Analysis
- user interaction
yes - max time kernel
102s - max time network
105s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 23:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Stand.Launchpad.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target Stand.Launchpad.exe
- Size 74KB
- Sample260804-3mls3aad23
- SHA256 2d3f8de8b5d596e953d467cd8079070abe5e51d3deca159a3776f56965d56222
- MD5 3219a95467be9ab4b8e26586e0c7ce06
- SHA1 882d9fbccc090c5e05a05e27cecaa00a6d31cb7f
- SHA512 aae5a10f3d9485abf5ac2ee178724680e0722434ac2c57af968dccd46bfdc7f6d9f7aea34d82367a28276b2b5977ae321f4a1af1b51e3eba403ce35fcd110c5c
- SSDEEP 768:mgI1eZXaHQBaKI4MjjMlvbmndydf9tdZIgiMDeLPPcc5tul5scYhb:w1tYMzMBbmnItdZIgvQ3Ol5scmb
- TLSH T16773080737AC436BDAFE1AF9297111304BB1F95E9521D78C3C9950CD5BEDBA04A20BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 10 2092 Stand.Launchpad.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Control Panel\Colors Stand.Launchpad.exe - Modifies registry class 41 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents" Stand.Launchpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ Stand.Launchpad.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell Stand.Launchpad.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 Stand.Launchpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ Stand.Launchpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ Stand.Launchpad.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Stand.Launchpad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Stand.Launchpad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" Stand.Launchpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ Stand.Launchpad.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff Stand.Launchpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\ Stand.Launchpad.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg Stand.Launchpad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" Stand.Launchpad.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Stand.Launchpad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2" Stand.Launchpad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" Stand.Launchpad.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Stand.Launchpad.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 Stand.Launchpad.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Stand.Launchpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Stand.Launchpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ Stand.Launchpad.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} Stand.Launchpad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" Stand.Launchpad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" Stand.Launchpad.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000 Stand.Launchpad.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff Stand.Launchpad.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Stand.Launchpad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" Stand.Launchpad.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Stand.Launchpad.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\NotificationData Stand.Launchpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\ Stand.Launchpad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" Stand.Launchpad.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings Stand.Launchpad.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell Stand.Launchpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ Stand.Launchpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\ Stand.Launchpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ Stand.Launchpad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" Stand.Launchpad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\ Stand.Launchpad.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 Stand.Launchpad.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2092 Stand.Launchpad.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2092 Stand.Launchpad.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2092 Stand.Launchpad.exe 2092 Stand.Launchpad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe"C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe"1⤵
- Downloads MZ/PE file
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2092
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1188
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Calamity,_Inc\Stand.Launchpad.exe_Url_rz0v4fzocioy3g23muw4v53aivui0hlg\1.9.3.0\user.config
- Size 946B
- SHA256 8409dd0aa292b3bf50903a7ca1a1a0d6697d5c7b0ed3d1c5e43ebdf6f82db074
- MD5 b4ae24f20e59e454d57443d663a7581e
- SHA1 68ab33e7fcea8bf79d76728fc49338d0d10a12f6
- SHA512 25a7cbc382609d298ecaedea567231ac6ba0856bc523550912fd7b8393a29664ad68e9490dff0ff25b18b7a018476798c4df1000ebc99174bb6f2d5604e383f5
- TLSH T10911480571C0BE6B42B36F32CA214644EEB142E755362568BC7D62A79F304CA07833AA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Calamity,_Inc\Stand.Launchpad.exe_Url_rz0v4fzocioy3g23muw4v53aivui0hlg\1.9.3.0\user.config
- Size 1KB
- SHA256 baf745ec4ae8a7e12a355d2465b657f16eb17fb81b52dc773ce00040f37322b3
- MD5 68ba8901729e7430d02d3062556fffcf
- SHA1 e3e67a576582785c6ac8ccd63f9c6622c9050d41
- SHA512 1e21d21a5c36b7d2f80611b3eaa7abecf612d7b832ea52ce88f9f8e8b4c8a77242107b25783757e3ea2fa8e47c9ea303c94c1c5c8949ccf392302ee1c57b499d
- TLSH T1AD212B0871C1AEAB01B36B31DB314284EDB042A7513621E4B8BD72675F308CA07D33AA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
- Size 28KB
- SHA256 f23b871a1a805344208513a1efe8af879edca8004f39c65b311460fa2b4f9423
- MD5 144a96427aa8c9c37bddd26cbba05a38
- SHA1 044722c398c1765d49b61ed52a0c6bba77ad7542
- SHA512 dfd69cf1c3fca375761d8628d8978f2eedb0b8b443b0e6fba0241cbdbe3d6cc82bb166ebb9927df9d547f17e12288e58c3ddbba86082dc23092b9d62fa52690c
- SSDEEP 96:IUJdKtZ1y1cK9AD9vGQbbQTPqQYUG1A+UVAkPBJLVQ86eVFaX:IUJstZdK9AD9OoQsFAnAkJdVQ8VVsX
- TLSH T1FDD25556B404EA12DD0A2C36EFEAD9EC33313E21CD9A031379C6B77F49BB1C08868549
- MD5 SHA1 SHA512 SSDEEP TLSH