Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
10-07-2024 21:07
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://llaun.ch/installer
Resource
win11-20240709-en
General
-
Target
https://llaun.ch/installer
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exepid process 1848 msedge.exe 1848 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 4924 identity_helper.exe 4924 identity_helper.exe 4504 msedge.exe 4504 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
msedge.exepid process 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 936 wrote to memory of 2404 936 msedge.exe msedge.exe PID 936 wrote to memory of 2404 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 3904 936 msedge.exe msedge.exe PID 936 wrote to memory of 1848 936 msedge.exe msedge.exe PID 936 wrote to memory of 1848 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe PID 936 wrote to memory of 2472 936 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://llaun.ch/installer1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa64d93cb8,0x7ffa64d93cc8,0x7ffa64d93cd82⤵PID:2404
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,17167735166061492829,16471895892273733871,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:22⤵PID:3904
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,17167735166061492829,16471895892273733871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1848 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,17167735166061492829,16471895892273733871,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵PID:2472
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17167735166061492829,16471895892273733871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:3724
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17167735166061492829,16471895892273733871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:4928
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,17167735166061492829,16471895892273733871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4924 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,17167735166061492829,16471895892273733871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4504 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17167735166061492829,16471895892273733871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:12⤵PID:4028
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17167735166061492829,16471895892273733871,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:12⤵PID:1144
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17167735166061492829,16471895892273733871,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:3456
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,17167735166061492829,16471895892273733871,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:12⤵PID:4256
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,17167735166061492829,16471895892273733871,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5076 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3496
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1240
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4300
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c1ff2a88b65e524450bf7c721960d7db
SHA1382c798fcd7782c424d93262d79e625fcb5f84aa
SHA2562d12365f3666f6e398456f0c441317bc8ad3e7b089feacc14756e2ae87379409
SHA512f19c08edf1416435a7628064d85f89c643c248d0979ece629b882f600956f0d8cd93efbe253fa3ec61ad205233a8804807600f845e53e5ed8949290b80fe42d3
-
Filesize
152B
MD5562b59fd3a3527ef4e850775b15d0836
SHA1ffd14d901f78138fc2eece97c5e258b251bc6752
SHA2560a64863cb40f9d3b13a7b768b62e8b4707dfee1d3e86a07e999acb87bd7d3430
SHA512ef9fd3d83ab85b18cf0e0d17e2c7d71936f783e3ae38005e5c78742560332f88be7c4c936d4dc4179e93fde0240d2882d71ef7038289c8cbddbfc4790c0603c2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a87ada5-8587-41b3-a978-12b36d8e5791.tmp
Filesize6KB
MD5e64f924b68cbb4324ff80575751fc84b
SHA1cc49c321cb4bb1151107caee312bdc50e04a1838
SHA2560e79c38445770ada5c0433f62379a11f1a6addba1df95be57ade79a405f72a71
SHA512821597be81548b39bab06d3d6a6727adfc48b4b6eee860d9ec238b07646a331a5772b33db098dcdf7ec89538ace61cbb4d735d77f37ae468154808cb3a1cdcd2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD542bf954e19ed925de703227023c38ec0
SHA191302866b4c6793b2de4a65946fdd2e1779404aa
SHA2569161299dba96c8151df8f934d1b102a7c93a98c4839468ec7b9d8273888e43c3
SHA512e16953a71b210c825928aab53cf69b99e0afcd9b36135233398f50a0f67aaac165c421da92b735cef9c848ebec403b6a45044ec145187f1ae568fe400bc99957
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
535B
MD56288b5256a2e74ad0f257a291b8ad1f4
SHA1d628a71ad888c8738ebb95fb47caefe634dd1611
SHA256493e83eb93f8d5ade0a018b6ddc10f3587662872c069943fc2d77b77468b6413
SHA51264d838ced4673356643d678434d3fa58cb52a2c98f00fde1b9f08ee319021415ca95df4b54950c22bbfee1c401bea84017a9bc27719c460a760ab3f969493ed0
-
Filesize
5KB
MD54ce798f16df9285737a0d01619679839
SHA1d10431dfbd03df52777c8bc3347022b04e3482a4
SHA25624db0939a90adbb5ec3ab2fc89fd8a36f52791385e8de56e5a3f8e251db27742
SHA51234722b4e57c3df813aeff5d758f4428785399446756127bdde19be594f1b8eb4a0a89d87d8c7c6ef9fb8f0f5500f2a5b3ec97850191b95ee149eb186c8d740c3
-
Filesize
539B
MD53789a9be782270f796c1b3cb4aadf103
SHA1c5ab44f313d8d34362269efb4bf1804fcfe2b497
SHA2568b2b26f0ea630ff8b8b91d37b22e8a4a8844e1518a868e436963c8a9d88fedfe
SHA512d5b119b82d0aa02065f345e64df9b2650ce96a084aba507d29fb4eb0f9cd34c705c0726567476133e0b109bb50f125734a6aac6d5afc2bbdb3c29b29c21f3dff
-
Filesize
539B
MD5c0e5973d8e0fcaf4906ffd11022230f2
SHA1e57078627f0d18f8c6ab96b47437c885de4b3f9d
SHA25681c916e682c677c933307ca465f1eb07b1c57ece9542b16d278d2170af5aee40
SHA5123784f03864dae96b9070c4c56fdbf0f57e7f335789f45e5be2d34e18cf0db756b49e338c5b4d6231a1f9605048282b554ecdce20f30f69a13433f58fbec468e5
-
Filesize
539B
MD558fcd56e4821347319b299c0c736091c
SHA158b068c36c702c1e9c65e2475d7e847d0382daf0
SHA25690adebcf9bc3096b95618bb871043974a554bc46d5ae13b44ae216c66f622b25
SHA512caba171742e8457e6e0094f4d74dfa914775d52c4028d163a247bf8218fabaefe2d0550ba32a94d004f79a4c1c718b36f100512d2e50d5afa2dff0e6a7dd2f19
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
11KB
MD5f16dbc940c9acf6f43b6bf6f2ff0fdc6
SHA15ec32f942eb97e69a9c6262c9a42e452b9866461
SHA256356ec6ae7062c6c18aedb733029d66d41b1e3ca0efe2406b0b67eecba75b5851
SHA5121543b53ab035f87af6c9be5be5724474c3fc84e6a610b8c1e6cda2cd6f4715036c98216d42fe8474edf0498c92979b5013181d6b26a370917f3c3edcff65ed41
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e