Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    45s
  • max time network
    52s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14/06/2024, 01:06

General

  • Target

    LauncherBFH-Last.exe

  • Size

    719KB

  • MD5

    a2fd9f0e50ce7bdba610a94c6631029c

  • SHA1

    666e589cced96647add94fa0d6e715d567a62caf

  • SHA256

    fb8e948e91a2ba3f8405f21a234d23f8d64f39cb9b4f9cb2580d14b4732b4e34

  • SHA512

    d2f15d1cb7026b8a842957ac8e5146eeffc7785d7383e58a2599d86720d1f9100152f7d96202eb8db10f8f4515e7037765d59b3a2833777eca9e8b8f814e1079

  • SSDEEP

    12288:lhAJjgTqySggXAfMTtx8eX5VUQWwGltdfgmXShq4AuGXcB7:l28TIXOGXzLuTfdXSc3XcB7

Score
1/10

Malware Config

Signatures

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LauncherBFH-Last.exe
    "C:\Users\Admin\AppData\Local\Temp\LauncherBFH-Last.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1892
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

    Filesize

    10KB

    MD5

    df46eb1fe5d54a0521d9965203a4a9da

    SHA1

    e977aae1bb82f3d57267ead3b91df3d82d6d50c6

    SHA256

    6076a9ea8f52f5ad109fbe29f955ee052f626b22ee45366bfa83f70706744b1d

    SHA512

    5bc5f8d247ba164f1af6f4ae902906568a4e9baf05c9782d999e537730d8cfe443daac6f44aa246f27e9678237a4b57a7e8411e3c4fbe88e943525cdb2ae239e

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kyunrtop.qyg.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/1892-30-0x0000000008550000-0x000000000859A000-memory.dmp

    Filesize

    296KB

  • memory/1892-43-0x000000000B1D0000-0x000000000B1EE000-memory.dmp

    Filesize

    120KB

  • memory/1892-4-0x0000000004D10000-0x0000000004D1A000-memory.dmp

    Filesize

    40KB

  • memory/1892-5-0x00000000740C0000-0x0000000074871000-memory.dmp

    Filesize

    7.7MB

  • memory/1892-2-0x0000000005180000-0x0000000005726000-memory.dmp

    Filesize

    5.6MB

  • memory/1892-13-0x00000000066A0000-0x00000000066A8000-memory.dmp

    Filesize

    32KB

  • memory/1892-14-0x00000000085D0000-0x0000000008BFA000-memory.dmp

    Filesize

    6.2MB

  • memory/1892-1-0x0000000000230000-0x00000000002EA000-memory.dmp

    Filesize

    744KB

  • memory/1892-23-0x0000000008320000-0x000000000833A000-memory.dmp

    Filesize

    104KB

  • memory/1892-24-0x0000000008380000-0x00000000083B6000-memory.dmp

    Filesize

    216KB

  • memory/1892-25-0x0000000009280000-0x00000000098FA000-memory.dmp

    Filesize

    6.5MB

  • memory/1892-26-0x0000000008460000-0x00000000084F6000-memory.dmp

    Filesize

    600KB

  • memory/1892-28-0x0000000008C00000-0x0000000008C66000-memory.dmp

    Filesize

    408KB

  • memory/1892-29-0x0000000008440000-0x000000000845E000-memory.dmp

    Filesize

    120KB

  • memory/1892-3-0x0000000004C70000-0x0000000004D02000-memory.dmp

    Filesize

    584KB

  • memory/1892-0-0x00000000740CE000-0x00000000740CF000-memory.dmp

    Filesize

    4KB

  • memory/1892-45-0x000000000B470000-0x000000000B47A000-memory.dmp

    Filesize

    40KB

  • memory/1892-32-0x0000000009060000-0x00000000090C6000-memory.dmp

    Filesize

    408KB

  • memory/1892-33-0x0000000009100000-0x0000000009122000-memory.dmp

    Filesize

    136KB

  • memory/1892-34-0x0000000009C60000-0x0000000009CAC000-memory.dmp

    Filesize

    304KB

  • memory/1892-27-0x00000000083F0000-0x0000000008412000-memory.dmp

    Filesize

    136KB

  • memory/1892-44-0x000000000B1F0000-0x000000000B294000-memory.dmp

    Filesize

    656KB

  • memory/1892-31-0x0000000009900000-0x0000000009C57000-memory.dmp

    Filesize

    3.3MB

  • memory/1892-46-0x000000000B5E0000-0x000000000B5F1000-memory.dmp

    Filesize

    68KB

  • memory/1892-47-0x000000000B610000-0x000000000B61E000-memory.dmp

    Filesize

    56KB

  • memory/1892-48-0x000000000B620000-0x000000000B635000-memory.dmp

    Filesize

    84KB

  • memory/1892-49-0x000000000B660000-0x000000000B67A000-memory.dmp

    Filesize

    104KB

  • memory/1892-50-0x000000000B6A0000-0x000000000B6A8000-memory.dmp

    Filesize

    32KB

  • memory/1892-51-0x00000000740CE000-0x00000000740CF000-memory.dmp

    Filesize

    4KB

  • memory/1892-53-0x00000000740C0000-0x0000000074871000-memory.dmp

    Filesize

    7.7MB