Overview
overview
6Static
static
3去脚本�...��.url
windows10-2004-x64
1去脚本�...��.url
windows11-ltsc_2024-x64
1快速启�...ch.exe
windows10-2004-x64
3快速启�...ch.exe
windows11-ltsc_2024-x64
3快速启�...in.exe
windows10-2004-x64
1快速启�...in.exe
windows11-ltsc_2024-x64
1快速启�...ok.dll
windows10-2004-x64
1快速启�...ok.dll
windows11-ltsc_2024-x64
1快速启�...en.chm
windows10-2004-x64
1快速启�...en.chm
windows11-ltsc_2024-x64
1快速启�...se.dll
windows10-2004-x64
1快速启�...se.dll
windows11-ltsc_2024-x64
1快速启�...sh.dll
windows10-2004-x64
1快速启�...sh.dll
windows11-ltsc_2024-x64
1快速启�...up.exe
windows10-2004-x64
6快速启�...up.exe
windows11-ltsc_2024-x64
6快速启�...ch.exe
windows10-2004-x64
3快速启�...ch.exe
windows11-ltsc_2024-x64
3快速启�...in.exe
windows10-2004-x64
3快速启�...in.exe
windows11-ltsc_2024-x64
3快速启�...ok.dll
windows10-2004-x64
3快速启�...ok.dll
windows11-ltsc_2024-x64
3快速启�...en.chm
windows10-2004-x64
1快速启�...en.chm
windows11-ltsc_2024-x64
1快速启�...se.dll
windows10-2004-x64
3快速启�...se.dll
windows11-ltsc_2024-x64
3快速启�...sh.dll
windows10-2004-x64
3快速启�...sh.dll
windows11-ltsc_2024-x64
3快速启�...up.exe
windows10-2004-x64
6快速启�...up.exe
windows11-ltsc_2024-x64
6服务器软件.url
windows10-2004-x64
1服务器软件.url
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 03:37
Behavioral task
behavioral1
Sample
去脚本之家看看.url
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
去脚本之家看看.url
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
快速启动管理器(CLaunch)4.22.x64汉化绿色便携版/CLaunch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
快速启动管理器(CLaunch)4.22.x64汉化绿色便携版/CLaunch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
快速启动管理器(CLaunch)4.22.x64汉化绿色便携版/ClAdmin.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
快速启动管理器(CLaunch)4.22.x64汉化绿色便携版/ClAdmin.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
快速启动管理器(CLaunch)4.22.x64汉化绿色便携版/ClHook.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
快速启动管理器(CLaunch)4.22.x64汉化绿色便携版/ClHook.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
快速启动管理器(CLaunch)4.22.x64汉化绿色便携版/Docs/CLaunch_en.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
快速启动管理器(CLaunch)4.22.x64汉化绿色便携版/Docs/CLaunch_en.chm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
快速启动管理器(CLaunch)4.22.x64汉化绿色便携版/Languages/Chinese.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
快速启动管理器(CLaunch)4.22.x64汉化绿色便携版/Languages/Chinese.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
快速启动管理器(CLaunch)4.22.x64汉化绿色便携版/Languages/English.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
快速启动管理器(CLaunch)4.22.x64汉化绿色便携版/Languages/English.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
快速启动管理器(CLaunch)4.22.x64汉化绿色便携版/Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
快速启动管理器(CLaunch)4.22.x64汉化绿色便携版/Setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
快速启动管理器(CLaunch)4.22.x86汉化绿色便携版/CLaunch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
快速启动管理器(CLaunch)4.22.x86汉化绿色便携版/CLaunch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
快速启动管理器(CLaunch)4.22.x86汉化绿色便携版/ClAdmin.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
快速启动管理器(CLaunch)4.22.x86汉化绿色便携版/ClAdmin.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
快速启动管理器(CLaunch)4.22.x86汉化绿色便携版/ClHook.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
快速启动管理器(CLaunch)4.22.x86汉化绿色便携版/ClHook.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
快速启动管理器(CLaunch)4.22.x86汉化绿色便携版/Docs/CLaunch_en.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
