Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

NirLauncher.exe

windows7-x64

9

NirLauncher.exe

windows10-1703-x64

1

NirLauncher.exe

windows10-2004-x64

1

NirLauncher.exe

windows11-21h2-x64

1

Analysis

  • max time kernel
    139s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21/07/2024, 06:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NirLauncher.exe

  • Size

    25.9MB

  • MD5

    9e717d7865685c6036aee52d0efffdb4

  • SHA1

    dbe99d5f3678b4d6f9c5ce7896096ef24287cf72

  • SHA256

    9930d0ce01c00f577f3b40e9773d0ba3f55c41c7e876f984446d2ed756d258be

  • SHA512

    e183d4ed79da1e8b8d7071907b3682d999d7cfbe78b4a83e85a48ccb9e8850be93895652fcdde06c9a981c09906107a2b43bbb141b64a78efd236505c63423de

  • SSDEEP

    786432:NTxnq643jmn2/pZSzxExqwmNVQNCjKfrOT/YZ2VrePUN:hUOn2/mKgXgC2zaYZX8N

Score
9/10
upx

Malware Config

Signatures

  • Detected Nirsoft tools 11 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NirLauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\NirLauncher.exe"
    1⤵
    • Drops autorun.inf file
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:2472
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:316
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x194
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1928
    • C:\Users\Admin\AppData\Local\Temp\NirLauncher\NirLauncher.exe
      "C:\Users\Admin\AppData\Local\Temp\NirLauncher\NirLauncher.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      PID:2556

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\NirLauncher\NirLauncher.cfg
      Filesize

      1KB

      MD5

      9fb6fa9bb008645dc708e0c000eab811

      SHA1

      293e4af8489e080a314479ea3a658759104eac82

      SHA256

      ee47c1b3ceeae1d2cff3ae2ff58994a20c5ceaca949b8f2628accd962f97a804

      SHA512

      b25cd47ad8b7af687f7fe54a792d057f9cb1b81a0d7476ccbfdc27c8d3aa87dd30b542c12f321d9b17bac57d8bfbfb619abddeaefef6a58d1238a086d4b96d66

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\NirLauncher\NirLauncher.exe
      Filesize

      109KB

      MD5

      b40315affe032e1eefe8ee42c18331bc

      SHA1

      7c9e6cb3547ab5f0810e90727374129ec21600f4

      SHA256

      ed8b14d0a38d857dd299e2c271b3c8b69baecc97ee3190c1ebb0da0be83b4fbd

      SHA512

      12b5fdee7076771b5a5094c077cbf6360ceb2e7d6624e2c6f5f111314146d4a65d758fab42471f6a6e5417db44d615c10c2570501cb4eaf57473f432eb3a2ca5

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\ExtPassword.exe
      Filesize

      280KB

      MD5

      215abd5dd14f4d76a028a591a6518da1

      SHA1

      241972e695d94b2bc7e3b2566d36fe07a0b828a4

      SHA256

      bd61c5daaad30b420817fb1fd2f0447c3b66a1900ba69fd4cd724d1e6897ab41

      SHA512

      02dab91bbfe69d50d1c4f41d5db20075a6d55978e1eec01fa8b54e5ea8673e231862914f611ba314b7be0ebc4c5f893075778e9b1e62cc940e327ffd62d95dc2

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\LSASecretsDump.exe
      Filesize

      10KB

      MD5

      47ac4697c6d587ae9d319cf32c68174c

      SHA1

      26f0afad5fd6294808d6bad0dc2e41dddef94cef

      SHA256

      2a871c1837d59951a260b8ad9778bdaaaa8604a605ea5fc378e722f9d7088ea0

      SHA512

      eb22972196cbed789de73cdf81ba29c54ded48b6cc9da0ad0580d83d926b802e5f07b8651b01fe20386814690de4c4e3c2ebda4a242da4825e2f36fd3573075c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\OperaPassView.exe
      Filesize

      40KB

      MD5

      0e47188b23d897ede0fe8fac05cb3263

      SHA1

      cab798294be00a94ba8ebf9ccb7443e837835d05

      SHA256

      8e4b218bdbd8e098fff749fe5e5bbf00275d21f398b34216a573224e192094b8

      SHA512

      4be255b828c5eda9b82b1dd058488ef6aea5a8f8f5265c9a3a241fd5f5cafaf1706e8089d84026e52a6a2e4ea750f610183e2ff6942e42f0e209ba2df3788492

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\PCAnyPass.exe
      Filesize

      48KB

      MD5

      5c4e66b263b767048e725e63e0e1a59b

      SHA1

      fb495ffaf189f65d30d688ef18a4af91e0126ddb

      SHA256

      0db918e616456bc10f3f583cebb27d3fbc5a15b9899bbba22594d8a2acc6f9c3

      SHA512

      0de334180ddc775e2d897ece9362e833b3c4c4f019686fb6cbd44df2d0ec548dd32d291c016d8a0f0eacae9051cc929bccf9f3b037d76680ed8c38ce6cf14dae

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\joeware.nlp
      Filesize

      9KB

      MD5

      15f4ed225130dea22d7202bd0cd907df

      SHA1

      0f2c6cd6963893c1e4c396d3d4c4917729136ed3

      SHA256

      2510dee9947340e685279675ba321e545487863cc0dc98d117607c4606077dea

      SHA512

      69311c026cbd255de0d9e044bf5d00279a2e78c1cb310fe2c8dc71a47b11b5c1104e6188142acf52c6974f09b2dba910600e485db2ebc166b4a199ae38417dae

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\mitec.nlp
      Filesize

      9KB

      MD5

      71e098b216c5ceae133faf81a877724e

      SHA1

      afbb16dcdb37ce14a916080343862039f61bef76

      SHA256

      56744831e88469d21abdb2ce7d63a0f4ab02dd62760ada2a427ed24bff8ce744

      SHA512

      dcd6f86c342d9c847655ca3fe2c5342cfd2f27cb7623e46ab4588c6f4f5745243b675bd8d05544da9508b29939ff630a57d5c7a7f37d18f5db59afcf848f718c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\nirsoft.nlp
      Filesize

      154KB

      MD5

      acf8de079a4217067a75ee60e3d8ee29

      SHA1

      ed38f56dfbde955ed95d73ea9f5d223bfe9e5dac

      SHA256

      6cdf59ebc13359054d15ea104163313ab7b5005513456b06e0611a1ad2ba3d82

      SHA512

      c72484d45d2749c896ed496ed0892ded7a82d4a119f5d0f470e744f6fc334e7d263dea8a51b8fe43e1090fe492416d4e267957edff5ca81adb805cce9784dad7

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\ntcore.nlp
      Filesize

      7KB

      MD5

      f6f9a4b55fb67296f7114c0a4f29665e

      SHA1

      a31769914898a89a98f58ef3b0befd2bcf382430

      SHA256

      860e21cf928728d600d0188d935af95a12b6c16d1f578bc78752b0f12170945f

      SHA512

      3a75bcbdbd5953b47819037e6b49337092c86425305c2bbc65350013492f824afd99bc4b54409c634a27e56e6ba255fd6e275e0853e3d26f8100c3a35bd584cc

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\piriform.nlp
      Filesize

      2KB

      MD5

      772f3b6e8621cb42a6d80b49da867005

      SHA1

      f6fe38a76ff44b7884a6a655f35b6d7b66e0f0fc

      SHA256

      f3b94b938dd85b3a1f15eaeae7f8b8c1e68b13e35d910e499d6355a267a28f39

      SHA512

      0adb95c21d092cd1f24213c9ff99cd5fb6e762086f2ef9539f7cc222a66d371bca7077f34f8566cf1cf25072e374f369f8b1797629411c8b37a8051989b51843

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\sysinternals6a.nlp
      Filesize

      57KB

      MD5

      f10a3d4adcd8e5a4540b4f4dd6a2850e

      SHA1

      0e47f2fb8f0bc23b9fc44067047430518eef7e0d

      SHA256

      f76cce55eea574319846f8d1be81cb6a026e955c4d3a85a8e6f377f1d0f3d806

      SHA512

      200361589c913733937f54f99ac82e8f8abc19d376d8bf421120bbc41296fbf30ffe7b109e824c2e043074b80c05c528c809a0b3d5c7eaf1a49788206cda13f1

      Download Submit

    • \Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\bulletspassview.exe
      Filesize

      70KB

      MD5

      e40c9293ea0b6d62a0f62f40212df07b

      SHA1

      08edc669c2a5408cdbc3968fc4ac0a2f23ed69ba

      SHA256

      b19dfe440e515c39928b475a946656a12b1051e98e0df36c016586b34a766d5c

      SHA512

      6eb169f810092de15a9d54ab40ab61afc3ad37d4adb6ecb4d97a4f349e1a24ab0b62251b54db88f91cbc993d0626e34c738e054eed5a6e23cace669f9f01a975

      Download Submit

    • \Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\chromepass.exe
      Filesize

      341KB

      MD5

      01ecf3649dc4a7cbf5bef268d3ae47fe

      SHA1

      8647ce9f98b6e5c770fb10925178980080f1be2d

      SHA256

      744e50af5566fa5ab70d4db70d35b3b89d75018e00b6b1e8e6280030482353bc

      SHA512

      3902df20a30dd281a4057136842479169b9ddeefd68e1adc23e90eddb6c4edc6c9a578450ae11f77a4689f45e5f4f8ae349ab580ff35801f053c058f6cf30cc0

