Analysis
- max time kernel
149s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/08/2026, 18:56
General
- Target PrismLauncher-Windows-MSVC-Setup-11.0.3.exe
- Size 22.8MB
- Sample260824-xle18sysht
- SHA256 6c61bd9fef98c21750b021e0450896749cb25e75b91716bf22423d7ca64c1cb4
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 28 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Kills process with taskkill 1 IoCs
- Modifies registry class 12 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MSVC-Setup-11.0.3.exe"C:\Users\Admin\AppData\Local\Temp\PrismLauncher-Windows-MSVC-Setup-11.0.3.exe"1⤵
- Loads dropped DLL
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TaskKill.exeTaskKill /IM prismlauncher.exe /F2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exeC:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe /install /passive /norestart2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{A401AE66-7342-47ED-A389-DE48A57EADA5}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{A401AE66-7342-47ED-A389-DE48A57EADA5}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe" -burn.filehandle.attached=776 -burn.filehandle.self=780 /install /passive /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{23CC595F-B823-4C3E-9D01-12ADE3EECB33}\.be\VC_redist.x64.exe"C:\Windows\Temp\{23CC595F-B823-4C3E-9D01-12ADE3EECB33}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{EA7AB3CE-C652-49EA-9B15-EB0FEDB21464} {D28361BD-FEAC-4538-B88C-0CCE20E08C8F} 43884⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Qt6Core.dll
Qt6Gui.dll
Qt6Network.dll
Qt6NetworkAuth.dll
Qt6OpenGL.dll
Qt6Widgets.dll
Qt6Xml.dll
archive.dll
bz2.dll
cmark.dll
icuuc.dll
liblzma.dll
lz4.dll
lzo2.dll
qwindows.dll
prismlauncher.exe
qrencode.dll
qt.conf
qtlogging.ini
qmodernwindowsstyle.dll
tomlplusplus-3.dll
vc_redist.x64.exe
zlib1.dll
zstd.dll
NScurl.dll
System.dll
modern-wizard.bmp
nsDialogs.dll
nsExec.dll
logo.png
wixstdba.dll
vc_redist.x64.exe
memory/2700-171-0x00000000730F0000-0x0000000073700000-memory.dmp
memory/3280-226-0x00007FF762510000-0x00007FF762E45000-memory.dmp
memory/3280-220-0x00007FFB525F0000-0x00007FFB52C37000-memory.dmp