Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

3

Global/Launcher.exe

windows11-21h2-x64

3

Resubmissions

02/08/2024, 15:31

240802-sx1d4azckm 3

02/08/2024, 15:28

240802-swnnxazbpm 3

02/08/2024, 15:27

240802-svrdeavajf 3

Analysis

  • max time kernel
    101s
  • max time network
    98s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240730-en
  • resource tags

    arch:x64arch:x86image:win11-20240730-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02/08/2024, 15:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Global/Launcher.exe

  • Size

    22KB

  • MD5

    4c8f3a1e15f370ca8afe2992902a6e98

  • SHA1

    dc6324d924ac31bea4ad7e4dd6720ecdad3877dd

  • SHA256

    dcdc72549f7ad41cc860738adbeee5e44f02222415fd84ed5c92538ac9049b92

  • SHA512

    b63c4e48f3024edcf1e1391b5df6ff65fc5111849eb093b429fa0f21c03339dbaeff835f18e250758498f3432874b85348530e47b2ada93f6f68615a5ccf66c0

  • SSDEEP

    384:fuPJRlNhSP00zehDDG41lI3Vf4f1s/3UP1D23NWqd:WPJRlNhSP00A3hIB4fbPc3cq

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Global\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Global\Launcher.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c pause
      2⤵
        PID:3140
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
      1⤵
        PID:2408

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
        Filesize

        7KB

        MD5

        1bccf43ba4ffb00bffd57b98e226d374

        SHA1

        c9f1d86bc6f38d2becd6935de0bdc857b322a8ea

        SHA256

        28806d29dddfff42ba4c9bcc55219efb3f25f974df058c07983a8430260b6327

        SHA512

        3025d0949aacb700b608ae0072cee93d976b37ff6c9f7bab5fcbb2ff76e781546ae2d8fb57b5a39ea78a850d5e4083c9576ee89b59e42d6c87f674255f69c40b

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
        Filesize

        7KB

        MD5

        e2fdbb7a3172cdf80b753caaa408c9d4

        SHA1

        019620ca7f321cbf455bfa23a934766a895cc4ed

        SHA256

        bddb404a40b735add3ce20d53309dd6464c31d9c68f42393fc05dcd2c6e38461

        SHA512

        f94ec08e8c9ef716c7af2107980d0efb8db44fde3fe3c27dac89da5a67df8a2e6b9a9bc8679a350d1312cb7fafaca45fb0a499745e53fce53e0c534dc735eb02

        Download Submit