Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
30/05/2024, 01:31
General
-
Target
SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.11805.11027.exe
-
Size
3.2MB
-
MD5
13ca60d73776b420ada5cc15848f8dfb
-
SHA1
22bece82795e9c60d76c19f22f777f3b19af10d8
-
SHA256
fbb5302b06f7e6824ecdaf59162f3a08557cac0efe6b40b4502eab60ecd04d82
-
SHA512
7074d3fb777563a94dde036cab647cfc72c115e140343ec25f6921a5689b4d381b60012dfa0fb2b1ea17621ff90ca4c225cd3f2e71c1a6bab935c33610f4dafc
-
SSDEEP
98304:VSiRz+JwCh4p8zdpHzEugKdTHvjgJLTiH7BUB:3zI48v1r1EsY
Malware Config
Signatures
-
Downloads MZ/PE file
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Script User-Agent 7 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.11805.11027.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.11805.11027.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8BAKL.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.11805.11027.tmp"C:\Users\Admin\AppData\Local\Temp\is-8BAKL.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.11805.11027.tmp" /SL5="$40212,2484196,893952,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.11805.11027.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.11805.11027.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.11805.11027.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTcwMzI2NzEsImRpc3RpbmN0X2lkIjoiOEZDODFEOUMtRkU0Mi00OThELUJENTAtM0QwQjkyMDM3QkNBIiwiZGVmYXVsdF9icm93c2VyIjoiTVNFZGdlSFRNIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuNC4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImIiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImIiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0= /LAUNCHER /VERYSILENT3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-TCO40.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.11805.11027.tmp"C:\Users\Admin\AppData\Local\Temp\is-TCO40.tmp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.11805.11027.tmp" /SL5="$601E6,2484196,893952,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.not-a-virus.HEUR.WebToolbar.Win32.Olaunch.gen.11805.11027.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTcwMzI2NzEsImRpc3RpbmN0X2lkIjoiOEZDODFEOUMtRkU0Mi00OThELUJENTAtM0QwQjkyMDM3QkNBIiwiZGVmYXVsdF9icm93c2VyIjoiTVNFZGdlSFRNIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuNC4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImIiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImIiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0= /LAUNCHER /VERYSILENT4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_.exe"C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTcwMzI2NzEsImRpc3RpbmN0X2lkIjoiOEZDODFEOUMtRkU0Mi00OThELUJENTAtM0QwQjkyMDM3QkNBIiwiZGVmYXVsdF9icm93c2VyIjoiTVNFZGdlSFRNIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuNC4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImIiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImIiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0=5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-EI2LF.tmp\OneLaunch Setup_.tmp"C:\Users\Admin\AppData\Local\Temp\is-EI2LF.tmp\OneLaunch Setup_.tmp" /SL5="$10228,105339801,893952,C:\Users\Admin\AppData\Local\Temp\OneLaunch