download: | installer |
Full analysis: | https://app.any.run/tasks/4e8b7d22-3608-45b8-adc5-8d976d81fe54 |
Verdict: | Malicious activity |
Analysis date: | August 08, 2020, 18:09:16 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 77CF6ABDC003148F0661C8C37BAE62C2 |
SHA1: | 831EF726CA5AAF945CCEE509EEB6E5AFE0446059 |
SHA256: | ED0F21AA98BBE5058C8E2E1AF33A1BB0BCBED8DC404BEA9215EBBB7C2EDAF25F |
SSDEEP: | 393216:QXv7fsD441ffz4e4oQL14BIzAtdB7l9eN7r570hM:Q/7+1Hz4e4txzuB7l9o57eM |
.exe | | | Win32 Executable MS Visual C++ (generic) (42.8) |
---|---|---|
.exe | | | Win32 EXE Yoda's Crypter (36.4) |
.dll | | | Win32 Dynamic Link Library (generic) (9) |
.exe | | | Win32 Executable (generic) (6.1) |
.exe | | | Generic Win/DOS Executable (2.7) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2019:01:03 20:13:08+01:00 |
PEType: | PE32 |
LinkerVersion: | 10 |
CodeSize: | 23552 |
InitializedDataSize: | 142336 |
UninitializedDataSize: | - |
EntryPoint: | 0x2ce1 |
OSVersion: | 5.1 |
ImageVersion: | - |
SubsystemVersion: | 5.1 |
Subsystem: | Windows GUI |
FileVersionNumber: | 0.5.2.0 |
ProductVersionNumber: | 2.72.0.0 |
FileFlagsMask: | 0x0000 |
FileFlags: | (none) |
FileOS: | Win32 |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | English (U.S.) |
CharacterSet: | ASCII |
Comments: | TLauncher Setup |
CompanyName: | TLauncher Inc. |
FileDescription: | TLauncher Setup |
FileVersion: | 0.5.2.0 |
InternalName: | TLauncher |
LegalCopyright: | TLauncher Copyright © 2020 |
LegalTrademarks: | TLauncher |
OriginalFileName: | suf_launch.exe |
ProductName: | TLauncher |
ProductVersion: | 2.72.0.0 |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 03-Jan-2019 19:13:08 |
Detected languages: |
|
Comments: | TLauncher Setup |
CompanyName: | TLauncher Inc. |
FileDescription: | TLauncher Setup |
FileVersion: | 0.5.2.0 |
InternalName: | TLauncher |
LegalCopyright: | TLauncher Copyright © 2020 |
LegalTrademarks: | TLauncher |
OriginalFilename: | suf_launch.exe |
ProductName: | TLauncher |
ProductVersion: | 2.72.0.0 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000D8 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 03-Jan-2019 19:13:08 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00005A18 | 0x00005C00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.40733 |
.rdata | 0x00007000 | 0x00002F54 | 0x00003000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.05968 |
.data | 0x0000A000 | 0x00001968 | 0x00000C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.59807 |
.rsrc | 0x0000C000 | 0x0001DDCC | 0x0001DE00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.50313 |
.reloc | 0x0002A000 | 0x000010D0 | 0x00001200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 3.81847 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.37674 | 1413 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 4.87454 | 67624 | Latin 1 / Western European | English - United States | RT_ICON |
3 | 5.04321 | 16936 | Latin 1 / Western European | English - United States | RT_ICON |
4 | 5.10433 | 9640 | Latin 1 / Western European | English - United States | RT_ICON |
5 | 5.15069 | 6760 | Latin 1 / Western European | English - United States | RT_ICON |
6 | 5.24063 | 4264 | Latin 1 / Western European | English - United States | RT_ICON |
7 | 5.45174 | 2440 | Latin 1 / Western European | English - United States | RT_ICON |
8 | 5.39733 | 1720 | Latin 1 / Western European | English - United States | RT_ICON |
9 | 5.52276 | 1128 | Latin 1 / Western European | English - United States | RT_ICON |
101 | 2.9892 | 132 | Latin 1 / Western European | English - United States | RT_GROUP_ICON |
ADVAPI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3108 | "C:\Users\admin\AppData\Local\Temp\installer.exe" | C:\Users\admin\AppData\Local\Temp\installer.exe | explorer.exe | ||||||||||||
User: admin Company: TLauncher Inc. Integrity Level: MEDIUM Description: TLauncher Setup Exit code: 0 Version: 0.5.2.0 Modules
