Analysis
- user interaction
yes - max time kernel
150s - max time network
143s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
30/04/2026, 10:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Launcher.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Launcher.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target Launcher.exe
- Size 28.6MB
- Sample260430-mpdmgag17j
- SHA256 b8ad7b9f2eed92ba0c5b755c769a55b33afd03263b39c654dd97126439990733
- MD5 526e66f420acd9b4cc10b57240836539
- SHA1 349e9dad7dc9a3d413cd94154f3443045453c373
- SHA512 ab861fc0705ae4120222bd4e3b47339c5de777dbfe932e4637b3a84fbd39fd36aaa8c322e63ef21939048ebd143ad095ee0fb8a23c803884abaa0cbd8b9b6b0e
- SSDEEP 393216:zlrnCDutahC6nqJREs8RHgkp4VxmZ72k5kbHPBqwSZ7gNjk5HNhGr+sVLE91thPd:2H4V7Q0LE93hPhZF
- TLSH T17E67CF87626C24CAC47692BC8542513AF2B7F8195760C3FB59D3FDA60FA36C01E7AB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings Launcher.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe 3240 Launcher.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 5600 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5600 AUDIODG.EXE - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3240 Launcher.exe 2304 OpenWith.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3240
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004C81⤵
- Suspicious use of AdjustPrivilegeToken
PID:5600
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:2304