General
-
Target
TLauncher-Installer-1.4.7.exe
-
Size
24.1MB
-
Sample
240701-a75gpathnq
-
MD5
6c6d9d44d11a3dabdd12190827499fd2
-
SHA1
493b199a43cd915f7b5113bf3841da3b3672421c
-
SHA256
2ccb74ef3a067234c9a718f052e03ebe47954828cf08f75fdebdc5c645950b3d
-
SHA512
6e9348aa831a0e306bf180194cb4c289aeb89762c8af8137e41387a68bb341a32bcafe5c17544adccfd8d51e69458b9bb20e288021f6fdc46a1133be4352d59d
-
SSDEEP
786432:ZKxabBbJyM9irrKJBH5lFRqH0fYk/pUJ8a:ZKcSMQPKJBZlCUfYSpUJ8
Static task
static1
Behavioral task
behavioral1
Sample
TLauncher-Installer-1.4.7.exe
Resource
win7-20240220-en
Malware Config
Targets
-
-
Target
TLauncher-Installer-1.4.7.exe
-
Size
24.1MB
-
MD5
6c6d9d44d11a3dabdd12190827499fd2
-
SHA1
493b199a43cd915f7b5113bf3841da3b3672421c
-
SHA256
2ccb74ef3a067234c9a718f052e03ebe47954828cf08f75fdebdc5c645950b3d
-
SHA512
6e9348aa831a0e306bf180194cb4c289aeb89762c8af8137e41387a68bb341a32bcafe5c17544adccfd8d51e69458b9bb20e288021f6fdc46a1133be4352d59d
-
SSDEEP
786432:ZKxabBbJyM9irrKJBH5lFRqH0fYk/pUJ8a:ZKcSMQPKJBZlCUfYSpUJ8
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks for any installed AV software in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-