56f50f9d9ac9a1b9
SHA161dc6aed3d0d1f3b8afe3d161410848c565247ed
SHA2569dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
SHA5124ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f
-
Filesize
1.8MB
MD5cb50d496ae05fa1c8bfbcb3b7f910bfe
SHA13ec4d77b73c4d7e9858b11224314e99d082497a8
SHA2567616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34
SHA51222051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d
-
Filesize
339B
MD5e5e9c323b6a9533a09982b2117c61528
SHA13dc0e877803d6e16b28ce0840e2967cc74494a61
SHA256ba1f3e4598c5716bbfea508fada40b7dfd0989ddabd453e8c8703c04270151fd
SHA512bbfa29299a1e948506f6ec3802aceb27f8aef3a5b2e3c9789a92b2bcc959fc2523d2344739ccc89df370dde6ea23c1db5ffc7e4799b5e532b0ec85dc98996865
-
Filesize
280B
MD55803b5d5f862418b64caa83396e69c7f
SHA197b6c8209b8ad65f4f9f3b953fe966bb09ee4e13
SHA256ee340f8560ba2e71d7e6d305b959ff8fa77869dac916287da2bff7ce5aa2e159
SHA512e9bf37f0c89299bfa369a8677ac56b12177dd3153246e5e6a9390577658111b731b0ab987044d30f43e05cb41d79ed31dae3b6f4521f225925920617d0414edd
-
Filesize
281B
MD560a19921c7ff3c75e28c302f95460994
SHA107ac64ffbb153c8675e2ce0651afeaa5e8c6652d
SHA25633341d30463fbc7cf3fba5070925569c822b6835aabdb8ef2c3cf09547912d46
SHA512b30b960152dc13b1a9d384c4972169392cd405bdf4d3ecf73f85cf8a9a68a075131b2495c0348f54d43d0e7a279907bc7b76ac103f4a624738cbfc73bbeeba02
-
Filesize
206B
MD56b2addb09533ae5cc0650ebc8779f948
SHA17bef900d216614f9f498d33b345372e40d872628
SHA256260b130f51840a7b353a640ae69484498c6ec957e37f3bac831a140db533da84
SHA512769bbde3aaac255bd5464acaedae0a5b9ca0e11e9cc9ce0d71cdb4e47ee21fc3610bf43240d52cf2d9bdc74478384f5c1130f0d919927067631d01a1446aece4
-
Filesize
1.3MB
MD5a70accbc1f1001cbf1c4a139e4e5d7af
SHA1138de36067af0c8f98e1f7bc4c6bea1d73bc53ab
SHA256b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6
SHA51246fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04
-
Filesize
1.3MB
MD5a70accbc1f1001cbf1c4a139e4e5d7af
SHA1138de36067af0c8f98e1f7bc4c6bea1d73bc53ab
SHA256b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6
SHA51246fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04
-
Filesize
1.3MB
MD5a70accbc1f1001cbf1c4a139e4e5d7af
SHA1138de36067af0c8f98e1f7bc4c6bea1d73bc53ab
SHA256b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6
SHA51246fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04
-
Filesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
Filesize
576KB
MD55d48873014aeb4d2b95e30acc1f50ca0
SHA11d91177629c6bb91514c6769b90dc3639133eb9d
SHA256fdca250ce16780061c793cbf7aff1e2ea57235f0d1c664c34f5072b34270df21
SHA5123d70b20f57eab6acf489e437c146bc801dd36a85b0c1bfb6368f5696c59599ffb4cae278af27bcbe9f4a73ca78b67961afa0168c0380e45fc0608729c77208c1
-
Filesize
1.8MB
MD5cb50d496ae05fa1c8bfbcb3b7f910bfe
SHA13ec4d77b73c4d7e9858b11224314e99d082497a8
SHA2567616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34
SHA51222051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d
-
Filesize
1.8MB
MD5cb50d496ae05fa1c8bfbcb3b7f910bfe
SHA13ec4d77b73c4d7e9858b11224314e99d082497a8
SHA2567616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34
SHA51222051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d
-
Filesize
1.8MB
MD5cb50d496ae05fa1c8bfbcb3b7f910bfe
