File name:

ClientLauncher.exe

Full analysis: https://app.any.run/tasks/8e0b8803-0473-4412-8405-a572fc4becf4
Verdict: Malicious activity
Analysis date: July 23, 2024, 22:22:02
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5:

7BE62B25D923F1B49E120E6CA83E5690

SHA1:

E23342573F201E9D7B86475FF5C4FBF5FE0BB4B6

SHA256:

3E5EB2CA8D6EB0A4C3450A76270112DD364890DCC29D64B1D237BEEBABE4E238

SSDEEP:

1536:HWGcFomlrWIEe4X0Y6HvUiL37H6XRqIXKwo:HWGc5rR14XTaMizmxXKF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • ClientLauncher.exe (PID: 616)
      • java.exe (PID: 3992)
      • javaw.exe (PID: 5632)

  • SUSPICIOUS

    • Checks for Java to be installed

      • ClientLauncher.exe (PID: 616)

    • Process drops legitimate windows executable

      • javaw.exe (PID: 5632)

    • Executable content was dropped or overwritten

      • javaw.exe (PID: 5632)
      • java.exe (PID: 3992)

    • The process drops C-runtime libraries

      • javaw.exe (PID: 5632)

    • Starts CMD.EXE for commands execution

      • java.exe (PID: 3992)
      • wscript.exe (PID: 3800)

    • The process executes VB scripts

      • cmd.exe (PID: 2116)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 2116)
      • cmd.exe (PID: 3948)

    • Executing commands from a ".bat" file

      • java.exe (PID: 3992)
      • wscript.exe (PID: 3800)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 3800)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 3948)

    • The process creates files with name similar to system file names

      • javaw.exe (PID: 5632)

    • Connects to unusual port

      • javaw.exe (PID: 5632)

  • INFO

    • Creates files in the program directory

      • javaw.exe (PID: 5632)

    • Checks supported languages

      • ClientLauncher.exe (PID: 616)
      • javaw.exe (PID: 5632)
      • java.exe (PID: 3992)

    • Reads the computer name

      • javaw.exe (PID: 5632)
      • java.exe (PID: 3992)

    • Creates files or folders in the user directory

      • javaw.exe (PID: 5632)
      • java.exe (PID: 3992)

    • Create files in a temporary directory

      • javaw.exe (PID: 5632)
      • java.exe (PID: 3992)

    • Reads the machine GUID from the registry

      • javaw.exe (PID: 5632)
      • java.exe (PID: 3992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Win16/32 Executable Delphi generic (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:10:29 16:48:14+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.22
CodeSize: 19968
InitializedDataSize: 31232
UninitializedDataSize: 36864
EntryPoint: 0x1290
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
17
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start clientlauncher.exe no specs javaw.exe icacls.exe no specs conhost.exe no specs java.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs cacls.exe no specs wscript.exe no specs cmd.exe conhost.exe no specs cacls.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
304reg add HKEY_CLASSES_ROOT\clientlauncher\shell\open /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
616"C:\Users\admin\AppData\Local\Temp\ClientLauncher.exe" C:\Users\admin\AppData\Local\Temp\ClientLauncher.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\clientlauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1000reg add HKEY_CLASSES_ROOT\clientlauncher\shell /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
2116C:\WINDOWS\system32\cmd.exe /c C:\Users\admin\AppData\Roaming\.clientlauncher\bin\createurlscheme.batC:\Windows\System32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
2228"C:\WINDOWS\system32\cacls.exe" "C:\WINDOWS\system32\config\system"C:\Windows\System32\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Control ACLs Program
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ntmarta.dll
3800"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\getadmin.vbs" C:\Windows\System32\wscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3948"C:\Windows\System32\cmd.exe" /c "C:\Users\admin\AppData\Roaming\CLIENT~1\bin\CREATE~1.BAT" C:\Windows\System32\cmd.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
3992C:\Users\admin\AppData\Roaming\.clientlauncher\bin\java.exe -Djava.library.path=C:\Users\admin\AppData\Roaming\.clientlauncher\bin\opengl -noverify -cp C:\Users\admin\AppData\Roaming\.clientlauncher\lib/* $C:\Users\admin\AppData\Roaming\.clientlauncher\bin\java.exe
javaw.exe
User:
admin
Company:
N/A
Integrity Level:
MEDIUM
Description:
OpenJDK Platform binary
Exit code:
0
Version:
8.0.2520.9
Modules
Images
c:\users\admin\appdata\roaming\.clientlauncher\bin\java.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5200\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5564\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
6 850
Read events
6 825
Write events
25
Delete events
0

