Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
19/07/2024, 17:51
240719-wfd2basfmm 619/07/2024, 17:47
240719-wczhvaweje 619/07/2024, 17:46
240719-wb9x7asejk 1Analysis
-
max time kernel
103s -
max time network
112s -
platform
windows7_x64 -
resource
win7-20240704-es -
resource tags
arch:x64arch:x86image:win7-20240704-eslocale:es-esos:windows7-x64systemwindows -
submitted
19/07/2024, 17:47
Static task
static1
Behavioral task
behavioral1
Sample
LauncherFenix-Minecraft-v7.jar
Resource
win7-20240704-es
Behavioral task
behavioral2
Sample
LauncherFenix-Minecraft-v7.jar
Resource
win10v2004-20240704-es
General
-
Target
LauncherFenix-Minecraft-v7.jar
-
Size
65KB
-
MD5
fea39379db50e2a8feee8bac75ab769d
-
SHA1
1b1df2b43088ddff1394d50d515901570ab18f40
-
SHA256
e7b3db67c5b22fb6175be7299d1ad622d6183210d212ca3ce464292b627400f1
-
SHA512
25487310a04b60b561d013b01e7d595e545e1da3b352e046774b95a54f2877ffad2b64d961dc8ed99532dc8c83719f0e281cf0540cf25e4b0708d2c5d64c7c79
-
SSDEEP
1536:paoqO4pFE7IxmtlSBszOg+0HUad8vr7lK:p56K7ItBjgXHUYCnlK
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\launcherfenix.com.ar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\launcherfenix.com.ar\Total = "29" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\launcherfenix.com.ar\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000007c9e1391738038fb254465b9b681b201383a9f42781de4fe632e1881d87d79a000000000e8000000002000020000000817a6eab8fc4b546d17a1574d49fabfd207d4bb6740a75ceb426aeb76be6bb4c900000002dac787bb13e8a59d1b86e73ebc8b7e965c144c22ea82fce464bc6f6bf851aba878b451980d331feed8781e0bd4837b6fd9557c40e7698314f7c891ddee3b1754469a28acd7da9cb669e60a48ddaac0f1dda2cecccc9fd61dd3751873de437f257cd7d815201bd315ca41b6802aff049864fb5ae546cdd99414d0ad68cb72c7495a793a67e9d2d36f0ee3a80a7a4a744400000000793ae01fecd7dd801cce6cdd77bc8159b1881fe352eef88635dc4b23b8c5fd0dd0c423b9c0767231bc90dd9a2255bf710a958ca4ba123dfaabeb8b28a104281 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B7F87A1-45F7-11EF-A41F-62DBEBFF7CE3} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\launcherfenix.com.ar\ = "29" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000009328720f451bbdf46249f8645afa73517ed3be1bdb0ceb1b12c7967bf34dec95000000000e8000000002000020000000c73407b72bfc150ed525d7eca5598e1b78cab93a72e55c20a7dafa378cbf96be20000000d717cf3d3883c89cdbf07220a8933954b59de3b09da9f2c111393dae789dbcef4000000023e1a6faaa48a48ae2f54b8478f89ea1a7405dbffeaed50cccfda582a8cceea4db9f33589a21ab459c9406126ef59c4136c2baa669e8ff7d7c5695beef8afde0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "29" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a260f103dada01 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 2112 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2112 AUDIODG.EXE Token: 33 2112 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2112 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2800 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2964 java.exe 2964 java.exe 2964 java.exe 2964 java.exe 2800 iexplore.exe 2800 iexplore.exe 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE 2964 java.exe 2964 java.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2800 2964 java.exe 32 PID 2964 wrote to memory of 2800 2964 java.exe 32 PID 2964 wrote to memory of 2800 2964 java.exe 32 PID 2800 wrote to memory of 2016 2800 iexplore.exe 33 PID 2800 wrote to memory of 2016 2800 iexplore.exe 33 PID 2800 wrote to memory of 2016 2800 iexplore.exe 33 PID 2800 wrote to memory of 2016 2800 iexplore.exe 33
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://launcherfenix.com.ar/wope/register/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2800 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2016
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2608
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f81⤵
- Suspicious use of AdjustPrivilegeToken
PID:2112
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
854B
MD58d1040b12a663ca4ec7277cfc1ce44f0
SHA1b27fd6bbde79ebdaee158211a71493e21838756b
SHA2563086094d4198a5bbd12938b0d2d5f696c4dfc77e1eae820added346a59aa8727
SHA512610c72970856ef7a316152253f7025ac11635078f1aea7b84641715813792374d2447b1002f1967d62b24073ee291b3e4f3da777b71216a30488a5d7b6103ac1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa1f9acb2f62db92e27bc41b4e889cfa
