Analysis

  • max time kernel
    72s
  • max time network
    41s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    22/02/2024, 18:03

General

  • Target

    TLauncher-2.885-Installer-1.1.3.exe

  • Size

    22.6MB

  • MD5

    bd3eefe3f5a4bb0c948251a5d05727e7

  • SHA1

    b18722304d297aa384a024444aadd4e5f54a115e

  • SHA256

    f1b132f7ecf06d2aa1dd007fc7736166af3ee7c177c91587ae43930c65e531e0

  • SHA512

    d7df966eeda90bf074249ba983aac4ba32a7f09fe4bb6d95811951df08f24e55e01c790ffebc3bc50ce7b1c501ff562f0de5e01ca340c8596881f69f8fed932d

  • SSDEEP

    393216:KXGWOLBh2NPfs/dQETVlOBbpFEjdGphRqV56HpkoaH3D8P2Q6YS6x9DOc:K2/BhSHExi73qqHpu34kYbzOc

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TLauncher-2.885-Installer-1.1.3.exe
    "C:\Users\Admin\AppData\Local\Temp\TLauncher-2.885-Installer-1.1.3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2428
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1910546 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-2.885-Installer-1.1.3.exe" "__IRCT:3" "__IRTSS:23661420" "__IRSID:S-1-5-21-3281913400-1494313570-2321515684-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:1408
  • C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\CompressStep.bmp"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2108
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
    1⤵
      PID:2312
    • C:\Windows\system32\mspaint.exe
      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\DebugPublish.jpeg" /ForceBootstrapPaint3D
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4628
    • C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
      "C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:1964
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:408

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

              Filesize

              2B

              MD5

              d751713988987e9331980363e24189ce

              SHA1

              97d170e1550eee4afc0af065b78cda302a97674c

              SHA256

              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

              SHA512

              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

              Filesize

              233B

              MD5

              972b2d09e61075ccbbd32311c65f53f7

              SHA1

              4f5268ff03f2423831f5842ff4b062cdf7717106

              SHA256

              1a4c4e16d58e153d4e523f36df0e7c6e7d8fcdf77a59e1215dfd5321bef65539

              SHA512

              2e61cce3678b1e6601dc9fb7b76a55f963502a84d9b556911ad93a6ff37468c31106d983e767e3d4d0686d9f2d42f0bc914abd7dde5c28545d7f303decd73d02

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json

              Filesize

              2KB

              MD5

              404a3ec24e3ebf45be65e77f75990825

              SHA1

              1e05647cf0a74cedfdeabfa3e8ee33b919780a61

              SHA256

              cc45905af3aaa62601a69c748a06a2fa48eca3b28d44d8ec18764a7e8e4c3da2

              SHA512

              a55382b72267375821b0a229d3529ed54cef0f295f550d1e95661bafccec606aa1cd72e059d37d78e7d2927ae72e2919941251d233152f5eeb32ffdfc96023e5

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

              Filesize

              116KB

              MD5

              e043a9cb014d641a56f50f9d9ac9a1b9

              SHA1

              61dc6aed3d0d1f3b8afe3d161410848c565247ed

              SHA256

              9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

              SHA512

              4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

              Filesize

              1.8MB

              MD5

              cb50d496ae05fa1c8bfbcb3b7f910bfe

              SHA1

              3ec4d77b73c4d7e9858b11224314e99d082497a8

              SHA256

              7616c72f6659a3a2439d0452190459cd4ceb83fab2307e3e47c9604fa29d9f34

              SHA512

              22051de06c7e52a37ad36250aa095a8ccc0b0e1cdbfa2e9073c146e77e278cbdbe89bdb078dcfd8babf48baec1902b303ac39cc9db4114ce1516b06552dc924d

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.PNG

              Filesize

              280B

              MD5

              5803b5d5f862418b64caa83396e69c7f

              SHA1

              97b6c8209b8ad65f4f9f3b953fe966bb09ee4e13

              SHA256

              ee340f8560ba2e71d7e6d305b959ff8fa77869dac916287da2bff7ce5aa2e159

              SHA512

              e9bf37f0c89299bfa369a8677ac56b12177dd3153246e5e6a9390577658111b731b0ab987044d30f43e05cb41d79ed31dae3b6f4521f225925920617d0414edd

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG

              Filesize

              281B

              MD5

              60a19921c7ff3c75e28c302f95460994

              SHA1

              07ac64ffbb153c8675e2ce0651afeaa5e8c6652d

              SHA256

              33341d30463fbc7cf3fba5070925569c822b6835aabdb8ef2c3cf09547912d46

              SHA512

              b30b960152dc13b1a9d384c4972169392cd405bdf4d3ecf73f85cf8a9a68a075131b2495c0348f54d43d0e7a279907bc7b76ac103f4a624738cbfc73bbeeba02

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

              Filesize

              1.3MB

              MD5

              a70accbc1f1001cbf1c4a139e4e5d7af

              SHA1

              138de36067af0c8f98e1f7bc4c6bea1d73bc53ab

              SHA256

              b000fef41ce0267255701aacc76c02159d207212c4595437077e7904b7968ca6

              SHA512

              46fde27847dfab38d2f6fefca31677a0d5a5ac775951fc19f1fc0b4ec56969622f0c4f036ecacc05b33854871f03232a4944f3e93a747280cac622503f5c4f04

            • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

              Filesize

              326KB

              MD5

              80d93d38badecdd2b134fe4699721223

              SHA1

              e829e58091bae93bc64e0c6f9f0bac999cfda23d

              SHA256

              c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59

              SHA512

              9f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4

            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

              Filesize

              1.7MB

              MD5

              1bbf5dd0b6ca80e4c7c77495c3f33083

              SHA1

              e0520037e60eb641ec04d1e814394c9da0a6a862

              SHA256

              bc6bd19ab0977ac794e18e2c82ace3116bf0537711a352638efd2d8d847c140b

              SHA512

              97bc810871868217f944bc5e60ab642f161c1f082bc9e4122094f10b4e309a6d96e3dd695553a20907cb8fea5aef4802f5a2f0a852328c1a1cd85944022abaab

            • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

              Filesize

              97KB

              MD5

              da1d0cd400e0b6ad6415fd4d90f69666

              SHA1

              de9083d2902906cacf57259cf581b1466400b799

              SHA256

              7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

              SHA512

              f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

            • memory/1408-334-0x0000000000B20000-0x0000000000F08000-memory.dmp

              Filesize

              3.9MB

            • memory/1408-335-0x0000000010000000-0x0000000010051000-memory.dmp

              Filesize

              324KB

            • memory/1408-302-0x0000000006280000-0x0000000006283000-memory.dmp

              Filesize

              12KB

            • memory/1408-295-0x0000000010000000-0x0000000010051000-memory.dmp

              Filesize

              324KB

            • memory/1408-8-0x0000000000B20000-0x0000000000F08000-memory.dmp

              Filesize

              3.9MB