General
-
Target
TLauncher-2.86-Installer-1.0.1.exe
-
Size
21.7MB
-
Sample
240629-nj2msawgqa
-
MD5
f643be370cc9763a17f7746b1b6a0243
-
SHA1
c65391f59a6e1421d783eaf43eb9661cfd476f82
-
SHA256
5ab5f39d143b6ff77df2fd5026ac8e4788edfd3de27a4e1fa4b420a7d2f61d38
-
SHA512
5ce377dc1a4a59723cf2b969c0cadb3197e5bf61d0064e2e8c94a0be9d4fd1cd9b33e05078a17e89f54b763e180be32ce14b46949a58ff47e5df18183291142f
-
SSDEEP
393216:WXYwVCtYto0fs/dQETVlOBbpFEj9GZdqV56HpkbGCST7yuk9sLx:WowVCWTHExiTTqqHpMsV
Static task
static1
Behavioral task
behavioral1
Sample
TLauncher-2.86-Installer-1.0.1.exe
Resource
win7-20240220-en
Malware Config
Targets
-
-
Target
TLauncher-2.86-Installer-1.0.1.exe
-
Size
21.7MB
-
MD5
f643be370cc9763a17f7746b1b6a0243
-
SHA1
c65391f59a6e1421d783eaf43eb9661cfd476f82
-
SHA256
5ab5f39d143b6ff77df2fd5026ac8e4788edfd3de27a4e1fa4b420a7d2f61d38
-
SHA512
5ce377dc1a4a59723cf2b969c0cadb3197e5bf61d0064e2e8c94a0be9d4fd1cd9b33e05078a17e89f54b763e180be32ce14b46949a58ff47e5df18183291142f
-
SSDEEP
393216:WXYwVCtYto0fs/dQETVlOBbpFEj9GZdqV56HpkbGCST7yuk9sLx:WowVCWTHExiTTqqHpMsV
-
Modifies file permissions
-
Adds Run key to start application
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1