Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    26/11/2023, 19:12

General

  • Target

    TLauncher-2.885-Installer-1.1.3.exe

  • Size

    22.6MB

  • MD5

    bd3eefe3f5a4bb0c948251a5d05727e7

  • SHA1

    b18722304d297aa384a024444aadd4e5f54a115e

  • SHA256

    f1b132f7ecf06d2aa1dd007fc7736166af3ee7c177c91587ae43930c65e531e0

  • SHA512

    d7df966eeda90bf074249ba983aac4ba32a7f09fe4bb6d95811951df08f24e55e01c790ffebc3bc50ce7b1c501ff562f0de5e01ca340c8596881f69f8fed932d

  • SSDEEP

    393216:KXGWOLBh2NPfs/dQETVlOBbpFEjdGphRqV56HpkoaH3D8P2Q6YS6x9DOc:K2/BhSHExi73qqHpu34kYbzOc

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.885-Installer-1.1.3.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.885-Installer-1.1.3.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.885-Installer-1.1.3.exe" "__IRCT:3" "__IRTSS:23661420" "__IRSID:S-1-5-21-2084844033-2744876406-2053742436-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2240
      • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini
        3⤵
          PID:1064
          • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
            "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /S:C:\Users\Admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1816850 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1841988" "__IRSID:S-1-5-21-2084844033-2744876406-2053742436-1000"
            4⤵
              PID:1756

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

        Filesize

        1.8MB

        MD5

        cb50d496ae05fa1c8bfbcb3b7f910bfe

        SHA1

        3ec4d77b73c4d7e9858b11224314e99d082497a8

        SHA256

        7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

        SHA512

        22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

      • C:\Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

        Filesize

        1.8MB

        MD5

        cb50d496ae05fa1c8bfbcb3b7f910bfe

        SHA1

        3ec4d77b73c4d7e9858b11224314e99d082497a8

        SHA256

        7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

        SHA512

        22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

        Filesize

        116KB

        MD5

        e043a9cb014d641a56f50f9d9ac9a1b9

        SHA1

        61dc6aed3d0d1f3b8afe3d161410848c565247ed

        SHA256

        9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

        SHA512

        4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

        Filesize

        1.8MB

        MD5

        cb50d496ae05fa1c8bfbcb3b7f910bfe

        SHA1

        3ec4d77b73c4d7e9858b11224314e99d082497a8

        SHA256

        7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

        SHA512

        22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNG

        Filesize

        339B

        MD5

        e5e9c323b6a9533a09982b2117c61528

        SHA1

        3dc0e877803d6e16b28ce0840e2967cc74494a61

        SHA256

        ba1f3e4598c5716bbfea508fada40b7dfd0989ddabd453e8c8703c04270151fd

        SHA512

        bbfa29299a1e948506f6ec3802aceb27f8aef3a5b2e3c9789a92b2bcc959fc2523d2344739ccc89df370dde6ea23c1db5ffc7e4799b5e532b0ec85dc98996865

      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG

        Filesize

        280B

        MD5

        5803b5d5f862418b64caa83396e69c7f

        SHA1

        97b6c8209b8ad65f4f9f3b953fe966bb09ee4e13

        SHA256

        ee340f8560ba2e71d7e6d305b959ff8fa77869dac916287da2bff7ce5aa2e159

        SHA512

        e9bf37f0c89299bfa369a8677ac56b12177dd3153246e5e6a9390577658111b731b0ab987044d30f43e05cb41d79ed31dae3b6f4521f225925920617d0414edd

      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

        Filesize

        281B

        MD5

        60a19921c7ff3c75e28c302f95460994

        SHA1

        07ac64ffbb153c8675e2ce0651afeaa5e8c6652d

        SHA256

        33341d30463fbc7cf3fba5070925569c822b6835aabdb8ef2c3cf09547912d46

        SHA512

        b30b960152dc13b1a9d384c4972169392cd405bdf4d3ecf73f85cf8a9a68a075131b2495c0348f54d43d0e7a279907bc7b76ac103f4a624738cbfc73bbeeba02

