3d4bbf552902aaf1308c7a3f854e37958cd2634f6c310d3e8e7e93fb980c37f5

General

Target

3d4bbf552902aaf1308c7a3f854e37958cd2634f6c310d3e8e7e93fb980c37f5.exe
Size

7.7MB
MD5

05f15c198bbf2f847eb4700ebf832da7
SHA1

15a3676916039d810c7471a253850e4d52b891d2
SHA256

3d4bbf552902aaf1308c7a3f854e37958cd2634f6c310d3e8e7e93fb980c37f5
SHA512

7485a0173129309630d706bf289f3b3292e2725b44a5e52eacbbf6614f82460663d98d42cab5fba27613faa4132d1f3f689313a40a90ec499f8078a08322af3e
SSDEEP

196608:2cCuika88MiXKKP1YMjDo89ub0bVJ41aVPzXEx2QU98znTVn:o5DXUkX4nTt

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

MinecraftLauncherRelease.exe

pid process

1516 MinecraftLauncherRelease.exe

pid	process
1516	MinecraftLauncherRelease.exe

Loads dropped DLL 3 IoCs

Processes:

3d4bbf552902aaf1308c7a3f854e37958cd2634f6c310d3e8e7e93fb980c37f5.exe

pid	process
840	3d4bbf552902aaf1308c7a3f854e37958cd2634f6c310d3e8e7e93fb980c37f5.exe
840	3d4bbf552902aaf1308c7a3f854e37958cd2634f6c310d3e8e7e93fb980c37f5.exe
840	3d4bbf552902aaf1308c7a3f854e37958cd2634f6c310d3e8e7e93fb980c37f5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

MinecraftLauncherRelease.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	MinecraftLauncherRelease.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

MinecraftLauncherRelease.exe

pid process

1516 MinecraftLauncherRelease.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

3d4bbf552902aaf1308c7a3f854e37958cd2634f6c310d3e8e7e93fb980c37f5.exeMinecraftLauncherRelease.exe

pid process

840 3d4bbf552902aaf1308c7a3f854e37958cd2634f6c310d3e8e7e93fb980c37f5.exe
1516 MinecraftLauncherRelease.exe
1516 MinecraftLauncherRelease.exe

pid	process
1516	MinecraftLauncherRelease.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

3d4bbf552902aaf1308c7a3f854e37958cd2634f6c310d3e8e7e93fb980c37f5.exe

description	pid	process	target process
PID 840 wrote to memory of 1516	840	3d4bbf552902aaf1308c7a3f854e37958cd2634f6c310d3e8e7e93fb980c37f5.exe	MinecraftLauncherRelease.exe
PID 840 wrote to memory of 1516	840	3d4bbf552902aaf1308c7a3f854e37958cd2634f6c310d3e8e7e93fb980c37f5.exe	MinecraftLauncherRelease.exe
PID 840 wrote to memory of 1516	840	3d4bbf552902aaf1308c7a3f854e37958cd2634f6c310d3e8e7e93fb980c37f5.exe	MinecraftLauncherRelease.exe
PID 840 wrote to memory of 1516	840	3d4bbf552902aaf1308c7a3f854e37958cd2634f6c310d3e8e7e93fb980c37f5.exe	MinecraftLauncherRelease.exe
PID 840 wrote to memory of 1516	840	3d4bbf552902aaf1308c7a3f854e37958cd2634f6c310d3e8e7e93fb980c37f5.exe	MinecraftLauncherRelease.exe
PID 840 wrote to memory of 1516	840	3d4bbf552902aaf1308c7a3f854e37958cd2634f6c310d3e8e7e93fb980c37f5.exe	MinecraftLauncherRelease.exe
PID 840 wrote to memory of 1516	840	3d4bbf552902aaf1308c7a3f854e37958cd2634f6c310d3e8e7e93fb980c37f5.exe	MinecraftLauncherRelease.exe

C:\Users\Admin\AppData\Local\Temp\3d4bbf552902aaf1308c7a3f854e37958cd2634f6c310d3e8e7e93fb980c37f5.exe
"C:\Users\Admin\AppData\Local\Temp\3d4bbf552902aaf1308c7a3f854e37958cd2634f6c310d3e8e7e93fb980c37f5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840

C:\Users\Admin\AppData\Local\Temp\00069ECF\MinecraftLauncherRelease.exe
"C:\Users\Admin\AppData\Local\Temp\00069ECF\MinecraftLauncherRelease.exe"
2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\00069ECF\MinecraftLauncherRelease.exe

Filesize
3.2MB

MD5
2214214113319fcbf3d542f3511f4be3

SHA1
f3d9f1d0b5b9f6757985d044afa4ea01da8884f2

SHA256
207985303763f6ad4b6afd994e2d21808f09611fd9abad7c417829a9bb4c55a1

SHA512
b08709de37e683516df746d183a55a0a3f7dac704494c0a1f920fde3e81450ffd66e9f800fc9c704cce0686086694695ae5a5b22cc424461b79cb006073b75bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\00069ECF\MinecraftLauncherRelease.exe

Filesize
3.2MB

MD5
2214214113319fcbf3d542f3511f4be3

SHA1
f3d9f1d0b5b9f6757985d044afa4ea01da8884f2

SHA256
207985303763f6ad4b6afd994e2d21808f09611fd9abad7c417829a9bb4c55a1

SHA512
b08709de37e683516df746d183a55a0a3f7dac704494c0a1f920fde3e81450ffd66e9f800fc9c704cce0686086694695ae5a5b22cc424461b79cb006073b75bb

Download Submit
\Users\Admin\AppData\Local\Temp\00069ECF\MinecraftLauncherRelease.exe

Filesize
3.2MB

MD5
2214214113319fcbf3d542f3511f4be3

SHA1
f3d9f1d0b5b9f6757985d044afa4ea01da8884f2

SHA256
207985303763f6ad4b6afd994e2d21808f09611fd9abad7c417829a9bb4c55a1

SHA512
b08709de37e683516df746d183a55a0a3f7dac704494c0a1f920fde3e81450ffd66e9f800fc9c704cce0686086694695ae5a5b22cc424461b79cb006073b75bb

Download Submit
\Users\Admin\AppData\Local\Temp\00069ECF\MinecraftLauncherRelease.exe

Filesize
3.2MB

MD5
2214214113319fcbf3d542f3511f4be3

SHA1
f3d9f1d0b5b9f6757985d044afa4ea01da8884f2

SHA256
207985303763f6ad4b6afd994e2d21808f09611fd9abad7c417829a9bb4c55a1

SHA512
b08709de37e683516df746d183a55a0a3f7dac704494c0a1f920fde3e81450ffd66e9f800fc9c704cce0686086694695ae5a5b22cc424461b79cb006073b75bb

Download Submit
\Users\Admin\AppData\Local\Temp\00069ECF\MinecraftLauncherRelease.exe

Filesize
3.2MB

MD5
2214214113319fcbf3d542f3511f4be3

SHA1
f3d9f1d0b5b9f6757985d044afa4ea01da8884f2

SHA256
207985303763f6ad4b6afd994e2d21808f09611fd9abad7c417829a9bb4c55a1

SHA512
b08709de37e683516df746d183a55a0a3f7dac704494c0a1f920fde3e81450ffd66e9f800fc9c704cce0686086694695ae5a5b22cc424461b79cb006073b75bb

Download Submit
memory/840-54-0x00000000754C1000-0x00000000754C3000-memory.dmp

Filesize
8KB

Download
memory/1516-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads