56bacfb737076b0b10f9896ac124c2e8f83cb855f7b31ef5a95338b7529b3126

Analysis

max time kernel
150s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2024 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Feather Launcher.exe
Size

145.0MB
MD5

9ef1ecce599882119c5a0715f66dcc55
SHA1

f6e57a26c0f353ae14302a0a08eed0b4d8946619
SHA256

4d5066af522559245d0479e7d4ccc69a7f07de88aad84638d06815a6f4ad31e0
SHA512

f18f2e8b8cdab11305a33fce817715ebaf9d81b1eb4015e19aa1de7b53cc230b78b7b25af6151bdc6ad67c3ce763f294f8b61ecbb254a6ac0a2baea2fc8f0a3c
SSDEEP

3145728:9FJz+MnHejtWPrMYQWXPQdP57obOO4X7v+N303rVlZ:9FF+MnHejtWPrMYQWXPQdP57obOO4C6p

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	Feather Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	Feather Launcher.exe

Loads dropped DLL 1 IoCs

pid	Process
1308	Feather Launcher.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\feathermc\shell\open	Feather Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\feathermc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Feather Launcher.exe\" \"%1\""	Feather Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\feathermc	Feather Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\feathermc\URL Protocol	Feather Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\feathermc\ = "URL:feathermc"	Feather Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\feathermc\shell\open\command	Feather Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\feathermc\shell	Feather Launcher.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Feather Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Feather Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Feather Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Feather Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Feather Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Feather Launcher.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2072	Feather Launcher.exe
2072	Feather Launcher.exe
4660	Feather Launcher.exe
4660	Feather Launcher.exe
2320	Feather Launcher.exe
2320	Feather Launcher.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe
Token: SeShutdownPrivilege	3820	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3820	Feather Launcher.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 2084	3820	Feather Launcher.exe	81
PID 3820 wrote to memory of 3036	3820	Feather Launcher.exe	82
PID 3820 wrote to memory of 3036	3820	Feather Launcher.exe	82
PID 3820 wrote to memory of 1308	3820	Feather Launcher.exe	83
PID 3820 wrote to memory of 1308	3820	Feather Launcher.exe	83
PID 1308 wrote to memory of 2072	1308	Feather Launcher.exe	84
PID 1308 wrote to memory of 2072	1308	Feather Launcher.exe	84
PID 1308 wrote to memory of 4660	1308	Feather Launcher.exe	85
PID 1308 wrote to memory of 4660	1308	Feather Launcher.exe	85
PID 3820 wrote to memory of 2320	3820	Feather Launcher.exe	87
PID 3820 wrote to memory of 2320	3820	Feather Launcher.exe	87

C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1672,i,3449731058361568510,17268585611279354422,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:2084
- C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --mojo-platform-channel-handle=2008 --field-trial-handle=1672,i,3449731058361568510,17268585611279354422,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:3036
- C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --disable-blink-features=GetDisplayMedia --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2396 --field-trial-handle=1672,i,3449731058361568510,17268585611279354422,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" C:\Users\Admin\AppData\Local\Temp\resources\app.asar\preload\preload-mod-watcher-fork.js
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2072
- - C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" C:\Users\Admin\AppData\Local\Temp\resources\app.asar\preload\preload-skin-watcher-fork.js
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4660
- C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1564 --field-trial-handle=1672,i,3449731058361568510,17268585611279354422,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1c353322-9f1d-42e5-a9ea-179f1354127e.tmp.node

Filesize
7.0MB

MD5
7c665f5be07c5c43fa97973838b6a8ce

SHA1
03a3d5c39fbe0c43fa1560ed63276d905b2b74e9

SHA256
4b8df94e631f974b979086e9bc78395e3c95a813af55481dd2d89fc07ee64815

SHA512
c36d241427f4f0ff8059d839288b0bb150c873a4f7f9d78816617efa74e4b59a7b27d219db224460ce9f1ecb874e2c89f9b75fb3ffb3e0c8720fd917610f9d1d

