Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
84s -
max time network
202s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
14/01/2024, 23:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/982728136313692180/1196233850783813752/VincentLauncher.exe?ex=65b6e296&is=65a46d96&hm=873d06698447455a9fd85935401018bb14004af76d8363d0ccb193fe95368b56&
Resource
win11-20231215-en
General
-
Target
https://cdn.discordapp.com/attachments/982728136313692180/1196233850783813752/VincentLauncher.exe?ex=65b6e296&is=65a46d96&hm=873d06698447455a9fd85935401018bb14004af76d8363d0ccb193fe95368b56&
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 3408 VincentLauncher.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133497484155594784" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4468 chrome.exe 4468 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4468 chrome.exe 4468 chrome.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe Token: SeShutdownPrivilege 4468 chrome.exe Token: SeCreatePagefilePrivilege 4468 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe 4468 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4468 wrote to memory of 3828 4468 chrome.exe 49 PID 4468 wrote to memory of 3828 4468 chrome.exe 49 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3740 4468 chrome.exe 82 PID 4468 wrote to memory of 3432 4468 chrome.exe 84 PID 4468 wrote to memory of 3432 4468 chrome.exe 84 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83 PID 4468 wrote to memory of 948 4468 chrome.exe 83
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/982728136313692180/1196233850783813752/VincentLauncher.exe?ex=65b6e296&is=65a46d96&hm=873d06698447455a9fd85935401018bb14004af76d8363d0ccb193fe95368b56&1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff86fcb9758,0x7ff86fcb9768,0x7ff86fcb97782⤵PID:3828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1540,i,9768608913152839686,15959931221537581567,131072 /prefetch:22⤵PID:3740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2140 --field-trial-handle=1540,i,9768608913152839686,15959931221537581567,131072 /prefetch:82⤵PID:948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1540,i,9768608913152839686,15959931221537581567,131072 /prefetch:82⤵PID:3432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1540,i,9768608913152839686,15959931221537581567,131072 /prefetch:12⤵PID:3820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2940 --field-trial-handle=1540,i,9768608913152839686,15959931221537581567,131072 /prefetch:12⤵PID:4296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1540,i,9768608913152839686,15959931221537581567,131072 /prefetch:82⤵PID:3116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5344 --field-trial-handle=1540,i,9768608913152839686,15959931221537581567,131072 /prefetch:82⤵PID:4700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5288 --field-trial-handle=1540,i,9768608913152839686,15959931221537581567,131072 /prefetch:82⤵PID:2536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 --field-trial-handle=1540,i,9768608913152839686,15959931221537581567,131072 /prefetch:82⤵PID:4160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 --field-trial-handle=1540,i,9768608913152839686,15959931221537581567,131072 /prefetch:82⤵PID:5060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5384 --field-trial-handle=1540,i,9768608913152839686,15959931221537581567,131072 /prefetch:82⤵PID:4940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5436 --field-trial-handle=1540,i,9768608913152839686,15959931221537581567,131072 /prefetch:82⤵PID:4412
-
-
C:\Users\Admin\Downloads\VincentLauncher.exe"C:\Users\Admin\Downloads\VincentLauncher.exe"2⤵
- Executes dropped EXE
PID:3408
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1018B
MD5eec1a9d6bc625a10522118f6bebb8154
SHA15d8c95fed617bf44051139d8ad3f064a2c27164d
SHA2561d1bbee6133fa72c7acfad80b062cd9f7d0b113e310b225e0999a575bf531d8d
SHA512a8069e8ada253da37034358fad284e52a0b16c59bf3b485cf3453dd0fea95c0d3fe4a4e3bb9dbafd13ce3483c6e6bb4ea00a8d82b2b082af2d2d7a67908a3205
-
Filesize
6KB
MD54e5312547ebe483cbd6695f9ca5a6026
SHA1cd9f9275cc9b4ea6ee9213e17c8c8e3d837714df
SHA256cf301edf63b6e39dfef3f01daa2ef79f55a8a29816d72d9a0438d081d9e404a2
SHA512fc09801586e976c4db3c62137249f667825141dc8a559a179e7dd28e5b2e32dbfa3b5b85677d599065ac41cce6bf783f88590616abcec410a7ed29991ff492b6
-
Filesize
114KB
MD5dac66ded010a1b4b67ee2aadeb72bb5e
SHA170a561881dbd9ecf3fe73df7d577b200fdd9ac90
SHA256af44825f823893de02bd4df9beefb147642113219066534bf7f2a8f845dfb83b
SHA51286d69430bbe9347e4769e750e579478bd3b8acc69f63230a1f93f03bfc9024e0515ddd9fb674544c7d518734f5ef010d84b6ee2a3c2b5dc8ab5cdaf7d33164e0
-
Filesize
114KB
MD5ad6d1d8b7298cfacf45c2326243853ce
SHA1a89545a5df199fde6d43920f5effd64444bbd211
SHA256408e2184948ee612f9188eff482d2fddfb12d9d249bab750838352de80d9ca8b
SHA512298eeac0a868961d68c4cb3c4fbbe0ca286d027ea976ff932222e01570891be8c18d077906e9eaea0c74b36b3a9d09b89b2e3e1f06564d081631f7c4ee544e6d
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
222KB
MD51c6dce2293b67c0a8f9a55a2f182c19d
SHA11c87c2578583a09d64fc6d396e0b2e3d583a4e88
SHA25690b600bea7b5cb201e13b64b2cf26b9da4eb6b57e69e8b39eb3f7ff8dac85468
SHA5125f4170f1bbd39179d97ac155fcdb5c5c91e1b63ba8bbf66df1f89e49f9c7271aa98a83b0b537cafd78b10a1253de3d2832bf5bc379643ddeda81f9d9fabb175e