Analysis
- max time kernel
150s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 11:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
horizon-launcher.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target horizon-launcher.exe
- Size 37.3MB
- Sample261030-ngnm5sysfv
- SHA256 ef901348e259c39c83b8d246ecc92ccdeb4134aa07390777550799f2cfe63499
- MD5 2c8bf88e757e776f7c578d3c48f2c840
- SHA1 062ff4334d4115cb21a3cf85f8e37d414a8e211f
- SHA512 0fd3af84fb4ef9ac2d2273e17164f5d1ebe8cc82a6621a4b277b625539258f6b1182c5b9a095b7cd968495fcc95698ceb9c84455b5bbf9a1be7d910fbc04e3fa
- SSDEEP 393216:wDLy7S0NOs84VCbeQ7pZhe9iMuqlxWnDS4mDhMgDWpjn:b8MYZhrAIQdW9
- TLSH T178871811BB5B686CD05AC8B0834A8A335A3134DB1B35B9FF44D492353FBEAE45B38719
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 6 raw.githubusercontent.com 8 raw.githubusercontent.com -
pid Process 4156 powershell.exe 2344 powershell.exe 1384 powershell.exe 5520 powershell.exe 2104 powershell.exe 2592 powershell.exe 792 powershell.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5756 cmd.exe 1172 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname horizon-launcher.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain horizon-launcher.exe - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2104 powershell.exe 2104 powershell.exe 2592 powershell.exe 2592 powershell.exe 792 powershell.exe 792 powershell.exe 4156 powershell.exe 4156 powershell.exe 4156 powershell.exe 2344 powershell.exe 2344 powershell.exe 2344 powershell.exe 1384 powershell.exe 1384 powershell.exe 1384 powershell.exe 5520 powershell.exe 5520 powershell.exe 5520 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2104 powershell.exe Token: SeIncreaseQuotaPrivilege 2104 powershell.exe Token: SeSecurityPrivilege 2104 powershell.exe Token: SeTakeOwnershipPrivilege 2104 powershell.exe Token: SeLoadDriverPrivilege 2104 powershell.exe Token: SeSystemProfilePrivilege 2104 powershell.exe Token: SeSystemtimePrivilege 2104 powershell.exe Token: SeProfSingleProcessPrivilege 2104 powershell.exe Token: SeIncBasePriorityPrivilege 2104 powershell.exe Token: SeCreatePagefilePrivilege 2104 powershell.exe Token: SeBackupPrivilege 2104 powershell.exe Token: SeRestorePrivilege 2104 powershell.exe Token: SeShutdownPrivilege 2104 powershell.exe Token: SeDebugPrivilege 2104 powershell.exe Token: SeSystemEnvironmentPrivilege 2104 powershell.exe Token: SeRemoteShutdownPrivilege 2104 powershell.exe Token: SeUndockPrivilege 2104 powershell.exe Token: SeManageVolumePrivilege 2104 powershell.exe Token: 33 2104 powershell.exe Token: 34 2104 powershell.exe Token: 35 2104 powershell.exe Token: 36 2104 powershell.exe Token: SeDebugPrivilege 2592 powershell.exe Token: SeIncreaseQuotaPrivilege 2592 powershell.exe Token: SeSecurityPrivilege 2592 powershell.exe Token: SeTakeOwnershipPrivilege 2592 powershell.exe Token: SeLoadDriverPrivilege 2592 powershell.exe Token: SeSystemProfilePrivilege 2592 powershell.exe Token: SeSystemtimePrivilege 2592 powershell.exe Token: SeProfSingleProcessPrivilege 2592 powershell.exe Token: SeIncBasePriorityPrivilege 2592 powershell.exe Token: SeCreatePagefilePrivilege 2592 powershell.exe Token: SeBackupPrivilege 2592 powershell.exe Token: SeRestorePrivilege 2592 powershell.exe Token: SeShutdownPrivilege 2592 powershell.exe Token: SeDebugPrivilege 2592 powershell.exe Token: SeSystemEnvironmentPrivilege 2592 