Analysis
- max time kernel
117s - max time network
118s - platform
windows7_x64 - resource
win7-20240215-en - resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system - submitted
24/02/2024, 17:42
Static task
static1
Behavioral task
behavioral1
Sample
TLauncher.exe
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
TLauncher.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target TLauncher.exe
- Size 8.9MB
- Sample240224-v92tsshg42
- SHA256 978dfe8f0fbb57398366e2302055b58fa641258f53db6909fca2b5a1e87ff3c5
- MD5 505731086d2f448e68c025a7003efe00
- SHA1 e8358cf87df55712a7b6998d1816e94b57f3b7c1
- SHA512 856ad2f0caa72c15b20831c7e1d8917329907381e1e95ce470ff3592755804cc17cd507c105d49fdecbc418a2c3f2b01e1be2ce15dc981aeb7f39ce2889cb4d4
- SSDEEP 196608:vRAQAHQHWFm5kAiFWnuf6J/+Ift24xJN+vwvasDU6sU0s:LUn6nDJ/+v4xJprUB4
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f97de74867da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{10C34FF1-D33C-11EE-A4DC-6EC9990C2B7A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000df602162e88788d87e344d132563be50261bb4849e05a87c02dd3734993fcaf4000000000e8000000002000020000000d6d3233130ad9ac2eb979195fa5ed3697433c2f408d654d68c3f0ff26e6e0d742000000018950336568cac5d16d04d94c3532e16875fd3fce47e245c75368dbde6bbd9f440000000fe043e2ce4139b896711e7c5fa08c92ff5e4e2acdba1b33a9d61eff3ca605d77e73fd8f913f34f238d88cff2383e1079cf15d944b7726778be1f37630a6d505f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000068d16ea97aea6bed5e536226d9305a8a101026c2a19f766db9537d75ceb3be73000000000e80000000020000200000008bd2d1b85c7fa8d272e329b2565536c2ab46ca1a1b743b869aa4f8c4f221f31390000000103353660d87b9c276697f32a3f799403ea84c5a170156bfbd35f2266eaf2dd3c03126f5efe091ab729ab2f77172924f58a9be9031399d35319b36d8ebcaecc3ad2bc7a86ea3e9d2f4bbb29b36d96fc248690789cf93add4022f078e2eec1c7f96b48ce2aafb6470acfb0db4bdafe8c5933923661c08c5cc6e3a36b37473b144d28cb0c3bf5127314e4ef4eef3e3b3d74000000093fbbc13b316eb5abb0e136a7efdf100900f8752002ed8acc9d9a83bee33a20575388842774f7b9c7dc0aa137e79dd0909d92f455e7488d34e0bc5f5643889cc iexplore.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1776 TLauncher.exe 2940 iexplore.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2940 iexplore.exe 2940 iexplore.exe 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1776 wrote to memory of 2940 1776 TLauncher.exe 28 PID 1776 wrote to memory of 2940 1776 TLauncher.exe 28 PID 1776 wrote to memory of 2940 1776 TLauncher.exe 28 PID 1776 wrote to memory of 2940 1776 TLauncher.exe 28 PID 2940 wrote to memory of 2936 2940 iexplore.exe 29 PID 2940 wrote to memory of 2936 2940 iexplore.exe 29 PID 2940 wrote to memory of 2936 2940 iexplore.exe 29 PID 2940 wrote to memory of 2936 2940 iexplore.exe 29 PID 2940 wrote to memory of 2936 2940 iexplore.exe 29 PID 2940 wrote to memory of 2936 2940 iexplore.exe 29 PID 2940 wrote to memory of 2936 2940 iexplore.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\TLauncher.exe"C:\Users\Admin\AppData\Local\Temp\TLauncher.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://java-for-minecraft.com/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2936
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 0c5c67e0ec28349f8c08f9d3b51059c283c770cc0aad3a05c4ed47e55fb3ab73
- MD5 1c042ca3925958b03ad589dfaacb9adc
- SHA1 8553b96966ee7bc2fe533d6015c4fb59b59a384b
- SHA512 b125f5e67fcc6abb4a027dfd9947e2908ed7ab2ea10be5976a8d00210045e69caa28b15254efd91940da1b7f7966f4abd2974ab2812bacf44ff169c8ef3bdc6d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 a623fc940068afe8796ff0dc26717cce160d97f12f85d2caa2f59bb7e5810cfc
