582dc7e5514965dabde42bc4c560a2ee62d268ffb138a770fdd4a55fc9b7da1b | Triage

Analysis

max time kernel
24s
max time network
25s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 12:23

Sharing

Report Analysis Logs

General

Target

Onix Launcher.exe
Size

1.8MB
MD5

b05dc19989592ec3aea1a408d2bab0a0
SHA1

9d64f2db4a8e66736c9f10bbac1f47e533197465
SHA256

582dc7e5514965dabde42bc4c560a2ee62d268ffb138a770fdd4a55fc9b7da1b
SHA512

8c3a923a87f2d27006da71fef1ea5093a5c409a062f45cc3f5942da375d0b3dfed093657e5ca9f1b66fe8d117a569a36359ce157a800712e431c78dfd1d3ab07
SSDEEP

49152:dPzL3G65fuF8i50UStEz9CQ4QSKE75m4RMEvhq:dv3M9RfzkWs1vk

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
5044	Onix Launcher.exe
5044	Onix Launcher.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\discord-1020720961944813621\ = "URL:Run game 1020720961944813621 protocol"	Onix Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\discord-1020720961944813621\DefaultIcon	Onix Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\discord-1020720961944813621\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Onix Launcher.exe"	Onix Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\discord-1020720961944813621\shell	Onix Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\discord-1020720961944813621\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Onix Launcher.exe"	Onix Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\discord-1020720961944813621	Onix Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\discord-1020720961944813621\URL Protocol	Onix Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\discord-1020720961944813621\shell\open\command	Onix Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\discord-1020720961944813621\shell\open	Onix Launcher.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5044	Onix Launcher.exe
5044	Onix Launcher.exe
5044	Onix Launcher.exe
5044	Onix Launcher.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5044	Onix Launcher.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5044	Onix Launcher.exe
5044	Onix Launcher.exe
5044	Onix Launcher.exe

C:\Users\Admin\AppData\Local\Temp\Onix Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Onix Launcher.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A7A38D59054943F2C317C1A978E027EC69483F60.tmp.dll

Filesize
1.9MB

MD5
274120cc4cb27b87c916410c46971190

SHA1
738a725cb19109c6867345e706f6e34d8809b38f

SHA256
dd17146eed10fdbc839d274aae9faccf5b9c3fe54aa02ef7cf6d72b37869a837

SHA512
289e3d9bf491e9fa48f54c936427eb2eee42733bef2f9462897cf80101d30274e3fe29846ca7a9a5018c96b84803739fd0615841606cc853d9bfb82aa84993a3

Download Submit