SHA13ec4d77b73c4d7e9858b11224314e99d082497a8
SHA2567616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34
SHA51222051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d
-
Filesize
1.8MB
MD5cb50d496ae05fa1c8bfbcb3b7f910bfe
SHA13ec4d77b73c4d7e9858b11224314e99d082497a8
SHA2567616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34
SHA51222051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d
-
Filesize
1.7MB
MD51bbf5dd0b6ca80e4c7c77495c3f33083
SHA1e0520037e60eb641ec04d1e814394c9da0a6a862
SHA256bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b
SHA51297bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab
-
Filesize
97KB
MD5da1d0cd400e0b6ad6415fd4d90f69666
SHA1de9083d2902906cacf57259cf581b1466400b799
SHA2567a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a
-
Filesize
1.3MB
MD5a70accbc1f1001cbf1c4a139e4e5d7af
SHA1138de36067af0c8f98e1f7bc4c6bea1d73bc53ab
SHA256b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6
SHA51246fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04
-
Filesize
1.3MB
MD5a70accbc1f1001cbf1c4a139e4e5d7af
SHA1138de36067af0c8f98e1f7bc4c6bea1d73bc53ab
SHA256b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6
SHA51246fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04
-
Filesize
1.3MB
MD5a70accbc1f1001cbf1c4a139e4e5d7af
SHA1138de36067af0c8f98e1f7bc4c6bea1d73bc53ab
SHA256b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6
SHA51246fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04
-
Filesize
1.3MB
MD5a70accbc1f1001cbf1c4a139e4e5d7af
SHA1138de36067af0c8f98e1f7bc4c6bea1d73bc53ab
SHA256b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6
SHA51246fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04
-
Filesize
1.3MB
MD5a70accbc1f1001cbf1c4a139e4e5d7af
SHA1138de36067af0c8f98e1f7bc4c6bea1d73bc53ab
SHA256b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6
SHA51246fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04
-
Filesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4
-
Filesize
1.3MB
MD52b2fb67e0f041923ce66c1d1f2d91eee
SHA131d1a53b1eaa37f6bf7aae060e696f3a5bb15741
SHA256dc7cfb70877d3d264043ddda52da40d3ccb58370c202e12b3a4219432ce4091f
SHA512b74cbec340b65419a65db28ba9f38631a56f4ce15beec267693825c2714d3a000847df0ea4c7054eac3cb76a44fc0b42be97a85de3e71cbba4bad97053330e4b
-
Filesize
576KB
MD55d48873014aeb4d2b95e30acc1f50ca0
SHA11d91177629c6bb91514c6769b90dc3639133eb9d
SHA256fdca250ce16780061c793cbf7aff1e2ea57235f0d1c664c34f5072b34270df21
SHA5123d70b20f57eab6acf489e437c146bc801dd36a85b0c1bfb6368f5696c59599ffb4cae278af27bcbe9f4a73ca78b67961afa0168c0380e45fc0608729c77208c1
-
Filesize
512KB
MD5e1a409ae60c7f15f3c5f0888f1d3c70c
SHA1f529b499c6bca12c44da1ffd2cccb453f4cf6150
SHA2565783812c9589b4bcb95a86ee1932fef0a4d71fb4356490c37f005d13843f6522
SHA512d5c2db8e9792fb05d53ad4bc125fb68345e9767790795e8e254a8a21b03dd49c71058d13c3f75f4e7f6271dcc22bbe44a6b348d1f62d3f3fa64b6273925d4d1b
-
Filesize
512KB
MD5e1a409ae60c7f15f3c5f0888f1d3c70c
SHA1f529b499c6bca12c44da1ffd2cccb453f4cf6150
SHA2565783812c9589b4bcb95a86ee1932fef0a4d71fb4356490c37f005d13843f6522
SHA512d5c2db8e9792fb05d53ad4bc125fb68345e9767790795e8e254a8a21b03dd49c71058d13c3f75f4e7f6271dcc22bbe44a6b348d1f62d3f3fa64b6273925d4d1b