Overview

overview

7

Static

static

3

PrismLaunc....5.exe

windows11-21h2-x64

7

PrismLaunc....5.exe

windows11-ltsc_2024-x64

7

Resubmissions

20/07/2026, 18:13

260720-wtq8ssay2q7

20/07/2026, 18:12

260720-wtk2sacv8s

20/07/2026, 18:10

260720-wse45sax6r7

Analysis

  • user interaction
    yes
  • max time kernel
    54s
  • max time network
    48s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 18:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PrismLauncher-Windows-MinGW-arm64-Setup-10.0.5.exe
  • Size 42.0MB
  • Sample260720-wtq8ssay2q
  • SHA256 d9fa8b5792568df455a2f61521c0ae7facc7acfab7b1f2e2f41ed298c5cdca1c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies registry class 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MinGW-arm64-Setup-10.0.5.exe
    "C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MinGW-arm64-Setup-10.0.5.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:6140
    • C:\Windows\SysWOW64\TaskKill.exe
      TaskKill /IM prismlauncher.exe /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4176

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        prismlauncher.exe
        • Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
        • Size 18.8MB
        • SHA256 4a2427b29ad4516b35a9641970030144166e2064d3d624976088989f4ac707db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nss88BF.tmp\System.dll
        • Size 12KB
        • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        modern-wizard.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\nss88BF.tmp\modern-wizard.bmp
        • Size 25KB
        • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsDialogs.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nss88BF.tmp\nsDialogs.dll
        • Size 9KB
        • SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsExec.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nss88BF.tmp\nsExec.dll
        • Size 7KB
        • SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download