Modification events

(PID) Process:(2116) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
Operation:writeName:VBSFile
Value:
(PID) Process:(2116) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2116) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2116) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2116) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3800) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3800) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3800) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3800) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6400) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\clientlauncher
Operation:writeName:URL Protocol
Value:
Executable files
179
Suspicious files
62
Text files
311
Unknown types
0

Dropped files

PID
Process
Filename
Type
5632javaw.exeC:\Users\admin\AppData\Roaming\.clientlauncher\lib20\legal\jdk.internal.vm.ci\ADDITIONAL_LICENSE_INFOtext
MD5:512F151AF02B6BD258428B784B457531
SHA256:D255311B0A181E243DE326D111502A8B1DC7277B534A295A8340AB5230E74C83
5632javaw.exeC:\Users\admin\AppData\Roaming\.clientlauncher\lib20\bin\api-ms-win-crt-environment-l1-1-0.dllexecutable
MD5:40B6727C5C79A868C9A8CE707A2DB322
SHA256:167A2B52964458B16AAA166DE281E52C35DFE920380C9C7783A06678B665B2BA
5632javaw.exeC:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8061.timestamptext
MD5:B0817C40C583D66DEDE9E33D160D3949
SHA256:4E6DFC6611CD542C161223628579773575BD8FD59735363BDFC932F7BA73CE00
5632javaw.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\83aa4cc77f591dfc2374580bbd95f6ba_bb926e54-e3ca-40fd-ae90-2764341e7792binary
MD5:C8366AE350E7019AEFC9D1E6E6A498C6
SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
5632javaw.exeC:\Users\admin\AppData\Roaming\.clientlauncher\lib20\legal\jdk.accessibility\LICENSEtext
MD5:663F71C746CC2002AA53B066B06C88AB
SHA256:D60635C89C9F352AE1E66EF414344F290F5B5F7CE5C23D9633D41FDE0909DF80
5632javaw.exeC:\Users\admin\AppData\Roaming\.clientlauncher\lib20\legal\java.instrument\ASSEMBLY_EXCEPTIONtext
MD5:BD468DA51B15A9F09778545B00265F34
SHA256:7901499314E881A978D80A31970F0DAEC92D4995F3305E31FB53C38D9CC6EC3B
5632javaw.exeC:\Users\admin\AppData\Roaming\.clientlauncher\lib20\legal\jdk.internal.vm.compiler\ASSEMBLY_EXCEPTIONtext
MD5:BD468DA51B15A9F09778545B00265F34
SHA256:7901499314E881A978D80A31970F0DAEC92D4995F3305E31FB53C38D9CC6EC3B
5632javaw.exeC:\Users\admin\AppData\Roaming\.clientlauncher\lib20\bin\api-ms-win-core-file-l1-1-0.dllexecutable
MD5:FC67B593FEA9E5041A3EBBB1D63CC6E2
SHA256:02C96DDE747EA574FECFB93D43DD9829236A1B22F0EB5513C0E0B27B7BDAC934
5632javaw.exeC:\Users\admin\AppData\Roaming\.clientlauncher\lib20\legal\java.base\cldr.mdtext
MD5:8F5780E8D582FE686ED11535DEC512ED
SHA256:F2BD33DED550A05D59E8F659416EF382490504548D846E6388B1DFFD273AA077
5632javaw.exeC:\Users\admin\AppData\Roaming\.clientlauncher\lib20\legal\java.instrument\ADDITIONAL_LICENSE_INFOtext
MD5:512F151AF02B6BD258428B784B457531
SHA256:D255311B0A181E243DE326D111502A8B1DC7277B534A295A8340AB5230E74C83
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
56
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6588
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6564
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3148
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6012
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3656
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3008
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.209.32.198:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5052
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5368
SearchApp.exe
92.123.104.32:443
www.bing.com
Akamai International B.V.
DE
unknown
5272
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 40.127.240.158
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
google.com
  • 142.250.186.174
whitelisted
www.bing.com
  • 92.123.104.32
  • 92.123.104.33
  • 92.123.104.59
  • 92.123.104.52
  • 92.123.104.28
  • 92.123.104.62
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.76
  • 40.126.32.136
  • 40.126.32.138
  • 40.126.32.133
  • 40.126.32.74
  • 40.126.32.68
  • 20.190.160.14
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
api.haze.yt
  • 104.21.81.208
  • 172.67.191.18
unknown
go.microsoft.com
  • 23.35.238.131
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ClientLauncher.exe