Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

19/07/2024, 17:51

240719-wfd2basfmm 6

19/07/2024, 17:47

240719-wczhvaweje 6

19/07/2024, 17:46

240719-wb9x7asejk 1

Analysis

  • max time kernel
    103s
  • max time network
    112s
  • platform
    windows7_x64
  • resource
    win7-20240704-es
  • resource tags

    arch:x64arch:x86image:win7-20240704-eslocale:es-esos:windows7-x64systemwindows
  • submitted
    19/07/2024, 17:47

General

  • Target

    LauncherFenix-Minecraft-v7.jar

  • Size

    65KB

  • MD5

    fea39379db50e2a8feee8bac75ab769d

  • SHA1

    1b1df2b43088ddff1394d50d515901570ab18f40

  • SHA256

    e7b3db67c5b22fb6175be7299d1ad622d6183210d212ca3ce464292b627400f1

  • SHA512

    25487310a04b60b561d013b01e7d595e545e1da3b352e046774b95a54f2877ffad2b64d961dc8ed99532dc8c83719f0e281cf0540cf25e4b0708d2c5d64c7c79

  • SSDEEP

    1536:paoqO4pFE7IxmtlSBszOg+0HUad8vr7lK:p56K7ItBjgXHUYCnlK

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 43 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.jar
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://launcherfenix.com.ar/wope/register/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2800 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2016
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2608
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x4f8
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2112

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

      Filesize

      854B

      MD5

      8d1040b12a663ca4ec7277cfc1ce44f0

      SHA1

      b27fd6bbde79ebdaee158211a71493e21838756b

      SHA256

      3086094d4198a5bbd12938b0d2d5f696c4dfc77e1eae820added346a59aa8727

      SHA512

      610c72970856ef7a316152253f7025ac11635078f1aea7b84641715813792374d2447b1002f1967d62b24073ee291b3e4f3da777b71216a30488a5d7b6103ac1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      aa1f9acb2f62db92e27bc41b4e889cfa

      SHA1

      302c833b6363d7a4cbcf917fb5a525844540a1c7

      SHA256

      c19fe414aca7c660d0200ee24a6eda2993f51926745e4042094f7e191abec5b2

      SHA512

      78abc8732c47b9a1be5e19ca4b1ddddc9535baaeb2349b065fa9058b416159c40c53db45fdee3cc619102b79040b539a2585c8b2f861f41f1dd986ec8bebfb1e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      88f137f181e2425cbd07bab74ed05ec1

      SHA1

      7f0ff5dd95549eaf068b69d2a001da94d3a5ec94

      SHA256

      a82eefd20109accd7ed431c44a7f88168503b0f1fb760708b3f813037cf32d7f

      SHA512

      8ccc6821fc34aff93376a385c558dc7157db4685db9ae350367ecbddb665a9635fae79c45bed4dfeaf9d50a4d60ef27def33340a3a66873ec47fad52af48ad28

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b762caf0b7361bedb8638381a925ad36

      SHA1

      132b38f5b1350a5ccc83ff606deabaf8e275d991

      SHA256

      90ab549954667960e72d3a63e36904309f29958e2079a53202d080f39684c18a

      SHA512

      485b55fb088aee62c06636eed45496df63bf3413214011c60cb500bf4446d4f7212906c8ea4f043d59549e830eba70616b32f4f3b24cbe15582d9a3ac51cfd9e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d874771d24274c75aa4b7dfefb98ff36

      SHA1

      eadedcd5c0ce852aa72ecfc40030650a3ebae7ac

      SHA256

      c1aede7fb76a885275c1fd59c5343782c052a863a31daf4e2ab0cfcad72897c5

      SHA512

      5cb32f2d9fa2651aa0550cd4bcccc10d94937ab7167c38f17b9c41db9bbcc39f9126c05e4cf66d97b4323f276d090a74d590288ba178d20b98684a2cd779bc0e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d14d5ced5ffe568c8e0224bdde733229

