Analysis Overview
SHA256
122bfbb9f67e355340991deeacb167be9c12ad726b5a7c5779448dd0cc4af0cb
Threat Level: Shows suspicious behavior
The file LauncherFenix-Minecraft-v7.exe was found to be: Shows suspicious behavior.
Malicious Activity Summary
Drops desktop.ini file(s)
Drops file in Program Files directory
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-12-27 18:41
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-12-27 18:41
Reported
2022-12-27 18:44
Platform
win7-20220812-es
Max time kernel
142s
Max time network
154s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Java\jre7\bin\javaw.exe | N/A |
| N/A | N/A | C:\Program Files\Java\jre7\bin\javaw.exe | N/A |
| N/A | N/A | C:\Program Files\Java\jre7\bin\javaw.exe | N/A |
| N/A | N/A | C:\Program Files\Java\jre7\bin\javaw.exe | N/A |
| N/A | N/A | C:\Program Files\Java\jre7\bin\javaw.exe | N/A |
| N/A | N/A | C:\Program Files\Java\jre7\bin\javaw.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe
"C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe"
C:\Program Files\Java\jre7\bin\javaw.exe
"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef69e4f50,0x7fef69e4f60,0x7fef69e4f70
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1252 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1120 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1748 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2044 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2456 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2664 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2780 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3540 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3636 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3652 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3492 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3908 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3920 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3932 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3968 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4328 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4336 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4464 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4452 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4320 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4476 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4488 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4552 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2240 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2896 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=916 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=644 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1792 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5112 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1972 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1108,1690562448289211929,1094086049189186364,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
Network
| Country | Destination | Domain | Proto |
| N/A | 8.8.8.8:53 | www.dropbox.com | udp |
| N/A | 162.125.8.18:443 | www.dropbox.com | tcp |
| N/A | 162.125.8.18:443 | www.dropbox.com | tcp |
| N/A | 162.125.8.18:443 | www.dropbox.com | tcp |
| N/A | 8.8.8.8:53 | files.launcherfenix.com.ar | udp |
| N/A | 104.21.72.175:443 | files.launcherfenix.com.ar | tcp |
| N/A | 8.8.8.8:53 | launchermeta.mojang.com | udp |
| N/A | 13.107.237.67:443 | launchermeta.mojang.com | tcp |
| N/A | 8.8.8.8:53 | profile.launcherfenix.com.ar | udp |
| N/A | 104.21.72.175:80 | profile.launcherfenix.com.ar | tcp |
| N/A | 8.8.8.8:53 | iniciolauncherfx.tumblr.com | udp |
| N/A | 74.114.154.18:80 | iniciolauncherfx.tumblr.com | tcp |