      Download Submit

    • \Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\credentialsfileview.exe
      Filesize

      114KB

      MD5

      67b831f78b3bea8bf23ba8b488ba5254

      SHA1

      a0340fbe6a57aec5209d36c0dbd4d62231fc6a08

      SHA256

      15833ee12ac809341716adcea68f827ca1241bdb3b4499d61980419d1e21284a

      SHA512

      738a9c867b92124a5392956984f0b512f3221c2f1715eb72173778d9919e377c0c7349074db6c922ab842cc74eddfbb23d09543482f4f749704de9c78e39255b

      Download Submit

    • \Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\credhistview.exe
      Filesize

      84KB

      MD5

      4fe1871e39a90073dd952f041b468f2e

      SHA1

      f48b735b36228ffc8fb7885283de125d3dc839bd

      SHA256

      928de47e95b4eb963f75a5c908333f95545832760eed5ae0ba90f56753d66e66

      SHA512

      b130306235f8b905f62c4ea6d22dab2c08e517994784149090784dbe16198b846d73cc981d927aedde8fb7f8d2666c4995114aacbb9e577130fcd0d82482281f

      Download Submit

    • \Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\dataprotectiondecryptor.exe
      Filesize

      111KB

      MD5

      87da8719a775dbb49b99359a228c21fc

      SHA1

      1ff04b7062c026ec7960255d3712892f886ecf7e

      SHA256

      ece4b6572238e74980526220a8e94ec33b1819fbf348815e47324e824edd747d

      SHA512

      922f3e46a0198045c8e5696bdacb5a8715ba78929649ed60f8e66cf946e1f27096b8d653318a7c47f98d66a6594be64432144f6ebc958ff9183aeaec633095cb

      Download Submit

    • \Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\dialupass.exe
      Filesize

      73KB

      MD5

      1dfe0e65f3fb60ee4e46cf8125ad67ca

      SHA1

      bd48322845f8930e58e038dfd4e1e243e80a6b76

      SHA256

      598555a7e053c7456ee8a06a892309386e69d473c73284de9bbc0ba73b17e70a

      SHA512

      6f7a92f53c1a4e7b22fcca285422e9e04b6600bb1d16a6f1be08f3967830c0dc6ddeef6fdd3e514b34fd36f0bf92a771f83d9006105ec331c7c90c6161e19465

      Download Submit

    • \Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\encryptedregview.exe
      Filesize

      108KB

      MD5

      78a0fb0001a38ca70c87447e340ab331

      SHA1

      a5eb4437fa2c759325c7bd29fbb92a8c4a642170

      SHA256

      16bc73e22944758dae14426f93b093deb3c1de65837d1b0948ad615fd865f5de

      SHA512

      dc11e2b763a77a61cefbe2ea918b764434b479a9bf5a640eac07a75a82bda89725d4aad0567ba321b8c30b7a3964334f3865853de102ab7720bf8d8006471be6

      Download Submit

    • \Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\iepv.exe
      Filesize

      99KB

      MD5

      c56af5561e3f20bed435fb4355cffc29

      SHA1

      7e0e6900f4528e7dacb65ab1b1c107425d2a321b

      SHA256

      70aaf2b367b97fa35d599a6db4d08875206ef18c99d8c8c5b5f25e4f5509931a

      SHA512

      7b44b6a0485599ffd23d0602c835773fb48f42b7d64419e069f2347bf71248351273bcd9f74852088861515590126e8ca584f0fed0d34cce262df5512c589f9a

      Download Submit

    • \Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\lsasecretsview.exe
      Filesize

      63KB

      MD5

      e2ea94774a33c6e4988807f8f58dccbf

      SHA1

      be2029e1d32caa7cb23850f97314ff30b5ca322d

      SHA256

      3099260dd1dc8b8526c83d45ee27e0961b2fd545906f1b9de088749d13eb8dcf

      SHA512

      276dd58dec7da01208c73c86a001162d3d790ac9c972930528b8a76deef9e6d622e08ec18d098078f96ecf2f302154207660f94c3eace55391703dded57968ee

      Download Submit

    • \Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\madpassext.exe
      Filesize

      46KB

      MD5

      1d4cedae1f44f41d5e449680d0d08686

      SHA1

      4bfe0787e66c181920a462f805b0652e7c22e2c2

      SHA256

      a0a0c256070d7dc62a260ca36cf25b08521d8c35f2ac6f93224854cc538b564a

      SHA512

      7cd2875e9769d5dc02e99709e1762abf2d3cbac96051427f87be855d8d0886855d3805ffabca0f8dbdef357b509a0d292904c269f8f00a781f793f84c82fa93a

      Download Submit

    • \Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\mailpv.exe
      Filesize

      499KB

      MD5

      fc3b93e042de5fa569a8379d46bce506

      SHA1

      1ba499bafaa369be58e795a150403c8729ef5d95

      SHA256

      5be325905df8aab7089ab2348d89343f55a2f88dadd75de8f382e8fa026451bd

      SHA512

      1b802f8cddb1fcab643a2ec00ac139e7e419fc4f7fec5697c8b9f805c1a93ffbdc841438cfdd93c5018ce037fcc61844e392fb421423e88ec7d8dacecb0af08e

      Download Submit

    • \Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\mspass.exe
      Filesize

      64KB

      MD5

      df218168bf83d26386dfd4ece7aef2d0

      SHA1

      4a3418d78d8fe36b39d1ee5435796369b88a8762

      SHA256

      7a313840d25adf94c7bf1d17393f5b991ba8baf50b8cacb7ce0420189c177e26

      SHA512

      e81bb127771f67134f18a5197efd7b0fa5884d776cd7b7045ef8c594556ad3f596165f4d2970a1a861e4dc924774a3484dbb8a136234186db1316c0db91a50b6

      Download Submit

    • \Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\netpass.exe
      Filesize

      89KB

      MD5

      3eabb1c39d494cbc17259f36f56bf5d6

      SHA1

      67e8e85e6e316cd3008a7d8ce0d72064416c7a00

      SHA256

      51fd557a7325dd58cfcabebbbc33ef452d93f812c189360d4f2bf87c6df0a59c

      SHA512

      220d4ea306ac38eaeb3830227d345f196d68192736d27fa47c8f05b836561effcfc8baeac59eb427fb0de7b8173e94f87c28f1d539f3fac6af9ab7c5ed5b4666

      Download Submit

    • \Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\outlookaccountsview.exe
      Filesize

      98KB

      MD5

      b586e423e550179f8b13268e430507c3

      SHA1

      6534d510edbe31272e848b7a18ba88b8bd9a25f4

      SHA256

      1e42a5ca6361a94081e1dbda4a255b2e00e67de6d1d57de325d1e16b6dfeb621

      SHA512

      58abf83b2824bb523c7ffe9746058029ad883250cb4d3254834fd6ddf0c82edd64be6788d1f695395a99a052dc1fbffa20335fe00d51c18b71c479d56c0a8b43

      Download Submit

    • \Users\Admin\AppData\Local\Temp\NirLauncher\NirSoft\passwordfox.exe
      Filesize

      472KB

      MD5

      96a5209789bdaa00c051eb95a0986467

      SHA1

      1cc8d825a5f52f63916bf03215f7d236b405aa1a

      SHA256

      ce4204f78177db7259ad34677ef8ec2c7d645c088c82bdb845a0b8e2d04d2594

      SHA512

      d7e7bd7c6b3c322473dd729fe9bb34d98e8a2afa210f7b74017b2e46c8da484eb07cc34dbfeb35aea8c6b9a3fc3f77123c0a07e1383389ed4a12c79774fdf736

      Download Submit

    • memory/2556-1379-0x0000000008D40000-0x0000000008D65000-memory.dmp

      Filesize

      148KB

      Download

    • memory/2556-1382-0x0000000008D40000-0x0000000008D54000-memory.dmp

      Filesize

      80KB

      Download

    • memory/2556-1375-0x0000000008D40000-0x0000000008DDB000-memory.dmp

      Filesize

      620KB

      Download

    • memory/2556-1378-0x0000000008D40000-0x0000000008D65000-memory.dmp

      Filesize

      148KB

      Download

    • memory/2556-1376-0x0000000008D40000-0x0000000008DDB000-memory.dmp

      Filesize

      620KB

      Download

    • memory/2556-1380-0x0000000008D40000-0x0000000008D59000-memory.dmp

      Filesize

      100KB

      Download

    • memory/2556-1381-0x0000000008D40000-0x0000000008D59000-memory.dmp

      Filesize

      100KB

      Download

    • memory/2556-1377-0x0000000008D40000-0x0000000008D4A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/2556-1383-0x0000000008D40000-0x0000000008D54000-memory.dmp

      Filesize

      80KB

      Download

    • memory/2556-1385-0x0000000008D40000-0x0000000008D65000-memory.dmp

      Filesize

      148KB

      Download

    • memory/2556-1384-0x0000000008D40000-0x0000000008D53000-memory.dmp

      Filesize

      76KB

      Download

    • memory/2556-1386-0x0000000008D40000-0x0000000008D65000-memory.dmp

      Filesize

      148KB

      Download

    • memory/2556-1387-0x0000000008D40000-0x0000000008DDB000-memory.dmp

      Filesize

      620KB

      Download

    • memory/2556-1388-0x0000000008D40000-0x0000000008D4A000-memory.dmp

      Filesize

      40KB

      Download