      SHA1

      80f120663ad17cafc4b21b8f7e83a8909f93c1e3

      SHA256

      64faf7da3a5198958b1e426c645d8c9a1b7842b651c01240e9484d38fbe0a932

      SHA512

      daf3f48c0cd724e9142f6ce1569635a0ea5a418739fe1f9235c87b5fc601c117aa1a8bb52306ee408ab9dded1216936f484c25f87c24bacf659676765d8d7e5b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ffd5d88ed31442461fe2752d58af29c9

      SHA1

      ef4009de44c5bf34322b2ed9a834471686a2d424

      SHA256

      f6bdf665a9ac82a2334fcfdb8e54e4de0520ac32f92d818cfc3a643e5dc8a5ae

      SHA512

      8800b66307242ce1fd98ba8063acb29c9a1a2151e8bfd5dccd89d046dd60abd377d716bde4a29bcdc83807f92287d3db749412f67e21cdb98c892d4f48808f25

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      2ad847e5c3f228a48546066c38595532

      SHA1

      dedcb6490a89a64c0f3e83fccb8ff88ccbdffefc

      SHA256

      bd36a44aab79f15565a3047b2cdd91a57a0e6778142b067f9ceeb4a22e48bcfc

      SHA512

      e5dd7d183603923a13c486ed4b7b42f02b9aa1cc3c9eae25f339253124aee1ebfc20c9fafbd04fb4aa4e9e746caf6bc4973edef7fa06eccd67126c25960b25c6

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      cc7e4917efdcae66fc0c525c4094f550

      SHA1

      7d053f4d861c64c3dd0e1039f1b75b5db9dcaf7f

      SHA256

      3ee0cdb9d6a32430ffc472ad69467846ae882984ee6b8bb2aa981226aeb34df9

      SHA512

      c57e4bcdaf58f22b41160edb9e2dd7c869f4ee5442a75740fbe1bb129c00bb9a2a4154a4631fdc99052ce33b3f6bb0f57dad5a7bc9109c2768acf750310dfca8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      5d476a57e0991c120e3f9f26a3c9f03a

      SHA1

      fab1abaf204dab0f5be458c98604eae57ba4dfa7

      SHA256

      d89b07af167e392c5558d0ce8542010fe465d3ce9ada967056c219d5633fbd57

      SHA512

      894fb9dc8106c6da3d4dd6b35755b8bd450e3856492becaafe0f13dd5b516aabf8da68dbecd7d44d9e4474286906a09539aa5e21d8acc7f9dc85366044eb7bdd

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      cd265dbe5f593e0f64bc991858687e23

      SHA1

      e3e916bf4bf4d0ad5426e3a75613a6c41659e491

      SHA256

      16c8a5c70ee845ec14e12f6652d04692573566e555ec660dbdf8bd8884e97a0e

      SHA512

      fa304e9f088b9c970b60d1ae37ade4d6fa173c7c06ca5e72c9f8d67d78421b695e2ab53b6130246866b63d80e06b5d6637548bf2b6cade8e00e1a1d7b53d6624

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e4d69ea5b2811db63973718c4e41b30b

      SHA1

      523f207998e3521c4ef28fb1af4cba1f44ff95be

      SHA256

      40cc75d3712034d22c963b6b4846028b731e35d0c23d155c07cf6b5012dc1cbe

      SHA512

      8bc431f309bdaed6d1a2a56773b1eafd7df20465950ddbcceea6047ccf332c421f93a047559b429154a14054337c33ea99c12f9fdc6a2143644f344e3dce425b

