Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
292s -
max time network
277s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 23:34
Static task
static1
Behavioral task
behavioral1
Sample
LauncherFenix-Minecraft-v7.jar
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
LauncherFenix-Minecraft-v7.jar
Resource
win10v2004-20240704-en
General
-
Target
LauncherFenix-Minecraft-v7.jar
-
Size
65KB
-
MD5
fea39379db50e2a8feee8bac75ab769d
-
SHA1
1b1df2b43088ddff1394d50d515901570ab18f40
-
SHA256
e7b3db67c5b22fb6175be7299d1ad622d6183210d212ca3ce464292b627400f1
-
SHA512
25487310a04b60b561d013b01e7d595e545e1da3b352e046774b95a54f2877ffad2b64d961dc8ed99532dc8c83719f0e281cf0540cf25e4b0708d2c5d64c7c79
-
SSDEEP
1536:paoqO4pFE7IxmtlSBszOg+0HUad8vr7lK:p56K7ItBjgXHUYCnlK
Malware Config
Signatures
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "2" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "1" svchost.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1015551233-1106003478-1645743776-1000\{36A255AA-7A05-47F3-96C8-506D10E94510} svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2876 OpenWith.exe 116 java.exe 116 java.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.jar1⤵
- Suspicious use of SetWindowsHookEx
PID:116
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵PID:184
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:2876
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:5092
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
500KB
MD584591cf8bbe4b94d5a83b2cdd605d4b5
SHA185f1dbf03d2b4c52e067849b93c3f4c7ec284886
SHA256b8c2bf47cb70a77582c302284554ecd4a29f9ee55c09fc2193b3ba942d5884ae
SHA51231ff3523bedc87efd5040c46fdaff325c29fa109a912b729c81660c0737505e9dbd2f9bc0a443bfce12ede2569d023cc1f56f6bea0943a669f4f85e0f420830d
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c