1be9e53ae94c6af7ec5f6f50b46f9126064e6064e12ec6956d546d123e02de88

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 23:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
claude_launcher.exe
Size 125KB
Sample261027-3wkblaws8q
SHA256 1be9e53ae94c6af7ec5f6f50b46f9126064e6064e12ec6956d546d123e02de88
MD5 0fad29a61a424ce3c23eac453470ccbb
SHA1 a653464bf1c7bd44e1acdc6858ca425e6ca7d60b
SHA512 e6f0c660fc3d0bafc928d9a9020e6794a71eb49196a99d50c5257472172a69c8b38be0e3e45bbc109eb65ceb46fc33fe743f47a84b63209f9106a4febc5ffcb1
SSDEEP 3072:3MINdqttHixVPOdE4+5omzlbzgW/zwgOzutn:cINdcRixVNB5omzlQWz3Ozut
TLSH
T18EC37D2AEA1840EEE219D8B8CA635C05CB72FC96176097CF67804EDB0F27AD55F3E511
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4516	powershell.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	claude_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	claude_launcher.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\AppUserModelId\NotCode.ClaudeLauncher\DisplayName = "ClaudeLauncher"	claude_launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\AppUserModelId\NotCode.ClaudeLauncher\IconUri = "C:\\Users\\Admin\\AppData\\Local\\Temp\\data\\flutter_assets\\assets\\icon\\app_icon.png"	claude_launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\AppUserModelId\NotCode.ClaudeLauncher\CustomActivator = "{d0cc905a-995e-4349-aa39-dc9f260a3fe9}"	claude_launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\AppUserModelId\NotCode.ClaudeLauncher	claude_launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\AppUserModelId	claude_launcher.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4516	powershell.exe
3036	claude_launcher.exe
3036	claude_launcher.exe
3036	claude_launcher.exe
3036	claude_launcher.exe
3036	claude_launcher.exe
3036	claude_launcher.exe
3036	claude_launcher.exe
3036	claude_launcher.exe
4516	powershell.exe
4516	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4516	powershell.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3036	claude_launcher.exe
3036	claude_launcher.exe
3036	claude_launcher.exe
3036	claude_launcher.exe
3036	claude_launcher.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3036	claude_launcher.exe
3036	claude_launcher.exe
3036	claude_launcher.exe
3036	claude_launcher.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3036	claude_launcher.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 4516	3036	claude_launcher.exe	89

C:\Users\Admin\AppData\Local\Temp\claude_launcher.exe
"C:\Users\Admin\AppData\Local\Temp\claude_launcher.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\ClaudeLauncher\cowork-firewall\script.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

script.ps1

Path C:\Users\Admin\AppData\Local\Temp\ClaudeLauncher\cowork-firewall\script.ps1
Size 479B
SHA256 2f4a06409d1ed5fb7ab01f31b7d688e72e5d2aa2f27b1dddde5748c7d513329d
MD5 8670f4a52206f0e23752a6ef31e1803b
SHA1 bfb859f18d6527e15ca5239c2d42fd1f4d11018c
SHA512 d5cbd127828e7aed163ed3b3eed4ca58be7afbc5ed7141f433a6ed4673aec47f87809772b3c13edf8d054763e753d6974d971dc32a406841b6e362b164cae742
TLSH
T1F8F02E44E6538842039067357AFFF35F20392D7869463ED19D74854C20C5E48DE45F09
MD5 SHA1 SHA512 TLSH

Submit Download

claude-notifications.json

Path C:\Users\Admin\AppData\Roaming\notcodeone\ClaudeLauncher\claude-notifications.json
Size 51B
SHA256 889253340ed4d30413a28b5b5bd1c6b99db4e9b393fd5a9180f1fdc63f3ccb4b
MD5 91c02de1b4779ac3b20513eb4057bd08
SHA1 7959816ed8d29954accd68372e846a0b7965fcaf
SHA512 22aee80bbb87b74808c122e34a1d572e17d89687e2065e80e752138cdaba72a7c31bd5bbce62b82a0569eee863971dae73da4d96e1de518bc67211e66507b4ac
TLSH
T1AF90021DED05087302F0044D45B69186468C8C5A07C1241482D31454490C15040A1E02
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3036-0-0x000001F269050000-0x000001F269051000-memory.dmp

Download

memory/3036-4-0x000001F269060000-0x000001F269061000-memory.dmp

Download

memory/3036-1-0x000001F269750000-0x000001F269EF1000-memory.dmp

Download

memory/3036-3-0x000001F269750000-0x000001F269EF1000-memory.dmp

Download

memory/3036-2-0x000001F269750000-0x000001F269EF1000-memory.dmp

Download

memory/3036-7-0x000001F269080000-0x000001F269100000-memory.dmp

Download

memory/3036-6-0x000001F269080000-0x000001F269100000-memory.dmp

Download

memory/3036-15-0x000001F26A650000-0x000001F26A656000-memory.dmp

Download

memory/4516-23-0x00000219FFB80000-0x00000219FFBA2000-memory.dmp

Download