powershell.exe Token: SeRemoteShutdownPrivilege 2592 powershell.exe Token: SeUndockPrivilege 2592 powershell.exe Token: SeManageVolumePrivilege 2592 powershell.exe Token: 33 2592 powershell.exe Token: 34 2592 powershell.exe Token: 35 2592 powershell.exe Token: 36 2592 powershell.exe Token: SeDebugPrivilege 792 powershell.exe Token: SeIncreaseQuotaPrivilege 792 powershell.exe Token: SeSecurityPrivilege 792 powershell.exe Token: SeTakeOwnershipPrivilege 792 powershell.exe Token: SeLoadDriverPrivilege 792 powershell.exe Token: SeSystemProfilePrivilege 792 powershell.exe Token: SeSystemtimePrivilege 792 powershell.exe Token: SeProfSingleProcessPrivilege 792 powershell.exe Token: SeIncBasePriorityPrivilege 792 powershell.exe Token: SeCreatePagefilePrivilege 792 powershell.exe Token: SeBackupPrivilege 792 powershell.exe Token: SeRestorePrivilege 792 powershell.exe Token: SeShutdownPrivilege 792 powershell.exe Token: SeDebugPrivilege 792 powershell.exe Token: SeSystemEnvironmentPrivilege 792 powershell.exe Token: SeRemoteShutdownPrivilege 792 powershell.exe Token: SeUndockPrivilege 792 powershell.exe Token: SeManageVolumePrivilege 792 powershell.exe Token: 33 792 powershell.exe Token: 34 792 powershell.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5692 horizon-launcher.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5692 horizon-launcher.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5692 wrote to memory of 2104 5692 horizon-launcher.exe 90 PID 5692 wrote to memory of 2592 5692 horizon-launcher.exe 93 PID 5692 wrote to memory of 792 5692 horizon-launcher.exe 95 PID 5692 wrote to memory of 5756 5692 horizon-launcher.exe 97 PID 5692 wrote to memory of 4156 5692 horizon-launcher.exe 99 PID 5692 wrote to memory of 2344 5692 horizon-launcher.exe 101 PID 5692 wrote to memory of 1172 5692 horizon-launcher.exe 103 PID 5692 wrote to memory of 1384 5692 horizon-launcher.exe 105 PID 5692 wrote to memory of 5520 5692 horizon-launcher.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\horizon-launcher.exe"C:\Users\Admin\AppData\Local\Temp\horizon-launcher.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "(Get-CimInstance Win32_Processor | Select-Object -First 1).MaxClockSpeed"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "(Get-CimInstance Win32_Processor | Measure-Object NumberOfCores -Sum).Sum"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "@(Get-CimInstance Win32_Battery).Count"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:792
-
-
C:\Windows\system32\cmd.exe"cmd" /C ver2⤵
- Executes a command shell one-liner
PID:5756
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4156
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "(Get-CimInstance Win32_Battery | Select-Object -First 1).BatteryStatus"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2344
-
-
C:\Windows\system32\cmd.exe"cmd" /C ver2⤵
- Executes a command shell one-liner
PID:1172
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1384
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "(Get-CimInstance Win32_Battery | Select-Object -First 1).BatteryStatus"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5520
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 6b5ab6f03a56066846396806e5861ea202b0042a09eca2b274fb59f8b53bb216
- MD5 38ce8e0370ad1e9689327c9457d7b390
- SHA1 325b4ec139782df9dad39a822ae2ba64721cc4ea