| |||||||||||||||
2236 | "C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1905626 "__IRAFN:C:\Users\admin\AppData\Local\Temp\installer.exe" "__IRCT:1" "__IRTSS:16717045" "__IRSID:S-1-5-21-1302019708-1500728564-335382590-1000" | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | installer.exe | ||||||||||||
User: admin Company: Indigo Rose Corporation Integrity Level: MEDIUM Description: Setup Application Exit code: 0 Version: 9.5.3.0 Modules
| |||||||||||||||
284 | "C:\Users\admin\AppData\Roaming\.minecraft\TLauncher.exe" | C:\Users\admin\AppData\Roaming\.minecraft\TLauncher.exe | — | irsetup.exe | |||||||||||
User: admin Company: TLauncher Inc. Integrity Level: MEDIUM Description: TLauncher Exit code: 0 Version: 2.72 Modules
| |||||||||||||||
3092 | "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Roaming\.minecraft\TLauncher.exe" | C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe | — | TLauncher.exe | |||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.920.14 Modules
| |||||||||||||||
3812 | cmd.exe /C chcp 437 & wmic os get osarchitecture | C:\Windows\system32\cmd.exe | — | javaw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2304 | chcp 437 | C:\Windows\system32\chcp.com | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Change CodePage Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2688 | wmic os get osarchitecture | C:\Windows\System32\Wbem\WMIC.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: WMI Commandline Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2412 | cmd.exe /C chcp 437 & wmic os get osarchitecture | C:\Windows\system32\cmd.exe | — | javaw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3004 | chcp 437 | C:\Windows\system32\chcp.com | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Change CodePage Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3896 | wmic os get osarchitecture | C:\Windows\System32\Wbem\WMIC.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: WMI Commandline Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (3108) installer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (3108) installer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (2236) irsetup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (2236) irsetup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (2236) irsetup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (2236) irsetup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (2236) irsetup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (3092) javaw.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
Operation: | write | Name: | Name |
Value: javaw.exe | |||
(PID) Process: | (1408) javaw.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (1408) javaw.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E |
Operation: | write | Name: | @C:\Windows\system32\NetworkExplorer.dll,-1 |
Value: Network |
PID | Process | Filename | Type | |
---|---|---|---|---|
2236 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat | — | |
MD5:— | SHA256:— | |||
2236 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG11.PNG | image | |
MD5:4F7EE9256A02B1E219492BDF68DB9C67 | SHA256:A58F4BBC25BC0F7B10EE3201BFBB92CD6DFD27AD56F47B7F67AA8D4D3DAF12DF | |||
2236 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG15.PNG | image | |
MD5:41BD19D49E2B1CA67523A06F565A4115 | SHA256:5F5CEBDAEB6911715E84293322281D4D1B400DB94F5F047C238E66B2312BA05B | |||
2236 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG13.PNG | image | |
MD5:F1771D73AA12CF53B81E3F34A675D7A8 | SHA256:CDFD216B94C379770895F672AD5D1CCA6888C91CE43E53E90BAB9C4CA613C6A9 | |||
2236 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG17.PNG | image | |
MD5:867D39D8C43F6EDCDB19866EC05EC5FA | SHA256:DBDA640FDF9C9F5ABF97CD8AC33C11317E72448BFD79CDE124D877B0C34F7DA0 | |||
2236 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG7.PNG | image | |
