b37d102269745982438db2a8203182336d084b4638027e086969f363c25612ef

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 07:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Launcher__3687.exe
Size

1.2MB
MD5

ea7e076c616859ef73885b3e5699e875
SHA1

e4e023fbae59495abf1ea90aab8990da14e6b270
SHA256

96a7dc48c2dbd614b916c1bf6dc4a3ccdd91bf120895d039a263bd5d25870854
SHA512

3f727def58e6aeb5c31b5db316fd4d46071f2e759ee23f7c513a5285133e129a9168bf6375584499a1f57ba09373c4cb4bbe3fd9c6ca342f10488024d9000290
SSDEEP

12288:FmOyCqqYWFqbzvy3TtzxwkUAR+JYuIo7NQL8ZGlZoB//MilWNWWR2DrkgEl8vgs4:hyCDY+YEZoB/EqfDrk1Ov7aIZp+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}\LocalServer32	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Launcher__3687.exe"	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}\TypeLib\ = "{9cecabe0-c413-4831-8d04-d2c64adfd5e5}"	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9CECABE0-C413-4831-8D04-D2C64ADFD5E5}\1.0	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9CECABE0-C413-4831-8D04-D2C64ADFD5E5}\1.0\FLAGS	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F67F0BAF-4AD5-402A-AE2E-6F635181F618}\TypeLib	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F67F0BAF-4AD5-402A-AE2E-6F635181F618}\TypeLib\Version = "1.0"	Launcher__3687.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\printed.silicic.1\CLSID	Launcher__3687.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\printed.silicic\CurVer	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\printed.silicic\CurVer\ = "printed.silicic.1"	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}\ProgID	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}\TypeLib	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9CECABE0-C413-4831-8D04-D2C64ADFD5E5}\1.0\FLAGS\ = "0"	Launcher__3687.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9CECABE0-C413-4831-8D04-D2C64ADFD5E5}\1.0\HELPDIR	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9CECABE0-C413-4831-8D04-D2C64ADFD5E5}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F67F0BAF-4AD5-402A-AE2E-6F635181F618}\ = "IBoot"	Launcher__3687.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F67F0BAF-4AD5-402A-AE2E-6F635181F618}	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9CECABE0-C413-4831-8D04-D2C64ADFD5E5}\1.0\0	Launcher__3687.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\printed.silicic.1	Launcher__3687.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\printed.silicic	Launcher__3687.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F67F0BAF-4AD5-402A-AE2E-6F635181F618}\TypeLib	Launcher__3687.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F67F0BAF-4AD5-402A-AE2E-6F635181F618}	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F67F0BAF-4AD5-402A-AE2E-6F635181F618}\TypeLib	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F67F0BAF-4AD5-402A-AE2E-6F635181F618}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F67F0BAF-4AD5-402A-AE2E-6F635181F618}\ProxyStubClsid32	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F67F0BAF-4AD5-402A-AE2E-6F635181F618}\TypeLib\ = "{9CECABE0-C413-4831-8D04-D2C64ADFD5E5}"	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9CECABE0-C413-4831-8D04-D2C64ADFD5E5}\1.0\ = "InstallerLib"	Launcher__3687.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}\ProgID	Launcher__3687.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}\VersionIndependentProgID	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F67F0BAF-4AD5-402A-AE2E-6F635181F618}\TypeLib\Version = "1.0"	Launcher__3687.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9CECABE0-C413-4831-8D04-D2C64ADFD5E5}\1.0\0\win32	Launcher__3687.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9CECABE0-C413-4831-8D04-D2C64ADFD5E5}\1.0\0	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}\ = "Inst Class"	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}\Version	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}\Version\ = "1.0"	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9CECABE0-C413-4831-8D04-D2C64ADFD5E5}\1.0\HELPDIR	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F67F0BAF-4AD5-402A-AE2E-6F635181F618}	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\printed.silicic.1	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F67F0BAF-4AD5-402A-AE2E-6F635181F618}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}\ProgID\ = "printed.silicic.1"	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9CECABE0-C413-4831-8D04-D2C64ADFD5E5}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Launcher__3687.exe"	Launcher__3687.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F67F0BAF-4AD5-402A-AE2E-6F635181F618}\ProxyStubClsid32	Launcher__3687.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F67F0BAF-4AD5-402A-AE2E-6F635181F618}\TypeLib	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Launcher__3687.exe\""	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9CECABE0-C413-4831-8D04-D2C64ADFD5E5}	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F67F0BAF-4AD5-402A-AE2E-6F635181F618}	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F67F0BAF-4AD5-402A-AE2E-6F635181F618}\TypeLib\ = "{9CECABE0-C413-4831-8D04-D2C64ADFD5E5}"	Launcher__3687.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}\Version	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}\VersionIndependentProgID\ = "printed.silicic"	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F67F0BAF-4AD5-402A-AE2E-6F635181F618}\ = "IBoot"	Launcher__3687.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9CECABE0-C413-4831-8D04-D2C64ADFD5E5}\1.0\FLAGS	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}\VersionIndependentProgID	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}\Programmable	Launcher__3687.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F67F0BAF-4AD5-402A-AE2E-6F635181F618}\ProxyStubClsid32	Launcher__3687.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9CECABE0-C413-4831-8D04-D2C64ADFD5E5}	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}\LocalServer32	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9CECABE0-C413-4831-8D04-D2C64ADFD5E5}\1.0\0\win32	Launcher__3687.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d0bc8c13-636d-470f-9b6e-7ebb750009b9}\Programmable	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\printed.silicic.1\CLSID	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\printed.silicic.1\CLSID\ = "{d0bc8c13-636d-470f-9b6e-7ebb750009b9}"	Launcher__3687.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\printed.silicic	Launcher__3687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\printed.silicic\ = "Inst Class"	Launcher__3687.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2420	Launcher__3687.exe
2420	Launcher__3687.exe

C:\Users\Admin\AppData\Local\Temp\Launcher__3687.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher__3687.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...