- MD5 490079d803d7c2312cd28a2c1e3591ce
- SHA1 01da72aa6467baddc4d83dbfc10afac5a797c495
- SHA512 da9693651650f2b6ccf0fbc109d6cb574fc309d0ee3fef8b43647f6fc0f96facc7fdea816a46a45ef401118da63046f3069f0f9f0e73b446fd42d88494626c98
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 078afc71e0fcaf87c6f703b99c6852612e5cb0ad2bf94e8b3cfb70351920c861
- MD5 660fd5e77af5743ba58d7d21082b51e1
- SHA1 b94ac773cdbd2d9ec6b82c6c0ba8ec9844be0bd7
- SHA512 06d250065f7ca56850aad0c3df416f869682afb1e7a00d1b6fbb88463342f788405e4f0d7542256527d32221a636dbba3a6fec6913b6374b2e115014dcdd83f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 d3d2e3bf353a002cddc9cc0dde53c58db48c6d3a97741152f43c386acdc77df7
- MD5 6a200019f2a13711d719e5e0373c05af
- SHA1 116b2e9dcf4a954975d2f958875f3f6bbddf89ec
- SHA512 087340d16ced9dc13bb46fa2935932292539f7e316bc785aee9d6d8b9aa18857cc52d71242548ef07142b1258b829924e0a88eedcd7bdb76dc0c2648962593ea
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 d8b1f1497d9a69d8a5c617ab0580462a8b083a69360e3ccccd5ba0b04fac563d
- MD5 8efcffdad9caa4c267a199d4b61b0014
- SHA1 31f3a42b7aa9b97bd18bc22c9a537e21e655dec4
- SHA512 89242bea20900c58314b85540562314c62b3a14a2a0ae3b679c51278660a469e50eb0cfc9eafa17a1d4287180038f4f5ede5fd104556081df10fa19a4852933f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 f9ee78829f96a03a4fa8dff2749ff6f5d58b58dac8baa61ce61d7754a717c0ef
- MD5 4a895a2a1ee1590015546f93d3d6e1ae
- SHA1 adb9f8c986bb8258d4f9374d6f9a8504e7fedaac
- SHA512 b3016d71a30fbc510e7592403dfd4b075d18a439eb9e9d58a1f99e99ba670a8d4b289d3a23fa7f879b2aae0e4ced8cbabfa8c5a479a44c7655dbd75bdfa036c1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 8f417be7fef3c518a36b84bacfb82b80b1ff6b2e50971837cad071f5bd022d59
- MD5 1a7850c98d22e50a79ac6d7e6c437e5b
- SHA1 4277a91471a7f93dfee25c866e0db1013c27c037
- SHA512 8b0f1c4f32d8920844fbcc6666b7149b93e20c974c1c4443f23c6c6d238cafec9cf26711957af4841b41163245a773db10a063dad44afaeff10beeed733c7c36
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 566960c018d490f9e4e76c89b0e3405622de41355532892e82651416de3564d0
- MD5 f0faeca5f0bc32885ae1cbd847badda3
- SHA1 a7c45d10ceadf01aaa33a12e29a3c99f36b99a82
- SHA512 3832d2bba755966320c6b6c7624620c99dd6c8dae1c0d11ba67a40045f6f6729714647d8655f7b4562d43d8ec5a29b33c9394b3057246d590f7dd1f40c8b9f6c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 6ab5355b89543f7d9003f59485f4e27ba4e66b5c7c640cca804861aedfc3a6b2
- MD5 f34e4e18da3ff073f3f33bfc73823090
- SHA1 a8c289985358294583bd7b775e87e71b37402f66
- SHA512 e884f734c95be012b41dd4004c4f1e06b4dfce153f9de76dbf3c04276074ebebed2a3e112ac83076e13559734cb398df6dcac36c126d4fc2b705fce163be8edf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 d86fbd45316cdee5180588d6a0bc6916d68527876c1746592c817f6a66ea9f61
- MD5 8f516186cf103207b25319b514bb57f6
- SHA1 f4d3d4424c1869b6ad3b0f4df08a97f3e6c77807
- SHA512 58ad495a6775709263264f87a7e541fbd023e7b7a2f14578635b53cce3f5f15585003e990a1ae52fdc53181d49af256e302f5494e057297f1c9604b8b0d1e65d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab4980.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar4981.tmp
- Size 171KB
- SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
- MD5 9c0c641c06238516f27941aa1166d427
- SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
- SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
- SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
- MD5 SHA1 SHA512 SSDEEP