https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa2NYTnB3enUxcWRYSkhJejI5TEFjMVJxSTN5d3xBQ3Jtc0ttT1U4UElRX3U4alNwUWE1X0dfbWt3X25QZmRuU19IWlg4Y2NVSjc5eHM3c1hxdFRiMTlFN3R2dXYtSkhJMnhLMEh2eV96OG9VTENfNFRySjhSYnh6V1Q2NzIwMWtJaHdjNERiY1hXNlE0c2RCektpSQ&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Flnfate2s02lfv%2F304sav&v=bqoBwZQe_KQ

MALICIOUS

SUSPICIOUS

• Starts CMD.EXE for commands execution

  • LauncherX.exe (PID: 4000)

• Node.exe was dropped

  • firefox.exe (PID: 6032)

• The process bypasses the loading of PowerShell profile settings

  • cmd.exe (PID: 8784)
  • cmd.exe (PID: 5324)

• Starts POWERSHELL.EXE for commands execution

  • cmd.exe (PID: 8784)
  • cmd.exe (PID: 5324)

INFO

• Application launched itself

  • firefox.exe (PID: 6972)
  • firefox.exe (PID: 6032)

• Reads product name

  • LauncherX.exe (PID: 4000)

• Checks if a key exists in the options dictionary (POWERSHELL)

  • powershell.exe (PID: 8712)

• Reads the software policy settings

  • slui.exe (PID: 8200)
  • slui.exe (PID: 7824)

• Reads Environment values

  • LauncherX.exe (PID: 4000)

• The sample compiled with english language support

  • firefox.exe (PID: 6032)

• Manual execution by a user

  • LauncherX.exe (PID: 4000)
  • WinRAR.exe (PID: 8648)

• Checks supported languages

  • LauncherX.exe (PID: 4000)

• Node.js compiler has been detected

  • LauncherX.exe (PID: 4000)

• Checks proxy server information

  • slui.exe (PID: 7824)