Overview

overview

3

Static

static

3

Launcher.exe

windows11-21h2-x64

3

Analysis

  • max time kernel
    135s
  • max time network
    142s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03-08-2024 00:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Launcher.exe

  • Size

    21KB

  • MD5

    e8bfa0c80f32bda79e68bb0f94a23910

  • SHA1

    c86694dad1b0c98e10fe5144e2d8c99708c3abb9

  • SHA256

    c8ea8cd1bc81bcbe01ea8c61ddf4067c15931bf71577405f8230515c6c60f2c0

  • SHA512

    3d3a195afad9e0fd9d5b0e2801cb2041f5427ac30af27799efbf761a795868ae43106695ba63c37f64863b8d672abbb0eac57db794c17bce6f35ea26174d8432

  • SSDEEP

    384:Mgt7XJR193S5KWD+Tvc88fPfZv0AjcDpQ4pL2f2aDcgnrGQQi3Obo:5t7XJR193S5KWDm8Rv1gDpQ46nqQt3Ob

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4492
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c pause
      2⤵
        PID:1848
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
      1⤵
        PID:1052
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2552

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
        Filesize

        10KB

        MD5

        a73ea6e1db27acedbe4055c448f82ef7

        SHA1

        01769a266d26c4b4b374099606e86b8874ddd55f

        SHA256

        c3059c62596021e555ec7901361fcde75078ad931bcac6027539930bef8b77d9

        SHA512

        f9cfe99077e40ac3ff11ab39020d6e159ec06cf50f9b1d156858198d48851d29de8882a18609a17dd30ddea421c6c415683b8d7b14fa30a51ddd1cd76032deb4

        Download Submit