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\042419bf-810a-4ce8-a3b2-176f53b374b8.tmp

Filesize
366B

MD5
126d44ce6a517577ae8c54cca4f276aa

SHA1
85642c9f2da31407ed99ceb2aa6cd84a9d747052

SHA256
e827d30012f722c0158db2e892cc35715442c47067b4db0c9d64563274e504be

SHA512
0baf01de4fd27cef4259dcb3c4f6b3cbafb5500dde549f8a0f2a9ddcf18eb573a76dd19291280e345bda0cbd23664cd1a3494a2f1e22f9f0436ffb28a4b1434d

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\Network Persistent State

Filesize
385B

MD5
d49ad55b046de1dd845cbd38f5a29a2e

SHA1
6775e14a670f95308c1c4dd52e9414baf2fa4007

SHA256
1c7554e978c49c3da6969ead98cfb7fbd1b9c177f1050c79aa0f7c6d7bec0f64

SHA512
f5d3e40f490c4a030d146f15fd9956145cbe83985b440c8897e58ffe30032e259044dbe7fd9b5b2bca9a5766a21bb190f6c9f45472247bb2368219ea65edcc54

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\Network Persistent State~RFe58eeff.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\TransportSecurity

Filesize
370B

MD5
b1716eb133d6573e777092bc2e512fc6

SHA1
7ec9d0c842788cc1b2570a94aa5914a8771d4139

SHA256
c3e9c10232445f9ac344a7443643190771577c96d0160eb0df18fdecacb0f9c4

SHA512
5ca3ae3b0bbf9461c6bbcb03f953ce125572d3d9b3e5c145e439b128bc4269389ebcf3236863c5460528b43470ef1d240e7a6434c964592ce3200ce5e98bf4d2

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\cdebf0fd-1c82-4e3c-8eaa-03b96a1189c3.tmp

Filesize
531B

MD5
fa0396a62126548edbc7e4dbbbd1342f

SHA1
f41e068b43f9413554bdf8e67d84127e420cec53

SHA256
4a90932bcb469dfebd26ff9df2a6c25d88a4917d4e3aede3d228432472d7f88f

SHA512
b236551d9c726c82ddd70681ae39239d706f6e0ba14f4037203dad25f819fa09cc07c2811f23d5c6fd6d7c6c31b36edd364afe4a8e311c09215fe7f3051e72bb

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Preferences

Filesize
86B

MD5
d11dedf80b85d8d9be3fec6bb292f64b

SHA1
aab8783454819cd66ddf7871e887abdba138aef3

SHA256
8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67

SHA512
6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/2084-2-0x00007FFEF17E0000-0x00007FFEF17E1000-memory.dmp

Filesize
4KB

Download
memory/2320-101-0x000002366A780000-0x000002366A781000-memory.dmp

Filesize
4KB

Download
memory/2320-99-0x000002366A780000-0x000002366A781000-memory.dmp

Filesize
4KB

Download
memory/2320-113-0x000002366A780000-0x000002366A781000-memory.dmp

Filesize
4KB

Download
memory/2320-112-0x000002366A780000-0x000002366A781000-memory.dmp

Filesize
4KB

Download
memory/2320-111-0x000002366A780000-0x000002366A781000-memory.dmp

Filesize
4KB

Download
memory/2320-110-0x000002366A780000-0x000002366A781000-memory.dmp

Filesize
4KB

Download
memory/2320-109-0x000002366A780000-0x000002366A781000-memory.dmp

Filesize
4KB

Download
memory/2320-108-0x000002366A780000-0x000002366A781000-memory.dmp

Filesize
4KB

Download
memory/2320-107-0x000002366A780000-0x000002366A781000-memory.dmp

Filesize
4KB

Download
memory/2320-100-0x000002366A780000-0x000002366A781000-memory.dmp

Filesize
4KB

Download