Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 22:30
Static task
static1
Behavioral task
behavioral1
Sample
TLauncher-Installer-1.4.2.exe
Resource
win7-20240215-en
windows7-x64
8 signatures
150 seconds
General
- Target TLauncher-Installer-1.4.2.exe
- Size 22.3MB
- Sample240603-2e6mtsbd6v
- SHA256 8f657e915ef6ab8f9f0ecb653f2b79b19a6e68bb14d997b4b8c6e005c3923453
- MD5 7467a35cd1f34498c32d68fc11cf2dd6
- SHA1 3349ad795ff859a581f8d1c99d735f1817ca17e6
- SHA512 840fdc04e600fd6e0c01d2ee03b0e2f904f08ef1e59dce14b9c4897fa1971f4ad8431321e3061ef09ae981bcae5f008e613f8497745e29f9f007842877b6efa5
- SSDEEP 393216:/25KXSlsQ8C+Q5JIkc2rr6of5MJ7ZWqxPAIgtMIMlFRqH0fHbS1K8kn/rbhQyDkd:GKXWsQ8CJIArrKJBH5lFRqH0fYk/pUJn
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation TLauncher-Installer-1.4.2.exe - Executes dropped EXE 1 IoCs
pid Process 5100 irsetup.exe - Loads dropped DLL 3 IoCs
pid Process 5100 irsetup.exe 5100 irsetup.exe 5100 irsetup.exe -
resource yara_rule behavioral2/files/0x000800000002341d-5.dat upx behavioral2/memory/5100-14-0x0000000000880000-0x0000000000C69000-memory.dmp upx behavioral2/memory/5100-598-0x0000000000880000-0x0000000000C69000-memory.dmp upx - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1088 taskmgr.exe Token: SeSystemProfilePrivilege 1088 taskmgr.exe Token: SeCreateGlobalPrivilege 1088 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe 1088 taskmgr.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 5100 irsetup.exe 5100 irsetup.exe 5100 irsetup.exe 5100 irsetup.exe 5100 irsetup.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4792 wrote to memory of 5100 4792 TLauncher-Installer-1.4.2.exe 84 PID 4792 wrote to memory of 5100 4792 TLauncher-Installer-1.4.2.exe 84 PID 4792 wrote to memory of 5100 4792 TLauncher-Installer-1.4.2.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.4.2.exe"C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.4.2.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1773458 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\TLauncher-Installer-1.4.2.exe" "__IRCT:3" "__IRTSS:23398040" "__IRSID:S-1-5-21-4124900551-4068476067-3491212533-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5100
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico
- Size 116KB
- SHA256 9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946
- MD5 e043a9cb014d641a56f50f9d9ac9a1b9
- SHA1 61dc6aed3d0d1f3b8afe3d161410848c565247ed
- SHA512 4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f
- SSDEEP 1536:5HmLYAoZllsaebGVeTZ8Sz3HjpAAAAADYmaAAGg:UfoZll0bGVmjWh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe
- Size 1.6MB
- SHA256 4007ca82da52600902ad2e269445e0ae15701187d111ba7f59546c7dfe1fc3dc
- MD5 2885c4a1dc2bc52ea298b8d9c7e1bfbb
- SHA1 964bff819cbfd38692900403460c67b9d0dae8b0
- SHA512 e0480ece21136a29a727fe99001fae8a9009a4ce92bb1a48644cf20dfc57fe70cb685b6427a6582f85ac2ffee93d85fe91c7cb1bc5b8e2121f3cb38907da2e50
- SSDEEP 49152:XjJKHU/NJB2sr5Ciz4CsQ0/jYJE7z8E0j:XDVa25CicCf0/j78EC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd
- Size 1.7MB
- SHA256 89acf7a60e1d3f2bd7804c0cd65f8c90d52606d2a66906c8f31dce2e0ea66606
- MD5 dabd469bae99f6f2ada08cd2dd3139c3
- SHA1 6714e8be7937f7b1be5f7d9bef9cc9c6da0d9e9b
- SHA512 9c5fd1c8f00c78a6f4fd77b75efae892d1cb6baa2e71d89389c659d7c6f8b827b99cecadb0d56c690dd7b26849c6f237af9db3d1a52ae8531d67635b5eff5915
- SSDEEP 49152:aQQJFZfr5eA+qQ7SGi3jHjGmlmdS8y0hJvPd0YoCaJ7vEPmdVQtMnVaRTxiax:aQQJFRle40y3jHCmlmdS10hVOYoJ7v7w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd
- Size 97KB
- SHA256 7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
- MD5 da1d0cd400e0b6ad6415fd4d90f69666
- SHA1 de9083d2902906cacf57259cf581b1466400b799
- SHA512 f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a
- SSDEEP 1536:yIawRwRrXBV+PG8BBrZQrcyNoHpjGfaVgY+JmNSGjsf9jbtJRh6:ewgXBMPG8BBrKoHZGSn+8Mksf9jhJO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
- Size 1.2MB
- SHA256 fe88a318681b47a1e9aad79cd8b42fed323555fed23a04633b1bd16921380d86
- MD5 cd0ba34e6182159d0c7a70c40fa0bf6e
- SHA1 a20c20dee4b7ecd1e2c1f6b025e2766b583e2c38
- SHA512 2c540e510bd22fd70dc6393599b13aa1cd820b8434692b4fb2cdc60c08f4c03e4a4d0357e75672d4c08573d15ba3d1e62692756c30be00226225b5bec0efd79e
- SSDEEP 24576:QS/FpqUzjJFXAHR3+/NJBcrsr5/OrUbmIz4CsQsF/jYSuEOuzs:7jJKHU/NJB2sr5Ciz4CsQ0/jYJE7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
- Size 325KB
- SHA256 fad540071986c59ec40102c9ca9518a0ddce80cf39eb2fd476bb1a7a03d6eb34
- MD5 c333af59fa9f0b12d1cd9f6bba111e3a
- SHA1 66ae1d42b2de0d620fe0b7cc6e1c718c6c579ed0
- SHA512 2f7e2e53ba1cb9ff38e580da20d6004900494ff7b7ae0ced73c330fae95320cf0ab79278e7434272e469cb4ea2cbbd5198d2cd305dc4b75935e1ca686c6c7ff4
- SSDEEP 6144:kpF7LK5bwfYggoCQxltnoqhMQ3WxAOj+JzOgm:M7Igvnoz0Wx8x
- MD5 SHA1 SHA512 SSDEEP