快速启动管理器(CLaunch)4.22.x86汉化绿色便携版/Docs/CLaunch_en.chm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
快速启动管理器(CLaunch)4.22.x86汉化绿色便携版/Languages/Chinese.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
快速启动管理器(CLaunch)4.22.x86汉化绿色便携版/Languages/Chinese.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
快速启动管理器(CLaunch)4.22.x86汉化绿色便携版/Languages/English.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
快速启动管理器(CLaunch)4.22.x86汉化绿色便携版/Languages/English.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
快速启动管理器(CLaunch)4.22.x86汉化绿色便携版/Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
快速启动管理器(CLaunch)4.22.x86汉化绿色便携版/Setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
服务器软件.url
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
服务器软件.url
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target 快速启动管理器(CLaunch)4.22.x86汉化绿色便携版/Setup.exe
- Size 122KB
- Sample260804-d6vsmsvvgy
- SHA256 42e7cb84d799ebccbad62a8a7e274b0bafc92651820765376124cdda6d1f5a7b
- MD5 63a6a62aa43e83dc00b2cbe6bf672f0a
- SHA1 af6bf291068a9b4551c82b3a5fc2f37f2c610c1f
- SHA512 9af6440aac009ce184b8f7620bdd39feac59c9e6b175c22095c5fc6da1237d62ea4d3f22d14dce8decf4a2b91d3f021acaee083edcccc086e4fd2bb2d398b7c9
- SSDEEP 3072:/U4g/sQdCf/j4mkseu69fQhZrksEM0U93LJZV6SCXxvoEwTqN80C1:CkoC2FQLrk2vJbCKEcR0C1
- TLSH T102C36C0076D1D471D67605372860AEA0C63EFD315F75DEDBB7844ABA0E306C0EB36AA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 22 IoCs
description ioc Process File created C:\Program Files (x86)\CLaunch\Docs\CLaunch_en.chm Setup.exe File opened for modification C:\Program Files (x86)\CLaunch\Languages\Chinese.dll Setup.exe File created C:\Program Files (x86)\CLaunch\CLaunch.exe Setup.exe File created C:\Program Files (x86)\CLaunch\Languages\English.dll Setup.exe File opened for modification C:\Program Files (x86)\CLaunch\Skins\Solid Black.zip Setup.exe File created C:\Program Files (x86)\CLaunch\Skins\Vista-style.zip Setup.exe File opened for modification C:\Program Files (x86)\CLaunch\Skins\Vista-style.zip Setup.exe File opened for modification C:\Program Files (x86)\CLaunch\Languages\English.dll Setup.exe File created C:\Program Files (x86)\CLaunch\ClHook.dll Setup.exe File created C:\Program Files (x86)\CLaunch\ClAdmin.exe Setup.exe File opened for modification C:\Program Files (x86)\CLaunch\ClAdmin.exe Setup.exe File opened for modification C:\Program Files (x86)\CLaunch\Docs\CLaunch_en.chm Setup.exe File opened for modification C:\Program Files (x86)\CLaunch\Languages\Language.ini Setup.exe File opened for modification C:\Program Files (x86)\CLaunch\ClHook.dll Setup.exe File created C:\Program Files (x86)\CLaunch\Setup.exe Setup.exe File created C:\Program Files (x86)\CLaunch\Languages\Chinese.dll Setup.exe File created C:\Program Files (x86)\CLaunch\Languages\Language.ini Setup.exe File created C:\Program Files (x86)\CLaunch\Skins\Glass.zip Setup.exe File opened for modification C:\Program Files (x86)\CLaunch\Skins\Glass.zip Setup.exe File created C:\Program Files (x86)\CLaunch\Skins\Solid Black.zip Setup.exe File opened for modification C:\Program Files (x86)\CLaunch\CLaunch.exe Setup.exe File opened for modification C:\Program Files (x86)\CLaunch\Setup.exe Setup.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeBackupPrivilege 1672 Setup.exe Token: SeRestorePrivilege 1672 Setup.exe Token: SeBackupPrivilege 1672 Setup.exe Token: SeRestorePrivilege 1672 Setup.exe