| N/A | 74.114.154.18:443 | iniciolauncherfx.tumblr.com | tcp |
| N/A | 8.8.8.8:53 | assets.tumblr.com | udp |
| N/A | 8.8.8.8:53 | px.srvcs.tumblr.com | udp |
| N/A | 192.0.77.40:443 | px.srvcs.tumblr.com | tcp |
| N/A | 192.0.77.40:443 | px.srvcs.tumblr.com | tcp |
| N/A | 192.0.77.40:443 | px.srvcs.tumblr.com | tcp |
| N/A | 192.0.77.40:443 | px.srvcs.tumblr.com | tcp |
| N/A | 8.8.8.8:53 | static.tumblr.com | udp |
| N/A | 192.0.77.40:443 | static.tumblr.com | tcp |
| N/A | 104.21.72.175:80 | profile.launcherfenix.com.ar | tcp |
| N/A | 8.8.8.8:53 | clients2.google.com | udp |
| N/A | 8.8.8.8:53 | accounts.google.com | udp |
| N/A | 142.250.179.174:443 | clients2.google.com | tcp |
| N/A | 172.217.168.237:443 | accounts.google.com | tcp |
| N/A | 8.8.8.8:53 | dns.google | udp |
| N/A | 8.8.8.8:53 | dns.google | udp |
| N/A | 8.8.8.8:443 | dns.google | tcp |
| N/A | 8.8.8.8:443 | dns.google | tcp |
| N/A | 8.8.8.8:53 | edgedl.me.gvt1.com | udp |
| N/A | 34.104.35.123:80 | edgedl.me.gvt1.com | tcp |
| N/A | 8.8.8.8:443 | dns.google | udp |
| N/A | 142.250.179.131:443 | ssl.gstatic.com | tcp |
| N/A | 142.250.179.142:443 | apis.google.com | tcp |
| N/A | 142.251.39.110:443 | encrypted-tbn0.gstatic.com | tcp |
| N/A | 142.251.39.110:443 | tcp | |
| N/A | 142.251.39.110:443 | tcp | |
| N/A | 142.251.39.110:443 | tcp | |
| N/A | 142.251.39.110:443 | tcp | |
| N/A | 142.251.39.110:443 | udp | |
| N/A | 142.251.36.22:443 | tcp | |
| N/A | 142.251.36.22:443 | i.ytimg.com | tcp |
| N/A | 142.251.36.22:443 | tcp | |
| N/A | 142.251.36.22:443 | tcp | |
| N/A | 142.251.36.22:443 | tcp | |
| N/A | 142.250.179.142:443 | udp | |
| N/A | 142.251.39.106:443 | content-autofill.googleapis.com | tcp |
| N/A | 142.251.39.110:443 | play.google.com | tcp |
| N/A | 142.251.39.110:443 | udp | |
| N/A | 142.251.39.98:443 | googleads.g.doubleclick.net | tcp |
| N/A | 142.251.39.102:443 | static.doubleclick.net | tcp |
| N/A | 172.217.168.234:443 | udp | |
| N/A | 142.251.39.98:443 | udp | |
| N/A | 96.16.53.211:443 | java.com | tcp |
| N/A | 96.16.53.211:443 | tcp | |
| N/A | 23.2.175.165:443 | static.ocecdn.oraclecloud.com | tcp |
| N/A | 104.109.248.155:443 | tcp | |
| N/A | 23.0.84.121:443 | www.oracle.com | tcp |
| N/A | 23.0.84.121:443 | tcp | |
| N/A | 18.65.39.61:443 | consent.trustarc.com | tcp |
| N/A | 23.2.174.96:443 | c.oracleinfinity.io | tcp |
| N/A | 23.2.174.96:443 | tcp | |
| N/A | 23.0.84.121:443 | www.oracle.com | tcp |
| N/A | 138.1.45.89:443 | tcp | |
| N/A | 138.1.45.89:443 | tcp | |
| N/A | 138.1.45.89:443 | tcp | |
| N/A | 104.109.248.155:443 | tcp | |
| N/A | 18.65.39.61:443 | consent.trustarc.com | tcp |
| N/A | 15.236.176.210:443 | oracle.112.2o7.net | tcp |
| N/A | 96.16.53.134:443 | tcp | |
| N/A | 104.109.143.72:443 | tcp | |
| N/A | 104.109.143.72:443 | tcp | |
| N/A | 96.16.53.165:443 | tcp | |
| N/A | 96.16.53.138:80 | www.minecraft.net | tcp |
| N/A | 96.16.53.138:80 | tcp | |
| N/A | 96.16.53.138:443 | tcp | |
| N/A | 142.251.36.3:80 | clientservices.googleapis.com | tcp |
| N/A | 8.8.8.8:443 | dns.google | udp |
| N/A | 224.0.0.251:5353 | udp | |
| N/A | 96.16.53.138:443 | tcp | |
| N/A | 96.16.53.138:443 | tcp | |
| N/A | 96.16.53.138:443 | www.minecraft.net | tcp |
| N/A | 104.123.41.162:443 | tcp | |
| N/A | 18.65.39.103:443 | tcp | |
| N/A | 179.60.193.2:443 | tcp | |
| N/A | 142.250.179.131:443 | beacons.gcp.gvt2.com | tcp |
| N/A | 13.107.237.67:443 | launchermeta.mojang.com | tcp |
| N/A | 13.107.237.67:443 | launchermeta.mojang.com | tcp |
| N/A | 104.80.224.233:443 | assets.adobedtm.com | tcp |
| N/A | 13.107.237.67:443 | launchermeta.mojang.com | tcp |
| N/A | 34.250.29.197:443 | tcp | |
| N/A | 44.232.132.88:443 | tcp | |
| N/A | 34.248.130.67:443 | tcp | |
