9b32dc0f60ce7f0947fd272aee3cec8fa39a7ed8a7c71d0c2195ed940ae3f5fd

Analysis

max time kernel
25s
max time network
17s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe
Size

37.3MB
MD5

3cf0dfa36df4d9475383e7b8c139d643
SHA1

85f26ad8c7dd148eaf28fdd2be51ded1c16fbaab
SHA256

9b32dc0f60ce7f0947fd272aee3cec8fa39a7ed8a7c71d0c2195ed940ae3f5fd
SHA512

0940c0b6bc50e86a63606bfdcf7ad14ad53131872fefce2697b02ded3d4b8ee7f7f21cf5b3d6af150196b734a0ab084a71c79c9e30f4594a909475027cd58487
SSDEEP

786432:tQCxLzQ5ErrLoc0a5fwsudiHnLuGqLhKnrxh/XR0AKBl:t5LRrL5judAnLuG6UrD/X4l

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1720	prismlauncher.exe

Loads dropped DLL 6 IoCs

pid	Process
2276	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe
2276	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe
2276	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe
2276	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe
1720	prismlauncher.exe
1720	prismlauncher.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2856	TaskKill.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\curseforge\shell	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\curseforge\shell\open	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\curseforge\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\PrismLauncher\\prismlauncher.exe\" \"%1\""	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\curseforge	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\curseforge\URL Protocol	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\curseforge\shell\open\command	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2856	TaskKill.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2856	2276	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe	28
PID 2276 wrote to memory of 2856	2276	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe	28
PID 2276 wrote to memory of 2856	2276	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe	28
PID 2276 wrote to memory of 2856	2276	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe	28
PID 2276 wrote to memory of 2856	2276	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe	28
PID 2276 wrote to memory of 2856	2276	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe	28
PID 2276 wrote to memory of 2856	2276	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe	28
PID 2276 wrote to memory of 1720	2276	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe	31
PID 2276 wrote to memory of 1720	2276	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe	31
PID 2276 wrote to memory of 1720	2276	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe	31
PID 2276 wrote to memory of 1720	2276	PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe	31

C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe
"C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Cracked-Windows-MinGW-w64-Setup-8.3.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\TaskKill.exe
  TaskKill /IM prismlauncher.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Gui.dll

Filesize
9.2MB

MD5
93aeb30fa6a30fb3e16057c66cccace9

SHA1
d1de323d368b56a05b365c8ac0fa3f35f0e5058b

SHA256
098ac4f7eda347ff9abaf6d34334d620c6dfab3f90c33aca29f4fe7b8202a665

SHA512
660288bc132bbfaa7ce9f9303d524fffc18314c4cdb73fdaaa451d22bf21891f272e70db836d996067bf3eb94998df9688c749c83f261d7d5a7ba1b9c485e914

Download Submit
C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Widgets.dll

Filesize
7.7MB

MD5
2ff0c7b5b644448f4baeab14fdb9fce9

SHA1
d48d5dbb14de8b06baafe1bf15ca6b858d837f54

SHA256
dce9a722d44d3ec739eb06ded3db6735eb08e64d593b22575cd1487e4a91bd14

SHA512
2a7aee32932c174dff074d6a7fa8f142e8ed4310db994de3caf9b24162a7c28e7bc53f37c5550698965c70a0585623f58516d5db9918f62277611662770c0ac3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi1517.tmp\modern-wizard.bmp

Filesize
25KB

MD5
cbe40fd2b1ec96daedc65da172d90022

SHA1
366c216220aa4329dff6c485fd0e9b0f4f0a7944

SHA256
3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

SHA512
62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

Download Submit
\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe

Filesize
14.6MB

MD5
a6a44316f2ae9918ff05fb65a00c7d9f

SHA1
a8df26e6780e0dae83060ea0330a9bd1d074433a

SHA256
14b8cf33a14f23ad02658173c2b9674d29bb0c27ec66759967ed524f066c0041

SHA512
4109f7e9a4be0cbeaefda2c6ff79f203f0566cc414d01ce06dd7e726207b70cc2fc6bb53ab09527863c12d3ff001631e38f4ed288f6fe5224a2630c3682ab292

Download Submit
\Users\Admin\AppData\Local\Temp\nsi1517.tmp\System.dll

Filesize
12KB

MD5
192639861e3dc2dc5c08bb8f8c7260d5

SHA1
58d30e460609e22fa0098bc27d928b689ef9af78

SHA256
23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

SHA512
6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

Download Submit
\Users\Admin\AppData\Local\Temp\nsi1517.tmp\nsDialogs.dll

Filesize
9KB

MD5
b7d61f3f56abf7b7ff0d4e7da3ad783d

SHA1
15ab5219c0e77fd9652bc62ff390b8e6846c8e3e

SHA256
89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912

SHA512
6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8

Download Submit
\Users\Admin\AppData\Local\Temp\nsi1517.tmp\nsExec.dll

Filesize
7KB

MD5
11092c1d3fbb449a60695c44f9f3d183

SHA1
b89d614755f2e943df4d510d87a7fc1a3bcf5a33

SHA256
2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77

SHA512
c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a

Download Submit