Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    25s
  • max time network
    26s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04/10/2024, 17:45

General

  • Target

    Launcher Blue/Launcher Blue.exe

  • Size

    2.3MB

  • MD5

    3100469fe2bb524c5bbd80166a75de3d

  • SHA1

    d18b37515ca0d288ce989ab443b9d10f9554c4e3

  • SHA256

    190c0c39dc6f4db5c7a47bec58d899bd7b325893bc8c10eccf134c08e42d6695

  • SHA512

    ff6b98835621ac039868425fbc956c22f17d938e6e7a4c9114195c6c0a52f0ceb1ee6105b952f54a3c806915ad1d8d49e2037da66493195e7bec87516a591b17

  • SSDEEP

    49152:cYMdEHZ3Vu5B6k0O9ciX3QdfVkowskoNgeL9nTQRaCo+k9:cYMi530kOK43Qrx3kKgeL9n

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Modifies system certificate store 2 TTPs 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Launcher Blue\Launcher Blue.exe
    "C:\Users\Admin\AppData\Local\Temp\Launcher Blue\Launcher Blue.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:776
    • C:\Users\Admin\AppData\Local\Temp\Launcher Blue\Launcher Blue.exe
      "C:\Users\Admin\AppData\Local\Temp\Launcher Blue\Launcher Blue.exe" --COOKIES=base64_Y29va2llPWh0dHA6Ly9vYXNnYW1lcy5jb207b2FzX3NwX3Byb21vdGU9cGxheWVyXzIuNC4wLjcx NzFfb2FzX25hcnV0b3B0X25hcnV0b3B0Ow== --GAMENAME=base64_TmFydXRvT25saW5l --GAMEPAGE --GAMETYPE=base64_bWFpbg== --GROUPID=base64_MA== --LG=base64_cHQ= --MAINTOKEN --MAINUSER --MAINWINDOW=base64_NDU5MzE0 --TABID=base64_MQ== --URL=base64_aHR0cDovLzFsc3kuYmxvZ3Nwb3QuY29tPz8/Pz8/Pz8yLjQuMC90ZW1wbGF0ZS9sb2dpbi5waHA/ bGc9cHQmZ2FtZWlkPW5hcnV0b3B0Jm1haW50eXBlPXBsYXkmcGFnZT1sb2dpbiZhY2NvdW50PW9h czIuNC4wLjcxNzFvYXNsb2dpbmdhbWU= --boxtype=base64_bG9naW5nYW1l --gameid=base64_bmFydXRvcHQ=
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Users\Admin\AppData\Local\Temp\Launcher Blue\Launcher Blue.exe
        "C:\Users\Admin\AppData\Local\Temp\Launcher Blue\Launcher Blue.exe" --type=renderer --no-sandbox --lang=en-US --lang=en-US --log-file="C:\Users\Admin\AppData\Local\Temp\Launcher Blue\debug.log" --ppapi-flash-path="PepperFlash\pepflashplayer32.dll" --ppapi-flash-version=23.0.0.207 --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="2512.0.1352504140\1321325532" /prefetch:1
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656

    Filesize

    1KB

    MD5

    88ab42b150d05e8f74dbb432587b8113

    SHA1

    916bfbb726c08c1f72f8c3f673090d31a9ae67e0

    SHA256

    159af49f2efac1168efee2ff67c06bcd9c13f41bd143d4f576974711c29131b1

    SHA512

    7007f395f07d3d331347a778cf55c099129837f72d892674bf667e6a1dcdfff4fcf4b708c61e12a4c0f195147f521c160d233d384b3b5f8762a28f81fe330572

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

    Filesize

    2KB

    MD5

    918368e8fcb30a4bd51cff376fa633f0

    SHA1

    5358043adf7b2b0f6e70f64fac28f6c28c932da5

    SHA256

    0ad90802546d5d67c0b4663b1a493651ced10bd5cb48bcac64b585dc4aeec292

    SHA512

    a21b9e96a2721338c215ccff839705f3c249b3e69b19a81360d4429572ffde7a0330c59ac2eab1758bd1d00a938308483e00b03289b6a6d16840f95ad0e0ce6f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

    Filesize

    1KB

    MD5

    ffbf783b368c37bac9ae760421e48393

    SHA1

    e7a6f62c925be0931b499f4e4e0da9824e6533ac

    SHA256

    0ea5bba94b5b15af2d94e46eab73831bcfce9ea4b189503e89d68d881d56f100

    SHA512

    bc29068e3fb8dcdcb5a9e1c1ca1bcae86b708778188dc397ef5d0c85c0e2f328c63498069daa3dc2a6ceaae6c71b6e5a7791c9d155d67bcb14623c228da315a7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656

    Filesize

    434B

    MD5

    904b6f1bc185a20218a88884a4647193

    SHA1

    88e0937685640cec3edbabba32de68fceef4222a

    SHA256

    88b2fbab92bbeefece3d72b333eedb50840f9cf6f8fc8fff9374c9be5efcacb9

    SHA512

    a4a4e362db921f2539c54a5d2f412ea70a88feb78cfcc4df753a9e0ac45e2fc3f8b5c197c272568fa4126be096b5ae5c1959c91e23ee926352e1ccd4e04810aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

