General
- Target PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
- Size 22.9MB
- Sample260922-txchpsyeke
- SHA256 fa3e726aacdb530e8305c65a081338e470773e5c163d1e424e2f8741a75c696e
- MD5 789615fa8e3e4c6d6961042398603a38
- SHA1 91661f26566717313935aff3eb86ccf6ec247811
- SHA512 5526d0b80d609a7061fde144453640290c84ee4ccba84a142908e20f0dca2726a44d62d8f20325487a0f5b833e437eae8ac10d919dff3a8e8ec9f530926b8303
- SSDEEP 393216:/4Vr903YYxsHMr7Sc733UoUnOfg21N3RYTUyQwACcspokbGaCunFRdd0GoPOtOoc:/Mri3YYxssr7Z3VUnOfdhgUrpCcsaaCt
- TLSH T1403723CE67744004C58E0F34969AA0C07A1AAD1712F0E8BBEA37F1C9ADB5DD946DEC5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
Resource
win10v2004-20260911-en
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
Resource
win11ltsc2024-20260911-en
23 signatures
900 seconds
Malware Config
Targets
-
- Target PrismLauncher-Windows-MSVC-Setup-11.1.0.exe
- Size 22.9MB
- SHA256 fa3e726aacdb530e8305c65a081338e470773e5c163d1e424e2f8741a75c696e
- MD5 789615fa8e3e4c6d6961042398603a38
- SHA1 91661f26566717313935aff3eb86ccf6ec247811
- SHA512 5526d0b80d609a7061fde144453640290c84ee4ccba84a142908e20f0dca2726a44d62d8f20325487a0f5b833e437eae8ac10d919dff3a8e8ec9f530926b8303
- SSDEEP 393216:/4Vr903YYxsHMr7Sc733UoUnOfg21N3RYTUyQwACcspokbGaCunFRdd0GoPOtOoc:/Mri3YYxssr7Z3VUnOfdhgUrpCcsaaCt
- TLSH T1403723CE67744004C58E0F34969AA0C07A1AAD1712F0E8BBEA37F1C9ADB5DD946DEC5C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1