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VCY0HBA7\favicon[2].ico

      Filesize

      9KB

      MD5

      5e5a72ca015d590326710f86127efe26

      SHA1

      f6007612de554a13c0de8f29dc3a81174d64614f

      SHA256

      61a5e8a6bdaba1c97ae554193de4a66228bd443d318990fd1df7471debe24ca6

      SHA512

      582b5e40850c1e4d954b93c1997d65b05c9d6310ddca529ec19d5150fc41bd53aad2b08c5c1be59d33fd0806b44d5c28e4f2a1eb05c721a31b6679a6da46de38

    • C:\Users\Admin\AppData\Local\Temp\Cab29C1.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar29C4.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • C:\Users\Admin\AppData\Roaming\.minecraft\launcherfenix.jar

      Filesize

      500KB

      MD5

      84591cf8bbe4b94d5a83b2cdd605d4b5

      SHA1

      85f1dbf03d2b4c52e067849b93c3f4c7ec284886

      SHA256

      b8c2bf47cb70a77582c302284554ecd4a29f9ee55c09fc2193b3ba942d5884ae

      SHA512

      31ff3523bedc87efd5040c46fdaff325c29fa109a912b729c81660c0737505e9dbd2f9bc0a443bfce12ede2569d023cc1f56f6bea0943a669f4f85e0f420830d

    • memory/2964-53-0x0000000000440000-0x0000000000441000-memory.dmp

      Filesize

      4KB

    • memory/2964-225-0x0000000000530000-0x000000000053A000-memory.dmp

      Filesize

      40KB

    • memory/2964-93-0x0000000000440000-0x0000000000441000-memory.dmp

      Filesize

      4KB

    • memory/2964-92-0x0000000000440000-0x0000000000441000-memory.dmp

      Filesize

      4KB

    • memory/2964-223-0x0000000002580000-0x00000000027F0000-memory.dmp

      Filesize

      2.4MB

    • memory/2964-224-0x00000000004A0000-0x00000000004AA000-memory.dmp

      Filesize

      40KB

    • memory/2964-55-0x0000000000440000-0x0000000000441000-memory.dmp

      Filesize

      4KB

    • memory/2964-226-0x0000000000530000-0x000000000053A000-memory.dmp

      Filesize

      40KB

    • memory/2964-62-0x0000000000440000-0x0000000000441000-memory.dmp

      Filesize

      4KB

    • memory/2964-61-0x0000000000440000-0x0000000000441000-memory.dmp

      Filesize

      4KB

    • memory/2964-91-0x0000000000440000-0x0000000000441000-memory.dmp

      Filesize

      4KB

    • memory/2964-56-0x0000000000440000-0x0000000000441000-memory.dmp

      Filesize

      4KB

    • memory/2964-36-0x0000000000530000-0x000000000053A000-memory.dmp

      Filesize

      40KB

    • memory/2964-2-0x0000000002580000-0x00000000027F0000-memory.dmp

      Filesize

      2.4MB

    • memory/2964-42-0x0000000000440000-0x0000000000441000-memory.dmp

      Filesize

      4KB

    • memory/2964-35-0x0000000000530000-0x000000000053A000-memory.dmp

      Filesize

      40KB

    • memory/2964-64-0x0000000000440000-0x0000000000441000-memory.dmp

      Filesize

      4KB

    • memory/2964-37-0x0000000000530000-0x000000000053A000-memory.dmp

      Filesize

      40KB

    • memory/2964-25-0x0000000000440000-0x0000000000441000-memory.dmp

      Filesize

      4KB

    • memory/2964-22-0x0000000000440000-0x0000000000441000-memory.dmp

      Filesize

      4KB

    • memory/2964-16-0x0000000000440000-0x0000000000441000-memory.dmp

      Filesize

      4KB

    • memory/2964-13-0x00000000004A0000-0x00000000004AA000-memory.dmp

      Filesize

      40KB

    • memory/2964-14-0x00000000004A0000-0x00000000004AA000-memory.dmp

      Filesize

      40KB

    • memory/2964-1049-0x0000000002580000-0x00000000027F0000-memory.dmp

      Filesize

      2.4MB