- SHA512 3181f878daab2faae02dd0a5d1004a13f6932e7d57a9348ce5f018e233a0c9757ba418a8f4aeb9154b5911571445acf9784860e8379276a8360913b1b19ca315
- TLSH T163217633B3DC8664C899013A10DDAC1036B787DB40DECFDB2B85D169A82F699CFA1160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 606ea2b5e0c803bcb6a4ba52e8df9cc72ff66158225b17ee1303a69cfd694910
- MD5 68a920aadf415dbad5b78eafec154340
- SHA1 928537ba764a652a3622507248683ffddba3fe4a
- SHA512 ac723094adaee2791de662e04fb4ae9b6a90c96a88c5e005e6f54bb5210b4e1bddcdc415069aef7e75ad02ee36e71b40249679d12c3fe9ed8e027a48f2973aef
- TLSH T138219837F3DC8214CCA9003A10DDAD0036B6CBCB40DECF5B6B81E159A42F298CFA0060
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 501c9fb7a27a5370da5ff00cfe49ae01e7f5ce5c7958df916c921e0336d546e3
- MD5 26720bb7e11890f83dad507fb495c6b3
- SHA1 c5740a74374ccd4fbf4543abf0b5df93f5be979a
- SHA512 6e7f1f6bc8153e1b0178363b183a3d064e3ac45ad8b156b02abd8a48cb455cb2d4ab7fb95bc76b4edeec1c335af67f9f241f3275d116b49962cb246b8575c61a
- TLSH T182219833F3DC8224CC99013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DFA0160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 c11ba17dffd1ec3a5a6a5007ff7d65ce3e4b45a168312f3ee8fd0ba259e721c1
- MD5 a260df5887ad9dd47cacaff566fe9f3e
- SHA1 465bc8987b1dfa7bde36052af2e143a5b7558c8d
- SHA512 4a375038e82e9beff9898f7c02d384ea50df84708c39f26d955cc2e1bb8e0fe09106e22919423d20c70e79fb4ee9ac7fb51754537a40d691c8d48adea77fcd30
- TLSH T13C217633B3DC8624C899013A10DDAC1036B687CB40DECF9B6B81E159A82F298DF60160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 0d91a2ec5bbc7db0a3afecd4546c9da8d48183c4c941bec2eefec9af3b727e08
- MD5 1302979d02b3a9d29310c227f8731c74
- SHA1 e2fcd4e2638266051c504183cfed203f9245b77f
- SHA512 ed204666035d8771154264e496e9c4a3c1f9276006f322338a17ebfd2ec1df8940b625b3a9034aa59a2be23afe95e43a595495f3e09914535d6d9a76562c3adf
- TLSH T133217633F3DC8694C899413A10DDAC0032BB87CB40DFCF9B6B85E129A42F699CF61060
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 2ab96330a33e8821004febafe33501787710f5ba1ef86f5f82ea7c425a271d61
- MD5 e714605963e4c5db5f36949ee59f921d
- SHA1 009383ba52511b95e7479e83ddf9d855f5a1033e
- SHA512 d1e35d88cbc6dc5312d7990fc075821bd93f19bd3451c2078c486327ccc7cfb306e0cf17e475a145d57298d6d23698b0b6e0c9691289180b8a2761b3ce4aa8f2
- TLSH T12C219833F3DC8224CC9A013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF60160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dcewjpfc.rh2.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\horizon-launcher\versions\nightly-2026-10-30-ba6344a\research-lock.json
- Size 3KB
- SHA256 94381e0432fe546239f900452f6ddddfffcbb2683066d83de5fc25d997dfa6ea
- MD5 0447482eba6aa399e0eeb3c7dfae9ca2
- SHA1 6cf2c50d37fba49958969f1960663636e6bfd2c2
- SHA512 e0bc343142e43de6477e13b9f954d43eb7e08b2afd1f5f4d1c9b23314b2692cb427a31efbce9a3187388bee11f3d31b3574bf92b32986a787f7043e341004b1f
- TLSH T108614337EA288CFB05B09393843E4AC3FB15436F0441994F7E3E628D5FB25721111A7A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\horizon\servers.dat
- Size 82B
- SHA256 7ad26fe02e7acaeccab181c624130c53da9aed302d42d687b3b822773681551a
- MD5 5260d38cf9a69ea0a500875eb37a88c1
- SHA1 e187fe5cff7f141a0c430842481ef2ebf8691534
- SHA512 63dd81dee8b4998e460da0833a0479c0b01a8e1eb87530156199d6ab2fc5d7cae4972648ef157ae8a0d27d16bf24872b123b8e15ddf5d28da294611addc9f296
- TLSH T10EA022BBAB032C2200038B208320EC3A833A80080C3030E82B0AC8B202030EF20C3EC0
- MD5 SHA1 SHA512 TLSH