SHA1302c833b6363d7a4cbcf917fb5a525844540a1c7
SHA256c19fe414aca7c660d0200ee24a6eda2993f51926745e4042094f7e191abec5b2
SHA51278abc8732c47b9a1be5e19ca4b1ddddc9535baaeb2349b065fa9058b416159c40c53db45fdee3cc619102b79040b539a2585c8b2f861f41f1dd986ec8bebfb1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588f137f181e2425cbd07bab74ed05ec1
SHA17f0ff5dd95549eaf068b69d2a001da94d3a5ec94
SHA256a82eefd20109accd7ed431c44a7f88168503b0f1fb760708b3f813037cf32d7f
SHA5128ccc6821fc34aff93376a385c558dc7157db4685db9ae350367ecbddb665a9635fae79c45bed4dfeaf9d50a4d60ef27def33340a3a66873ec47fad52af48ad28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b762caf0b7361bedb8638381a925ad36
SHA1132b38f5b1350a5ccc83ff606deabaf8e275d991
SHA25690ab549954667960e72d3a63e36904309f29958e2079a53202d080f39684c18a
SHA512485b55fb088aee62c06636eed45496df63bf3413214011c60cb500bf4446d4f7212906c8ea4f043d59549e830eba70616b32f4f3b24cbe15582d9a3ac51cfd9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d874771d24274c75aa4b7dfefb98ff36
SHA1eadedcd5c0ce852aa72ecfc40030650a3ebae7ac
SHA256c1aede7fb76a885275c1fd59c5343782c052a863a31daf4e2ab0cfcad72897c5
SHA5125cb32f2d9fa2651aa0550cd4bcccc10d94937ab7167c38f17b9c41db9bbcc39f9126c05e4cf66d97b4323f276d090a74d590288ba178d20b98684a2cd779bc0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d14d5ced5ffe568c8e0224bdde733229
SHA180f120663ad17cafc4b21b8f7e83a8909f93c1e3
SHA25664faf7da3a5198958b1e426c645d8c9a1b7842b651c01240e9484d38fbe0a932
SHA512daf3f48c0cd724e9142f6ce1569635a0ea5a418739fe1f9235c87b5fc601c117aa1a8bb52306ee408ab9dded1216936f484c25f87c24bacf659676765d8d7e5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffd5d88ed31442461fe2752d58af29c9
SHA1ef4009de44c5bf34322b2ed9a834471686a2d424
SHA256f6bdf665a9ac82a2334fcfdb8e54e4de0520ac32f92d818cfc3a643e5dc8a5ae
SHA5128800b66307242ce1fd98ba8063acb29c9a1a2151e8bfd5dccd89d046dd60abd377d716bde4a29bcdc83807f92287d3db749412f67e21cdb98c892d4f48808f25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ad847e5c3f228a48546066c38595532
SHA1dedcb6490a89a64c0f3e83fccb8ff88ccbdffefc
SHA256bd36a44aab79f15565a3047b2cdd91a57a0e6778142b067f9ceeb4a22e48bcfc
SHA512e5dd7d183603923a13c486ed4b7b42f02b9aa1cc3c9eae25f339253124aee1ebfc20c9fafbd04fb4aa4e9e746caf6bc4973edef7fa06eccd67126c25960b25c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc7e4917efdcae66fc0c525c4094f550
SHA17d053f4d861c64c3dd0e1039f1b75b5db9dcaf7f
SHA2563ee0cdb9d6a32430ffc472ad69467846ae882984ee6b8bb2aa981226aeb34df9
SHA512c57e4bcdaf58f22b41160edb9e2dd7c869f4ee5442a75740fbe1bb129c00bb9a2a4154a4631fdc99052ce33b3f6bb0f57dad5a7bc9109c2768acf750310dfca8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d476a57e0991c120e3f9f26a3c9f03a
SHA1fab1abaf204dab0f5be458c98604eae57ba4dfa7
SHA256d89b07af167e392c5558d0ce8542010fe465d3ce9ada967056c219d5633fbd57
SHA512894fb9dc8106c6da3d4dd6b35755b8bd450e3856492becaafe0f13dd5b516aabf8da68dbecd7d44d9e4474286906a09539aa5e21d8acc7f9dc85366044eb7bdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd265dbe5f593e0f64bc991858687e23
SHA1e3e916bf4bf4d0ad5426e3a75613a6c41659e491
SHA25616c8a5c70ee845ec14e12f6652d04692573566e555ec660dbdf8bd8884e97a0e
SHA512fa304e9f088b9c970b60d1ae37ade4d6fa173c7c06ca5e72c9f8d67d78421b695e2ab53b6130246866b63d80e06b5d6637548bf2b6cade8e00e1a1d7b53d6624
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4d69ea5b2811db63973718c4e41b30b
SHA1523f207998e3521c4ef28fb1af4cba1f44ff95be
SHA25640cc75d3712034d22c963b6b4846028b731e35d0c23d155c07cf6b5012dc1cbe
SHA5128bc431f309bdaed6d1a2a56773b1eafd7df20465950ddbcceea6047ccf332c421f93a047559b429154a14054337c33ea99c12f9fdc6a2143644f344e3dce425b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VCY0HBA7\favicon[2].ico
Filesize9KB
MD55e5a72ca015d590326710f86127efe26
SHA1f6007612de554a13c0de8f29dc3a81174d64614f
SHA25661a5e8a6bdaba1c97ae554193de4a66228bd443d318990fd1df7471debe24ca6
SHA512582b5e40850c1e4d954b93c1997d65b05c9d6310ddca529ec19d5150fc41bd53aad2b08c5c1be59d33fd0806b44d5c28e4f2a1eb05c721a31b6679a6da46de38
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
500KB
MD584591cf8bbe4b94d5a83b2cdd605d4b5
SHA185f1dbf03d2b4c52e067849b93c3f4c7ec284886
SHA256b8c2bf47cb70a77582c302284554ecd4a29f9ee55c09fc2193b3ba942d5884ae
SHA51231ff3523bedc87efd5040c46fdaff325c29fa109a912b729c81660c0737505e9dbd2f9bc0a443bfce12ede2569d023cc1f56f6bea0943a669f4f85e0f420830d