Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3Launcher S....0.exe
windows7-x64
7Launcher S....0.exe
windows10-2004-x64
7$PLUGINSDIR/app-64.7z
windows7-x64
3$PLUGINSDIR/app-64.7z
windows10-2004-x64
7Launcher.exe
windows7-x64
7Launcher.exe
windows10-2004-x64
7$R0/Uninst...er.exe
windows7-x64
7$R0/Uninst...er.exe
windows10-2004-x64
7Analysis
-
max time kernel
4s -
max time network
94s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
17/02/2024, 20:20
Static task
static1
Behavioral task
behavioral1
Sample
Launcher Setup 9.4.0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Launcher Setup 9.4.0.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/app-64.7z
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/app-64.7z
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
Launcher.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
Launcher.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
$R0/Uninstall Launcher.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
$R0/Uninstall Launcher.exe
Resource
win10v2004-20231215-en
General
-
Target
Launcher.exe
-
Size
150.4MB
-
MD5
0cc7c00bb4c982eb5f9f59054d1d1010
-
SHA1
430e1ada5ee370347d9f5b565bc7fe305a38105a
-
SHA256
8872eaa720e488e9b61a5c82409dcdcb58f29787e5393c50c7a911a8d7d00f59
-
SHA512
c7fec4103ea69bd3a87f450e4a08cf8dab3bf0938ddf2a6fbb257768e810fe03e12733b167929108d830e7a2c636f349ebbe106d10f43ec95068f94f7a931b4d
-
SSDEEP
1572864:b9sIp9dePx3boQ9zPx3veCvI+RJjaWIxdaJgAOB3i3wFO6Bj3yTEQjB4UR9OEm3:He15JHHgw9m
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\International\Geo\Nation Launcher.exe Key value queried \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\International\Geo\Nation Launcher.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2840 1664 Launcher.exe 28 PID 1664 wrote to memory of 2580 1664 Launcher.exe 29 PID 1664 wrote to memory of 2580 1664 Launcher.exe 29 PID 1664 wrote to memory of 2580 1664 Launcher.exe 29 PID 1664 wrote to memory of 3056 1664 Launcher.exe 30 PID 1664 wrote to memory of 3056 1664 Launcher.exe 30 PID 1664 wrote to memory of 3056 1664 Launcher.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=968 --field-trial-handle=1140,i,15968848652688762190,3467677236220961804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --mojo-platform-channel-handle=1300 --field-trial-handle=1140,i,15968848652688762190,3467677236220961804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵PID:2580
-
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1568 --field-trial-handle=1140,i,15968848652688762190,3467677236220961804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
- Checks computer location settings
PID:3056
-
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=968 --field-trial-handle=1140,i,15968848652688762190,3467677236220961804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535cd2bb7a790256cb6459627136e5ea8
SHA10ce8c35e14a982f923ac6bae0c36d359ec4a8fa0
SHA25669c772ccf5d0a07c499ca9bbc557fb00f70aae31f2ab6240eab4deba7d86968d
SHA5123a9e4be42dc430fa036ec01c7433b03e06cbf3929028f51b91bd4602cfb2c08df1223160142d7624b69e9f23bd321f8311dd5ddb7c3f1a8cad3fcdb543a49459
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23