57b68f91f97d09ef3b9e7d326c28aee98f1f78d656678f02bf7cb5c3e2a02e1e | Triage

Analysis

max time kernel
150s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 16:16

Sharing

Report Analysis Logs

General

Target

launcher.exe
Size

7.1MB
MD5

45fde662e7433ac3bbedcb39e3cea67a
SHA1

c140efbe43568a130aa297f9f7bdaf3bed62ce6c
SHA256

57b68f91f97d09ef3b9e7d326c28aee98f1f78d656678f02bf7cb5c3e2a02e1e
SHA512

febea1fe471b9ac6e28bbc8da059951621ccd6a8d927fb2ddc0b0aec0e6f581d15ead40ac59cfda7c7441af4839803818ecc2cd3101276d67a9cd3b528bc9ca2
SSDEEP

49152:xnJZqurlluYUASnmm8JNM5QQSyPhIuIFGhgkqKmQfzmGqHUsUTU8csdachnObdar:JJdr+QtvyLatoMwNMt

Score

1^/10

Malware Config

Signatures

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\discord-1105574242893959249\ = "URL:Run game 1105574242893959249 protocol"	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\discord-1105574242893959249\DefaultIcon	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\discord-1105574242893959249\shell\open\command	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\discord-1105574242893959249\shell	launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\discord-1105574242893959249\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\launcher.exe"	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\discord-1105574242893959249	launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\discord-1105574242893959249\URL Protocol	launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\discord-1105574242893959249\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\launcher.exe"	launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\discord-1105574242893959249\shell\open	launcher.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3956	launcher.exe
3956	launcher.exe
3956	launcher.exe
3956	launcher.exe
3956	launcher.exe
3956	launcher.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3956	launcher.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3956	launcher.exe

C:\Users\Admin\AppData\Local\Temp\launcher.exe
"C:\Users\Admin\AppData\Local\Temp\launcher.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads