Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    95s
  • max time network
    191s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/09/2024, 18:21

General

  • Target

    liquidlauncher_0.3.0_x64-setup.exe

  • Size

    6.1MB

  • MD5

    488e15c06c044be1eb8a42b1396d4768

  • SHA1

    f1e56df200072ce90811b4b985c33dd851526433

  • SHA256

    98a7fccdb0443b44fa3afabc5c673d4419014668992e531766a18b9f4bcb133d

  • SHA512

    f7d99054d446e67a6bfa0ffe2bbfff0120186f0c04ae4c7230c1e1a7d9525dfc10099be677b37ebb93e3ad827733742ad5ee120d15d520318826d710bb7d6320

  • SSDEEP

    196608:xxaBup4JrgUFFDG7U6uqLYkzzGZ4R0K8MNFUtfik:xAgp4JrXGwMFpTjOfn

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\liquidlauncher_0.3.0_x64-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\liquidlauncher_0.3.0_x64-setup.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:4620
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2760

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nst83E7.tmp\NSISdl.dll

      Filesize

      15KB

      MD5

      ee68463fed225c5c98d800bdbd205598

      SHA1

      306364af624de3028e2078c4d8c234fa497bd723

      SHA256

      419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04

      SHA512

      b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107

    • C:\Users\Admin\AppData\Local\Temp\nst83E7.tmp\StartMenu.dll

      Filesize

      7KB

      MD5

      d070f3275df715bf3708beff2c6c307d

      SHA1

      93d3725801e07303e9727c4369e19fd139e69023

      SHA256

      42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7

      SHA512

      fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d

    • C:\Users\Admin\AppData\Local\Temp\nst83E7.tmp\System.dll

      Filesize

      12KB

      MD5

      cff85c549d536f651d4fb8387f1976f2

      SHA1

      d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

      SHA256

      8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

      SHA512

      531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

    • C:\Users\Admin\AppData\Local\Temp\nst83E7.tmp\modern-wizard.bmp

      Filesize

      25KB

      MD5

      cbe40fd2b1ec96daedc65da172d90022

      SHA1

      366c216220aa4329dff6c485fd0e9b0f4f0a7944

      SHA256

      3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

      SHA512

      62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

    • C:\Users\Admin\AppData\Local\Temp\nst83E7.tmp\nsDialogs.dll

      Filesize

      9KB

      MD5

      6c3f8c94d0727894d706940a8a980543

      SHA1

      0d1bcad901be377f38d579aafc0c41c0ef8dcefd

      SHA256

      56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

      SHA512

      2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355