Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

17/02/2024, 20:29

240217-y9yzpabb28 10

17/02/2024, 20:20

240217-y4ry7aba54 7

Analysis

  • max time kernel
    4s
  • max time network
    94s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    17/02/2024, 20:20

General

  • Target

    Launcher.exe

  • Size

    150.4MB

  • MD5

    0cc7c00bb4c982eb5f9f59054d1d1010

  • SHA1

    430e1ada5ee370347d9f5b565bc7fe305a38105a

  • SHA256

    8872eaa720e488e9b61a5c82409dcdcb58f29787e5393c50c7a911a8d7d00f59

  • SHA512

    c7fec4103ea69bd3a87f450e4a08cf8dab3bf0938ddf2a6fbb257768e810fe03e12733b167929108d830e7a2c636f349ebbe106d10f43ec95068f94f7a931b4d

  • SSDEEP

    1572864:b9sIp9dePx3boQ9zPx3veCvI+RJjaWIxdaJgAOB3i3wFO6Bj3yTEQjB4UR9OEm3:He15JHHgw9m

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=968 --field-trial-handle=1140,i,15968848652688762190,3467677236220961804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:2840
      • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
        "C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --mojo-platform-channel-handle=1300 --field-trial-handle=1140,i,15968848652688762190,3467677236220961804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
          PID:2580
        • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
          "C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1568 --field-trial-handle=1140,i,15968848652688762190,3467677236220961804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
          2⤵
          • Checks computer location settings
          PID:3056
        • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
          "C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=968 --field-trial-handle=1140,i,15968848652688762190,3467677236220961804,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
          2⤵
            PID:2788

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          35cd2bb7a790256cb6459627136e5ea8

          SHA1

          0ce8c35e14a982f923ac6bae0c36d359ec4a8fa0

          SHA256

          69c772ccf5d0a07c499ca9bbc557fb00f70aae31f2ab6240eab4deba7d86968d

          SHA512

          3a9e4be42dc430fa036ec01c7433b03e06cbf3929028f51b91bd4602cfb2c08df1223160142d7624b69e9f23bd321f8311dd5ddb7c3f1a8cad3fcdb543a49459

        • C:\Users\Admin\AppData\Local\Temp\Cab9040.tmp

          Filesize

          65KB

          MD5

          ac05d27423a85adc1622c714f2cb6184

          SHA1

          b0fe2b1abddb97837ea0195be70ab2ff14d43198

          SHA256

          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

          SHA512

          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

        • C:\Users\Admin\AppData\Local\Temp\Tar9504.tmp

          Filesize

          171KB

          MD5

          9c0c641c06238516f27941aa1166d427

          SHA1

          64cd549fb8cf014fcd9312aa7a5b023847b6c977

          SHA256

          4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

          SHA512

          936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

        • C:\Users\Admin\AppData\Roaming\Launcher\DawnCache\data_0

          Filesize

          8KB

          MD5

          cf89d16bb9107c631daabf0c0ee58efb

          SHA1

          3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

          SHA256

          d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

          SHA512

          8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

        • C:\Users\Admin\AppData\Roaming\Launcher\DawnCache\data_2

          Filesize

          8KB

          MD5

          0962291d6d367570bee5454721c17e11

          SHA1

          59d10a893ef321a706a9255176761366115bedcb

          SHA256

          ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

          SHA512

          f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

        • C:\Users\Admin\AppData\Roaming\Launcher\DawnCache\data_3

          Filesize

          8KB

          MD5

          41876349cb12d6db992f1309f22df3f0

          SHA1

          5cf26b3420fc0302cd0a71e8d029739b8765be27

          SHA256

          e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

          SHA512

          e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

        • C:\Users\Admin\AppData\Roaming\Launcher\GPUCache\data_1

          Filesize

          264KB

          MD5

          f50f89a0a91564d0b8a211f8921aa7de

          SHA1

          112403a17dd69d5b9018b8cede023cb3b54eab7d

          SHA256

          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

          SHA512

          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

        • C:\Users\Admin\AppData\Roaming\Launcher\Local Storage\leveldb\CURRENT~RFf7676f4.TMP

          Filesize

          16B

          MD5

          46295cac801e5d4857d09837238a6394

          SHA1

          44e0fa1b517dbf802b18faf0785eeea6ac51594b

          SHA256

          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

          SHA512

          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

        • memory/1664-33-0x0000000002500000-0x0000000002501000-memory.dmp

          Filesize

          4KB

        • memory/2840-1-0x0000000000060000-0x0000000000061000-memory.dmp

          Filesize

          4KB

        • memory/2840-32-0x0000000077810000-0x0000000077811000-memory.dmp

          Filesize

          4KB