    Filesize

    458B

    MD5

    ef3ae3de24aaebe137450371c956c0cb

    SHA1

    9492a45ebcf286cfe2cb901afc28aa053e5e749a

    SHA256

    5cd9ae7ad5c434749614de9d6877c9787e340199f1cd69ba00c33aa2fcd80545

    SHA512

    7d59934cb8fa07ae8f05f46affcfc53f3799c7a5e2bb52d9634146c1773ab9bd885f35b4d6c531fcd68c6721926bee3f1f14dc46dee4f7b694fee009c684ab1c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

    Filesize

    432B

    MD5

    6df7a5d82a7d9ad57cd995a7041b5506

    SHA1

    3579e91a0c414ac832635977015fdd148bd61bd9

    SHA256

    83437499585965b79111d693aa9ff30791f23a65a0ffbfe0db8605f7bc12f187

    SHA512

    5c686f3e091fd7cfc9d6f36ddea86a5f28fcb64b37ad100c37edf047530a401be116b64c7a86a5273212d0791a3819abaea718dbca54dae26e9927cf3c02b36c

  • C:\Users\Admin\AppData\Roaming\Brotsoft\Player\pt\NarutoOnline\gamebox.ini

    Filesize

    105B

    MD5

    8f6f2ac23b1b1cee6fafec7f699d5a05

    SHA1

    c42f4b4d3c060267a764df430d616b9c00d758d9

    SHA256

    ec80d9f595fa574aa804c9b6c83e5fe36fdcf398ad5eca3e9f2092ac814565f5

    SHA512

    39987c41fcc5738e49c63b5843e68c36677ec47f8a947be2dad3df27589d1873639fc03029695c134cddd7cdddb006cd5e281bdcf966d033467f28671fceec7c

  • C:\Users\Admin\AppData\Roaming\Brotsoft\Player\pt\NarutoOnline\gamebox.ini

    Filesize

    131B

    MD5

    3d4f388e47532f547826c7d65942ec51

    SHA1

    2be7691a37b77ece3ade211082c97b271993d94f

    SHA256

    144b64c37f30b00ec79ad6343c462761652f86f20e38ac757f53b65802e900ae

    SHA512

    b972fc6a6b9dfbaa51a6197cde6f681b898a5d667e75012e28aea9a5d1339a6fa9e0eff10adc73581c328bae93bf851c1ecbffe3fec0871f888914bb4b2e2dc3

  • C:\Users\Admin\AppData\Roaming\Brotsoft\Player\pt\NarutoOnline\temp\cache\f_000005

    Filesize

    20KB

    MD5

    87e8230a9ca3f0c5ccfa56f70276e2f2

    SHA1

    eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

    SHA256

    e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

    SHA512

    37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

  • C:\Users\Admin\AppData\Roaming\Brotsoft\Player\pt\NarutoOnline\temp\cache\f_000009

    Filesize

    74KB

    MD5

    8bdcc6e17e44f9b95b36d534488a5758

    SHA1

    77c24651543a801f104c596dcafe91606d104cf8

    SHA256

    97b6bcee7015034925f48d86e62f5116e9243f452cfd274de08ca8b8e1314474

    SHA512

    d7865ff3ad4b65f51451e0a1f3fa4e86ed6a59c9e5fe5f9c6e7439d3ba175c1c7f21366400682a68d939943883029d85b3a582141c183e20b0382d48fe235ea9

  • C:\Windows\Temp\sdrecord.ini

    Filesize

    173B

    MD5

    65e8effea55df689fd770d1b0ccfb959

    SHA1

    d4b3b99a02171c2462ff55be06cd0f76c8d5143e

    SHA256

    474c4ddecc6ccaef53fe5e8b2bc9dfd944ddd0ce6322d0a8c539c7c23b6df96c

    SHA512

    b8accd5021ecdf72b9ddc113e80bbced8de24be3538b8fddeb17803efdd5b37b0fb935169cd45dc36962a8b552dccc677bf3b456b1fa9e0549ecb7e783154437

  • memory/776-63-0x0000000003960000-0x0000000003961000-memory.dmp

    Filesize

    4KB

  • memory/776-12-0x0000000003960000-0x0000000003961000-memory.dmp

    Filesize

    4KB

  • memory/5948-54-0x000000006FFF0000-0x0000000070000000-memory.dmp

    Filesize

    64KB

  • memory/5948-114-0x0000000075840000-0x0000000075ACA000-memory.dmp

    Filesize

    2.5MB

  • memory/5948-55-0x0000000027700000-0x0000000027701000-memory.dmp

    Filesize

    4KB

  • memory/5948-115-0x0000000003230000-0x000000000682C000-memory.dmp

    Filesize

    54.0MB

  • memory/5948-139-0x0000000003230000-0x000000000682C000-memory.dmp

    Filesize

    54.0MB