Overview
overview
7Static
static
3EduPrintProv.exe
windows10-2004-x64
1EhStorAuthn.exe
windows10-2004-x64
1EoAExperiences.exe
windows10-2004-x64
1FileDialogBroker.exe
windows10-2004-x64
1FileHistory.exe
windows10-2004-x64
1Fondue.exe
windows10-2004-x64
1FsIso.exe
windows10-2004-x64
1GameBarPre...er.exe
windows10-2004-x64
1GameInputSvc.exe
windows10-2004-x64
1GamePanel.exe
windows10-2004-x64
1GenValObj.exe
windows10-2004-x64
1HOSTNAME.exe
windows10-2004-x64
1IESettingSync.exe
windows10-2004-x64
1ISM.exe
windows10-2004-x64
1IcsEntitle...st.exe
windows10-2004-x64
1InfDefaultInstall.exe
windows10-2004-x64
1InputSwitc...er.exe
windows10-2004-x64
1LanguageCo...er.exe
windows10-2004-x64
1LaunchTM.exe
windows10-2004-x64
7LaunchWinApp.exe
windows10-2004-x64
1LegacyNetUXHost.exe
windows10-2004-x64
1LicenseMan...xt.exe
windows10-2004-x64
1LicensingUI.exe
windows10-2004-x64
1LiveCaptions.exe
windows10-2004-x64
1LocationNo...ws.exe
windows10-2004-x64
1Locator.exe
windows10-2004-x64
1LockAppHost.exe
windows10-2004-x64
1LockScreen...er.exe
windows10-2004-x64
1LogonUI.exe
windows10-2004-x64
1LsaIso.exe
windows10-2004-x64
1MBR2GPT.exe
windows10-2004-x64
1MDEServer.exe
windows10-2004-x64
1Resubmissions
23/08/2024, 16:00
240823-tf47dsteqe 623/08/2024, 15:32
240823-sy293sseld 423/08/2024, 15:18
240823-sp1d5athqk 823/08/2024, 14:12
240823-rjcv7sydnd 723/08/2024, 02:33
240823-c17dta1cpd 723/08/2024, 02:11
240823-cmbpzszelg 423/08/2024, 02:00
240823-ce59mazbnh 423/08/2024, 01:37
240823-b1992a1dmm 523/08/2024, 01:24
240823-bsm5jazhpp 523/08/2024, 00:51
240823-a7p21awhld 6Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
EduPrintProv.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
EhStorAuthn.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
EoAExperiences.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
FileDialogBroker.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
FileHistory.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Fondue.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
FsIso.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
GameBarPresenceWriter.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
GameInputSvc.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
GamePanel.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
GenValObj.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
HOSTNAME.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
IESettingSync.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
ISM.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
IcsEntitlementHost.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
InfDefaultInstall.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
InputSwitchToastHandler.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
LanguageComponentsInstallerComHandler.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
LaunchTM.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
LaunchWinApp.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
LegacyNetUXHost.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
LicenseManagerShellext.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
LicensingUI.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
LiveCaptions.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
LocationNotificationWindows.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Locator.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
LockAppHost.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
LockScreenContentServer.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
LogonUI.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
LsaIso.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
MBR2GPT.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
MDEServer.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
LaunchTM.exe
-
Size
28KB
-
MD5
7e964bd16794b6e7cc6ea11cca678459
-
SHA1
58858a541bdf3c56560f73abb37ddd77fc43a3b9
-
SHA256
1f38100bbb4db7d5f8afaacf3c0ae7fde607f5feea4d63c0390488791d8afe8c
-
SHA512
43f20e05de5bc2e53a0fe72a8465ee941110f876c567958bc9265ad02b9083ff4a9d2dda0477bbf5fe2d064066e0abf7e2849a620aa000c8ddf8fae7b20e5895
-
SSDEEP
192:yAovtgjn9aJY0YfZmo3Y1aahvBwMU8TWBqayW:5oFInwJY0skoI8OBrFTWBqayW
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation LaunchTM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3108 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3108 Taskmgr.exe Token: SeSystemProfilePrivilege 3108 Taskmgr.exe Token: SeCreateGlobalPrivilege 3108 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe 3108 Taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 516 wrote to memory of 3108 516 LaunchTM.exe 85 PID 516 wrote to memory of 3108 516 LaunchTM.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\LaunchTM.exe"C:\Users\Admin\AppData\Local\Temp\LaunchTM.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3108
-