Analysis

  • max time kernel
    152s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 18:53

General

  • Target

    Launcher.exe

  • Size

    150.4MB

  • MD5

    e4483aed6275e7e66d5a559ad0444d78

  • SHA1

    09c6508c8fd9068220a7fa632fffc2d41877d344

  • SHA256

    af42e42f286a98231e728bcfc4267b730849a0b373833b609184435b9fd628f6

  • SHA512

    6d6e87000a35adedd391ca76f2bbf456095768c632fb8de0c1f718fa720f8d58e1f71001be7fcfd1cb311124b981677626de5994200088acc423a887b0bc5627

  • SSDEEP

    1572864:I9sIp9dePx3boQ9zPx3veCvI+RJjaWIxdaJgAOB3i3wFO6Bj3yTEQjB4UR9OEm3:Ke15JHHgw9m

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
    1⤵
    • Checks computer location settings
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5024
    • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1612,i,17469481753974594601,7079724724039943215,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:5036
      • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
        "C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --mojo-platform-channel-handle=1976 --field-trial-handle=1612,i,17469481753974594601,7079724724039943215,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
          PID:2324
        • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
          "C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2412 --field-trial-handle=1612,i,17469481753974594601,7079724724039943215,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
          2⤵
          • Checks computer location settings
          PID:432
        • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
          "C:\Users\Admin\AppData\Local\Temp\Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Launcher" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2676 --field-trial-handle=1612,i,17469481753974594601,7079724724039943215,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:8

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Roaming\Launcher\Network\Network Persistent State

              Filesize

              495B

              MD5

              39ab0912d0ba476f65236d99ab7d0b53

              SHA1

              0e30543901e29d86a7e9f0b122b4ee986f230056

              SHA256

              383542abb562734109773769f5b9b8b14801f0cdb5528cb3364207a852ddcf6d

              SHA512

              c09fc3d3625146721531867d06aa4091d8476f23543b3606368cd851d8fa69c2c15a91a122908278d272f5b1c983256eb4c0c9c59dacf23921a60d8be4bb7f63

            • C:\Users\Admin\AppData\Roaming\Launcher\Network\Network Persistent State~RFe5922ff.TMP

              Filesize

              59B

              MD5

              2800881c775077e1c4b6e06bf4676de4

              SHA1

              2873631068c8b3b9495638c865915be822442c8b

              SHA256

              226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

              SHA512

              e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

            • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

              Filesize

              2B

              MD5

              f3b25701fe362ec84616a93a45ce9998

              SHA1

              d62636d8caec13f04e28442a0a6fa1afeb024bbb

              SHA256

              b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

              SHA512

              98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

            • memory/8-79-0x0000021925E90000-0x0000021925E91000-memory.dmp

              Filesize

              4KB

            • memory/8-77-0x0000021925E90000-0x0000021925E91000-memory.dmp

              Filesize

              4KB

            • memory/8-78-0x0000021925E90000-0x0000021925E91000-memory.dmp

              Filesize

              4KB

            • memory/8-83-0x0000021925E90000-0x0000021925E91000-memory.dmp

              Filesize

              4KB

            • memory/8-84-0x0000021925E90000-0x0000021925E91000-memory.dmp

              Filesize

              4KB

            • memory/8-85-0x0000021925E90000-0x0000021925E91000-memory.dmp

              Filesize

              4KB

            • memory/8-86-0x0000021925E90000-0x0000021925E91000-memory.dmp

              Filesize

              4KB

            • memory/8-87-0x0000021925E90000-0x0000021925E91000-memory.dmp

              Filesize

              4KB

            • memory/8-88-0x0000021925E90000-0x0000021925E91000-memory.dmp

              Filesize

              4KB

            • memory/8-89-0x0000021925E90000-0x0000021925E91000-memory.dmp

              Filesize

              4KB

            • memory/5036-6-0x00007FFDAB1F0000-0x00007FFDAB1F1000-memory.dmp

              Filesize

              4KB