      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG46.PNG

        Filesize

        206B

        MD5

        6b2addb09533ae5cc0650ebc8779f948

        SHA1

        7bef900d216614f9f498d33b345372e40d872628

        SHA256

        260b130f51840a7b353a640ae69484498c6ec957e37f3bac831a140db533da84

        SHA512

        769bbde3aaac255bd5464acaedae0a5b9ca0e11e9cc9ce0d71cdb4e47ee21fc3610bf43240d52cf2d9bdc74478384f5c1130f0d919927067631d01a1446aece4

      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

        Filesize

        1.3MB

        MD5

        a70accbc1f1001cbf1c4a139e4e5d7af

        SHA1

        138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

        SHA256

        b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

        SHA512

        46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

        Filesize

        1.3MB

        MD5

        a70accbc1f1001cbf1c4a139e4e5d7af

        SHA1

        138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

        SHA256

        b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

        SHA512

        46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

        Filesize

        1.3MB

        MD5

        a70accbc1f1001cbf1c4a139e4e5d7af

        SHA1

        138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

        SHA256

        b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

        SHA512

        46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

        Filesize

        326KB

        MD5

        80d93d38badecdd2b134fe4699721223

        SHA1

        e829e58091bae93bc64e0c6f9f0bac999cfda23d

        SHA256

        c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

        SHA512

        9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

      • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

        Filesize

        576KB

        MD5

        5d48873014aeb4d2b95e30acc1f50ca0

        SHA1

        1d91177629c6bb91514c6769b90dc3639133eb9d

        SHA256

        fdca250ce16780061c793cbf7aff1e2ea57235f0d1c664c34f5072b34270df21

        SHA512

        3d70b20f57eab6acf489e437c146bc801dd36a85b0c1bfb6368f5696c59599ffb4cae278af27bcbe9f4a73ca78b67961afa0168c0380e45fc0608729c77208c1

      • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

        Filesize

        1.8MB

        MD5

        cb50d496ae05fa1c8bfbcb3b7f910bfe

        SHA1

        3ec4d77b73c4d7e9858b11224314e99d082497a8

        SHA256

        7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

        SHA512

        22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

      • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

        Filesize

        1.8MB

        MD5

        cb50d496ae05fa1c8bfbcb3b7f910bfe

        SHA1

        3ec4d77b73c4d7e9858b11224314e99d082497a8

        SHA256

        7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

        SHA512

        22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

      • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

        Filesize

        1.8MB

        MD5

        cb50d496ae05fa1c8bfbcb3b7f910bfe

        SHA1

        3ec4d77b73c4d7e9858b11224314e99d082497a8

        SHA256

        7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

        SHA512

        22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

      • \Users\Admin\AppData\Local\Temp\BrowserInstaller.exe

        Filesize

        1.8MB

        MD5

        cb50d496ae05fa1c8bfbcb3b7f910bfe

        SHA1

        3ec4d77b73c4d7e9858b11224314e99d082497a8

        SHA256

        7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

        SHA512

        22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

        Filesize

        1.7MB

        MD5

        1bbf5dd0b6ca80e4c7c77495c3f33083

        SHA1

        e0520037e60eb641ec04d1e814394c9da0a6a862

        SHA256

        bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

        SHA512

        97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

        Filesize

        97KB

        MD5

        da1d0cd400e0b6ad6415fd4d90f69666

        SHA1

        de9083d2902906cacf57259cf581b1466400b799

        SHA256

        7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

        SHA512

        f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

        Filesize

        1.3MB

        MD5

        a70accbc1f1001cbf1c4a139e4e5d7af

        SHA1

        138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

        SHA256

        b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

        SHA512

        46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

        Filesize

        1.3MB

        MD5

        a70accbc1f1001cbf1c4a139e4e5d7af

        SHA1

        138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

        SHA256

        b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

        SHA512

        46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

        Filesize

        1.3MB

        MD5

        a70accbc1f1001cbf1c4a139e4e5d7af

        SHA1

        138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

        SHA256

        b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

        SHA512

        46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

        Filesize

        1.3MB

        MD5

        a70accbc1f1001cbf1c4a139e4e5d7af

        SHA1

        138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

        SHA256

        b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

        SHA512

        46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

        Filesize

        1.3MB

        MD5

        a70accbc1f1001cbf1c4a139e4e5d7af

        SHA1

        138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

        SHA256

        b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

        SHA512

        46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

        Filesize

        326KB

        MD5

        80d93d38badecdd2b134fe4699721223

        SHA1

        e829e58091bae93bc64e0c6f9f0bac999cfda23d

        SHA256

        c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

        SHA512

        9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

        Filesize

        1.3MB

        MD5

        2b2fb67e0f041923ce66c1d1f2d91eee

        SHA1

        31d1a53b1eaa37f6bf7aae060e696f3a5bb15741

        SHA256

        dc7cfb70877d3d264043ddda52da40d3ccb58370c202e12b3a4219432ce4091f

        SHA512

        b74cbec340b65419a65db28ba9f38631a56f4ce15beec267693825c2714d3a000847df0ea4c7054eac3cb76a44fc0b42be97a85de3e71cbba4bad97053330e4b

      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

        Filesize

        576KB

        MD5

        5d48873014aeb4d2b95e30acc1f50ca0

        SHA1

        1d91177629c6bb91514c6769b90dc3639133eb9d

        SHA256

        fdca250ce16780061c793cbf7aff1e2ea57235f0d1c664c34f5072b34270df21

        SHA512

        3d70b20f57eab6acf489e437c146bc801dd36a85b0c1bfb6368f5696c59599ffb4cae278af27bcbe9f4a73ca78b67961afa0168c0380e45fc0608729c77208c1

      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

        Filesize

        512KB

        MD5

        e1a409ae60c7f15f3c5f0888f1d3c70c

        SHA1

        f529b499c6bca12c44da1ffd2cccb453f4cf6150

        SHA256

        5783812c9589b4bcb95a86ee1932fef0a4d71fb4356490c37f005d13843f6522

        SHA512

        d5c2db8e9792fb05d53ad4bc125fb68345e9767790795e8e254a8a21b03dd49c71058d13c3f75f4e7f6271dcc22bbe44a6b348d1f62d3f3fa64b6273925d4d1b

      • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe

        Filesize

        512KB

        MD5

        e1a409ae60c7f15f3c5f0888f1d3c70c

        SHA1

        f529b499c6bca12c44da1ffd2cccb453f4cf6150

        SHA256

        5783812c9589b4bcb95a86ee1932fef0a4d71fb4356490c37f005d13843f6522

        SHA512

        d5c2db8e9792fb05d53ad4bc125fb68345e9767790795e8e254a8a21b03dd49c71058d13c3f75f4e7f6271dcc22bbe44a6b348d1f62d3f3fa64b6273925d4d1b

      • memory/1064-438-0x0000000002CE0000-0x00000000030C8000-memory.dmp

        Filesize

        3.9MB

      • memory/2240-336-0x0000000010000000-0x0000000010051000-memory.dmp

        Filesize

        324KB

      • memory/2240-333-0x0000000000BD0000-0x0000000000FB8000-memory.dmp

        Filesize

        3.9MB

      • memory/2240-308-0x00000000005F0000-0x00000000005F3000-memory.dmp

        Filesize

        12KB

      • memory/2240-307-0x0000000010000000-0x0000000010051000-memory.dmp

        Filesize

        324KB

      • memory/2240-334-0x0000000010000000-0x0000000010051000-memory.dmp

        Filesize

        324KB

      • memory/2240-358-0x0000000010000000-0x0000000010051000-memory.dmp

        Filesize

        324KB

      • memory/2240-399-0x00000000049C0000-0x00000000049D0000-memory.dmp

        Filesize

        64KB

      • memory/2240-341-0x0000000000BD0000-0x0000000000FB8000-memory.dmp

        Filesize

        3.9MB

      • memory/2240-348-0x0000000010000000-0x0000000010051000-memory.dmp

        Filesize

        324KB

      • memory/2332-16-0x0000000002C60000-0x0000000003048000-memory.dmp

        Filesize

        3.9MB

      • memory/2332-15-0x0000000002C60000-0x0000000003048000-memory.dmp

        Filesize

        3.9MB

      • memory/2332-5-0x0000000002C60000-0x0000000003048000-memory.dmp

        Filesize

        3.9MB