56bacfb737076b0b10f9896ac124c2e8f83cb855f7b31ef5a95338b7529b3126

Analysis

max time kernel
151s
max time network
162s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
30/09/2024, 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Feather Launcher.exe
Size

145.0MB
MD5

9ef1ecce599882119c5a0715f66dcc55
SHA1

f6e57a26c0f353ae14302a0a08eed0b4d8946619
SHA256

4d5066af522559245d0479e7d4ccc69a7f07de88aad84638d06815a6f4ad31e0
SHA512

f18f2e8b8cdab11305a33fce817715ebaf9d81b1eb4015e19aa1de7b53cc230b78b7b25af6151bdc6ad67c3ce763f294f8b61ecbb254a6ac0a2baea2fc8f0a3c
SSDEEP

3145728:9FJz+MnHejtWPrMYQWXPQdP57obOO4X7v+N303rVlZ:9FF+MnHejtWPrMYQWXPQdP57obOO4C6p

Score

4^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3516	Feather Launcher.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\feathermc	Feather Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\feathermc\URL Protocol	Feather Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\feathermc\ = "URL:feathermc"	Feather Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\feathermc\shell\open\command	Feather Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\feathermc\shell	Feather Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\feathermc\shell\open	Feather Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\feathermc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Feather Launcher.exe\" \"%1\""	Feather Launcher.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Feather Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Feather Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Feather Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Feather Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Feather Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Feather Launcher.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3120	Feather Launcher.exe
3120	Feather Launcher.exe
4156	Feather Launcher.exe
4156	Feather Launcher.exe
2640	Feather Launcher.exe
2640	Feather Launcher.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe
Token: SeShutdownPrivilege	3480	Feather Launcher.exe
Token: SeCreatePagefilePrivilege	3480	Feather Launcher.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2052	3480	Feather Launcher.exe	79
PID 3480 wrote to memory of 2928	3480	Feather Launcher.exe	80
PID 3480 wrote to memory of 2928	3480	Feather Launcher.exe	80
PID 3480 wrote to memory of 3516	3480	Feather Launcher.exe	81
PID 3480 wrote to memory of 3516	3480	Feather Launcher.exe	81
PID 3516 wrote to memory of 3120	3516	Feather Launcher.exe	82
PID 3516 wrote to memory of 3120	3516	Feather Launcher.exe	82
PID 3516 wrote to memory of 4156	3516	Feather Launcher.exe	83
PID 3516 wrote to memory of 4156	3516	Feather Launcher.exe	83
PID 3480 wrote to memory of 2640	3480	Feather Launcher.exe	84
PID 3480 wrote to memory of 2640	3480	Feather Launcher.exe	84

C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"
1⤵
- Modifies registry class
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1548 --field-trial-handle=1692,i,7241430568084530567,8238746371811305101,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:2052
- C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --mojo-platform-channel-handle=1972 --field-trial-handle=1692,i,7241430568084530567,8238746371811305101,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:2928
- C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --disable-blink-features=GetDisplayMedia --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2228 --field-trial-handle=1692,i,7241430568084530567,8238746371811305101,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" C:\Users\Admin\AppData\Local\Temp\resources\app.asar\preload\preload-mod-watcher-fork.js
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3120
- - C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" C:\Users\Admin\AppData\Local\Temp\resources\app.asar\preload\preload-skin-watcher-fork.js
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4156
- C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2332 --field-trial-handle=1692,i,7241430568084530567,8238746371811305101,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\305c8180-3aaf-4b17-ae9b-4ff3c024241c.tmp.node

Filesize
7.0MB

MD5
7c665f5be07c5c43fa97973838b6a8ce

SHA1
03a3d5c39fbe0c43fa1560ed63276d905b2b74e9

SHA256
4b8df94e631f974b979086e9bc78395e3c95a813af55481dd2d89fc07ee64815

SHA512
c36d241427f4f0ff8059d839288b0bb150c873a4f7f9d78816617efa74e4b59a7b27d219db224460ce9f1ecb874e2c89f9b75fb3ffb3e0c8720fd917610f9d1d

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\Network Persistent State

Filesize
565B

MD5
5438636bf264331ccd148b4a3445ae17

SHA1
7b0251ca8678261d7a6e1bcccc28adfa6a48d34c

SHA256
407e7a5e161adbe9964a5ac81625b24197a62b24d59813f2c796852787144b64

SHA512
0ab12664d882932a78d9b47bc6cab509259c2410cbb704a2965dd13d580373431251157da44193205e60725de591ffe6d1d0529d5bb767cb3ecd8aa8b8e8730c

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Network\Network Persistent State~RFe58cd8c.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Preferences

Filesize
57B

MD5
58127c59cb9e1da127904c341d15372b

SHA1
62445484661d8036ce9788baeaba31d204e9a5fc

SHA256
be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

SHA512
8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

Download Submit
C:\Users\Admin\AppData\Roaming\Feather Launcher\Preferences~RFe57e62a.TMP

Filesize
86B

MD5
d11dedf80b85d8d9be3fec6bb292f64b

SHA1
aab8783454819cd66ddf7871e887abdba138aef3

SHA256
8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67

SHA512
6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/2052-2-0x00007FFEBF910000-0x00007FFEBF911000-memory.dmp

Filesize
4KB

Download
memory/2640-98-0x0000027E438A0000-0x0000027E438A1000-memory.dmp

Filesize
4KB

Download
memory/2640-96-0x0000027E438A0000-0x0000027E438A1000-memory.dmp

Filesize
4KB

Download
memory/2640-97-0x0000027E438A0000-0x0000027E438A1000-memory.dmp

Filesize
4KB

Download
memory/2640-102-0x0000027E438A0000-0x0000027E438A1000-memory.dmp

Filesize
4KB

Download
memory/2640-105-0x0000027E438A0000-0x0000027E438A1000-memory.dmp

Filesize
4KB

Download
memory/2640-108-0x0000027E438A0000-0x0000027E438A1000-memory.dmp

Filesize
4KB

Download
memory/2640-107-0x0000027E438A0000-0x0000027E438A1000-memory.dmp

Filesize
4KB

Download
memory/2640-106-0x0000027E438A0000-0x0000027E438A1000-memory.dmp

Filesize
4KB

Download
memory/2640-104-0x0000027E438A0000-0x0000027E438A1000-memory.dmp

Filesize
4KB

Download
memory/2640-103-0x0000027E438A0000-0x0000027E438A1000-memory.dmp

Filesize
4KB

Download