| N/A | 15.236.176.210:443 | msftenterprise.sc.omtrdc.net | tcp |
| N/A | 54.171.1.252:443 | tcp | |
| N/A | 185.29.134.244:443 | tcp | |
| N/A | 37.252.171.149:443 | tcp | |
| N/A | 35.190.60.146:443 | idsync.rlcdn.com | tcp |
| N/A | 20.120.124.64:443 | tcp | |
| N/A | 142.251.36.2:443 | cm.g.doubleclick.net | tcp |
| N/A | 142.251.36.2:443 | udp | |
| N/A | 151.101.2.49:443 | tcp | |
| N/A | 104.18.23.234:443 | tcp | |
| N/A | 104.244.42.67:443 | analytics.twitter.com | tcp |
| N/A | 20.120.124.64:443 | tcp | |
| N/A | 20.120.124.64:443 | tcp | |
| N/A | 20.120.124.64:443 | tcp | |
| N/A | 193.0.160.128:443 | tcp | |
| N/A | 52.223.40.198:443 | tcp |
Files
memory/1992-54-0x0000000075361000-0x0000000075363000-memory.dmp
memory/1340-55-0x0000000000000000-mapping.dmp
memory/1340-56-0x000007FEFBB11000-0x000007FEFBB13000-memory.dmp
memory/1340-68-0x0000000000170000-0x000000000017A000-memory.dmp
memory/1340-69-0x0000000000170000-0x000000000017A000-memory.dmp
memory/1340-67-0x0000000002330000-0x0000000005330000-memory.dmp
memory/1340-70-0x0000000001E30000-0x0000000001E3A000-memory.dmp
memory/1340-72-0x0000000002330000-0x0000000005330000-memory.dmp
memory/1340-73-0x0000000001E30000-0x0000000001E3A000-memory.dmp
\??\pipe\crashpad_1476_MXDIFWWTYEEHYZCW
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
Analysis: behavioral2
Detonation Overview
Submitted
2022-12-27 18:41
Reported
2022-12-27 18:44
Platform
win10v2004-20221111-es
Max time kernel
91s
Max time network
152s
Command Line
Signatures
Drops desktop.ini file(s)
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\Videos\Captures\desktop.ini | C:\Windows\system32\svchost.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe | N/A |
| File opened for modification | C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Windows\system32\svchost.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\system32\svchost.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4246620582-653642754-1174164128-1000\{F2768508-2E89-4E38-90FD-4C1454FE484F} | C:\Windows\system32\svchost.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe | N/A |
| N/A | N/A | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe | N/A |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 5000 wrote to memory of 4956 | N/A | C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe |
| PID 5000 wrote to memory of 4956 | N/A | C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe | C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe
"C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe"
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe"
C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
Network
| Country | Destination | Domain | Proto |
| N/A | 8.8.8.8:53 | www.dropbox.com | udp |
| N/A | 162.125.8.18:443 | www.dropbox.com | tcp |
| N/A | 8.238.110.126:80 | tcp | |
| N/A | 104.80.225.205:443 | tcp | |
| N/A | 52.182.143.208:443 | tcp | |
| N/A | 8.238.110.126:80 | tcp | |
| N/A | 8.238.110.126:80 | tcp | |
| N/A | 8.238.110.126:80 | tcp |
Files
memory/4956-132-0x0000000000000000-mapping.dmp
memory/4956-142-0x0000000002FF0000-0x0000000003FF0000-memory.dmp
memory/4956-155-0x0000000002FF0000-0x0000000003FF0000-memory.dmp
memory/4956-156-0x0000000002FF0000-0x0000000003FF0000-memory.dmp
memory/4956-157-0x0000000002FF0000-0x0000000003FF0000-memory.dmp
memory/4956-158-0x0000000002FF0000-0x0000000003FF0000-memory.dmp
memory/4956-159-0x0000000002FF0000-0x0000000003FF0000-memory.dmp
memory/4956-160-0x0000000002FF0000-0x0000000003FF0000-memory.dmp
memory/4956-162-0x0000000002FF0000-0x0000000003FF0000-memory.dmp
memory/4956-163-0x0000000002FF0000-0x0000000003FF0000-memory.dmp
memory/4956-165-0x0000000002FF0000-0x0000000003FF0000-memory.dmp
memory/4956-166-0x0000000002FF0000-0x0000000003FF0000-memory.dmp