MD5:FD28B41B8EA3346CAEB710F2ADFD26E7 | SHA256:77339AB9A173A7FACEBF79B463A0D437B845CE23B48E4C57A6A789BF31299975 | |||
2236 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG9.PNG | image | |
MD5:62E477DF8684D4490120631B88EF2EBF | SHA256:93BFA9659F810D8107BA037E0928A394B7AC329EFFCF3DBED506AD438395F812 | |||
2236 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.PNG | image | |
MD5:EC93F9A633247C6215C9FC963E7486D0 | SHA256:B5D54A1FC972EA2994966EBAAE0E29B5CFD0543925ECC64408B64B6D5B403B93 | |||
2236 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG5.PNG | image | |
MD5:7642C1C65BA6155747E0756DD2BC559D | SHA256:BCD86C813D76EB8574C61C851FC4F42B14D8E5E359E3933BC02BEB189322F1B3 | |||
2236 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG4.PNG | image | |
MD5:A43B5F20155DE26B8F1F4446E662D777 | SHA256:6C03B65249B72F50F7B2A54C7A1B30CDD954474CB540BE39289D673BA693D787 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1408 | javaw.exe | HEAD | 200 | 104.20.86.142:80 | http://page.tlauncher.org/ | US | — | — | malicious |
1408 | javaw.exe | GET | 200 | 104.20.87.142:80 | http://img.tlauncher.org/update/downloads/configs/client/style_new_bes_fontov.css | US | text | 5.76 Kb | malicious |
1408 | javaw.exe | GET | 200 | 104.20.87.142:80 | http://img.tlauncher.org/update/downloads/configs/client/images/icons/btn1.png | US | image | 160 b | malicious |
1408 | javaw.exe | GET | 200 | 104.20.87.142:80 | http://repo.tlauncher.org/update/downloads/configs/inner_servers.json | US | text | 3.45 Kb | whitelisted |
1408 | javaw.exe | HEAD | 200 | 104.20.86.142:80 | http://page.tlauncher.org/ | US | — | — | malicious |
1408 | javaw.exe | GET | 200 | 104.20.87.142:80 | http://repo.tlauncher.org/update/lch/update_2.0.json?version=2.72&client=b3418579-d303-473b-98ea-ffcf038156f6 | US | text | 7.66 Kb | whitelisted |
1408 | javaw.exe | GET | 200 | 104.20.87.142:80 | http://repo.tlauncher.org/update/downloads/libraries/org/tlauncher/authlib/libraries-1.6.json | US | text | 100 Kb | whitelisted |
1408 | javaw.exe | GET | 200 | 104.20.86.142:80 | http://page.tlauncher.org/update/downloads/configs/client/eng.html | US | html | 16.0 Kb | malicious |
1408 | javaw.exe | GET | 200 | 104.20.87.142:80 | http://repo.tlauncher.org/update/downloads/versions/new3/skin/versions/version_manifest.json | US | text | 5.38 Kb | whitelisted |
1408 | javaw.exe | GET | 200 | 104.20.87.142:80 | http://img.tlauncher.org/update/downloads/configs/client/images/icons/btn4.png | US | image | 205 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1408 | javaw.exe | 116.202.49.76:443 | mps.tlrepo.com | 334,Udyog Vihar | IN | unknown |
1408 | javaw.exe | 104.16.133.229:443 | ajax.cloudflare.com | Cloudflare Inc | US | suspicious |
1408 | javaw.exe | 104.20.86.142:80 | page.tlauncher.org | Cloudflare Inc | US | shared |
1408 | javaw.exe | 104.20.87.142:443 | page.tlauncher.org | Cloudflare Inc | US | shared |
1408 | javaw.exe | 176.9.83.82:443 | stat.tlrepo.com | Hetzner Online GmbH | DE | suspicious |
1408 | javaw.exe | 104.20.87.142:80 | page.tlauncher.org | Cloudflare Inc | US | shared |
1408 | javaw.exe | 176.9.83.82:8092 | stat.tlrepo.com | Hetzner Online GmbH | DE | suspicious |
1408 | javaw.exe | 99.86.2.139:443 | launchermeta.mojang.com | AT&T Services, Inc. | US | unknown |
1408 | javaw.exe | 104.20.86.142:443 | page.tlauncher.org | Cloudflare Inc | US | shared |
1408 | javaw.exe | 143.204.201.31:80 | resources.download.minecraft.net | — | US | malicious |
Domain | IP | Reputation |
---|---|---|
page.tlauncher.org |
| malicious |
repo.tlauncher.org |
| whitelisted |
img.tlauncher.org |
| malicious |
ajax.cloudflare.com |
| whitelisted |
launchermeta.mojang.com |
| whitelisted |
mps.tlrepo.com |
| unknown |
stat.tlrepo.com |
| suspicious |
tlauncher.org |
| malicious |
dl2.tlrepo.com |
| suspicious |
res.tlauncher.org |
| whitelisted |