Setup_.exe" /PDATA=eyJpbnN0YWxsX3RpbWUiOjE3MTcwMzI2NzEsImRpc3RpbmN0X2lkIjoiOEZDODFEOUMtRkU0Mi00OThELUJENTAtM0QwQjkyMDM3QkNBIiwiZGVmYXVsdF9icm93c2VyIjoiTVNFZGdlSFRNIiwiaW5pdGluYWxfdmVyc2lvbiI6IjUuMzEuNC4wIiwicGFja2FnZWRfYnJvd3NlciI6Ik5vbmUiLCJzcGxpdCI6ImIiLCJub19zcGxpdCI6ZmFsc2UsInNwbGl0MiI6ImIiLCJzZXJ2ZXJfc2lkZV9zcGxpdF8yOF8xMV9udHBfZGlzdHJpYnV0aW9uIjoiY29udHJvbCIsImVuY29kZWRfc3BsaXRzIjoiMDAwIn0=6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD55c6dc4f810bf08224a748763e915d294
SHA157e9256e9aeaafd45e4bdc8461f5fcb73f65302e
SHA25644f80edcbb47c543b362916340af40e5e0f5fa38c1c17713af1ab463d1389e9d
SHA5128a834ad640ea17ff74d4956d968fe4f5dc657f8fe152eaab778363b2d301733eca2ae01227e20ed9ed88b9eaabe2914a1e388ecea214effdce6725dd28164a15
-
Filesize
363B
MD5a4d4dc66a41d9c3b54a2ed3ee8d4b3df
SHA1e91a5e7a6690c14c6f799e2433beb2f6388c4df6
SHA25646e9c171e2115cd43e5d05f6a5f6015b27bda065fbab939916fee2fd5c06d5a4
SHA51299d5425aa653b93d0b6065020f88c095c39d982fb20a0ed0078418e8e862a104b4f0392791c79d2df86410a0ba5ba60e644852943a9fc602f7eaf82fecaaefd4
-
Filesize
5KB
MD52257b1d0d33a41f509e7c3e117819f8b
SHA187583bfbc655aec4e8cc4465b341c3f7889a6317
SHA256d43e4b285b5b54313b53e87d2a56ca9ba0c85f8f55c9c5fdcdb4fac815ff4d02
SHA512702d1a126a0a7a64af5cee9450daeed74364aa9e9f123e1bc398ecd4215c082e7f55e43dd292a4119749e84999b015109bff8b11732df11143d202b385411cc5
-
Filesize
24KB
MD52484489c7443ec4745488a77ed084d80
SHA1fcf49d1be8bbbae3d0dea49bb5e677fb19d98d9d
SHA25670b6921812f29b698f454927802db818c1625402baefd53ced1bfb9135c17d5a
SHA512a4776969b6bf215a85e7cfbc8f13dbb1beb4ef42eb5abfa572bb7f54c0032941c8bb178e7b77eda0c442741c29fccb02d8de157068dd31203bfed4e49ce051a5
-
Filesize
725KB
MD500de2dff1787f6d7904189476b307bfb
SHA1098a2c23f651d08730927adc8c63518744b199f9
SHA256cc24488a078d3e92dd7dfb96c22cebd4004ee7fcb297a438e2d3848b633a9f71
SHA51233a06affebca41e4580279d3ab0f5a2e798584f1ac7f15a19b2364825caba06d8cf57d4ea1ae15bb41d7b14b6ed48f0d3f472c4a4231b7ff792bfca97e93250f
-
Filesize
3.0MB
MD5ac664be735b76d24824d7cfd4ec8096d
SHA1f3d4942c15491c5b9d8e582958f19da2258fd9db
SHA2562e39a9112aeb59cee246f88db4f8e7d12aaee96ff23a82ec87f540657ae59127
SHA5128c3c501fd744c08afab43b4fea02095808f22fa379007dc03c5b5409b15b7cebf8a679573b2e6c666809e24f6cd7f86f0cd4cfc42f3187e2076a724a424ccf73
-
Filesize
46KB
MD5564f2dfb6bef1f47798dfb5d182232f0
SHA1290a5ad705a85e7fb26efcdc5374cd39738ad242
SHA256671fb4649ddd8428c7f6fd1e14b30fd4735efbbb8c142e2662e157d87f96c9c0
SHA512492091b1ecb0e36f3d01a7b6d516d836224966dc6e8ec9bcdc2254d252f9530c9b9b45ac10d5216761d557cda2454e3d53060b42e55f6a95631baca29199926b
-
Filesize
70KB
MD5d3110fb775ee7fd24426503d67840c25
SHA154f649c8bf3af2ad3a4d92cd8b1397bad1a49a75
SHA256f8392390dc81756e79ec5f359dbdcac3b4bd219b5188a429b814fc51aabb6e36
SHA512f6b79f728be17c9060edb2df2dac2b0f59a4dffd8c416e7e957bc3fa4696f4237e5969647309f5425a6297f189e351e20c99c642f90d1476050285929657c32f
-
Filesize
1.2MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
584KB
-
Filesize
3.0MB
-
Filesize
80KB
-
Filesize
3.0MB
-
Filesize
80KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
728KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
928KB
-
Filesize
928KB
