51a8d363bee48c41e89fc5ff6b9659d93d9521d94b824df9cf907588c2246f44

Analysis

max time kernel
73s
max time network
143s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/12/2022, 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Minecraft Launcher.exe
Size

4.4MB
MD5

62da1cde5869df964fc628ab9d226fb4
SHA1

6b4ebcd1685180d4e4477f5a7e9c36138e2e9aed
SHA256

51a8d363bee48c41e89fc5ff6b9659d93d9521d94b824df9cf907588c2246f44
SHA512

d29dc55c6ef957e624f445ca746db1e0bc4ba543df6e4aea4dc2f0ed8284bab80ff6268dc834722d695044cd1bb32cd6ca2086327aee22312b3d33bbd6b33d97
SSDEEP

98304:9Gz4kB1F8O+ZJpzMkqvc+tymgjSnm2Mwp3CTua:9YBcO+P2kqvchunHMwp3CTua

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "378966755"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb800000000020000000000106600000001000020000000afd05f450b9a962a3422cdede0a103ff102f63ac1c127d466996774c9bcc7517000000000e800000000200002000000069fd0ff4fc36bd3532ecd2b3393d0f8a0275cc76bebb27f0ed3f5086a61de933200000004b98c8f43d3b7a99e35cc0866605100cb97c2df308a1f1c0ad5954fff90395114000000099473069a3d2d0c9e1b7437712014ac52e08d37b2fbdcbc4fdfee355815d91644118c58f18908c9786e2592527c80d3d4900a4e72c4632b174854f81c03692dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3E23AE81-8668-11ED-8A0C-D60BF964997B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb8000000000200000000001066000000010000200000007ec92f03c7872cd0871931c4fb68e873e18d500b8c617fdd68f87fa95f7614d2000000000e80000000020000200000002b95a33f186032a88948c80be8b448f4d95c26ce478ad4a3154b024c4b3d89d8900000007520b88a1f7f5e7d5534038ed3819aeb52e2e62896d3e1db1f5b4c9e253b845fc96d0affd89b8086d7cca9b032d6bc77034231ef790cef6bb6b4929ecf9186156ca8ede49cef68dece03691ffc55df2e107993aef91ebd3598dd8636179ad63214945f607c906c802f7deb30e076c870f4349c02df32d1834d94aebcc029dcf1b21d09c1dbfd67dfbb41b2af75a3eac940000000cbb533c0f121c536963a6d3a4e4e280bba88572fceaaabcedc4bc72814613a7dec5f477151b687ba2cec8ee6607d8d40db7fc43992a7a253ae4f6357767424b7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00454718751ad901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1100	iexplore.exe
1100	iexplore.exe
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1100	1204	Minecraft Launcher.exe	28
PID 1204 wrote to memory of 1100	1204	Minecraft Launcher.exe	28
PID 1204 wrote to memory of 1100	1204	Minecraft Launcher.exe	28
PID 1204 wrote to memory of 1100	1204	Minecraft Launcher.exe	28
PID 1100 wrote to memory of 1404	1100	iexplore.exe	30
PID 1100 wrote to memory of 1404	1100	iexplore.exe	30
PID 1100 wrote to memory of 1404	1100	iexplore.exe	30
PID 1100 wrote to memory of 1404	1100	iexplore.exe	30
PID 1100 wrote to memory of 1404	1100	iexplore.exe	30
PID 1100 wrote to memory of 1404	1100	iexplore.exe	30
PID 1100 wrote to memory of 1404	1100	iexplore.exe	30

C:\Users\Admin\AppData\Local\Temp\Minecraft Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Minecraft Launcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://adoptium.net/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1100 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e35eb0d02084dfa56bd0cc6bc0faaeb

SHA1
ff60312fc4f25ec7cf3b4d4caa4d7c405f627ee8

SHA256
056d16f4533f2845ad893d7c5ca73dfba7d30f9262e844b367d0b52c34c37a91

SHA512
4290319705494989f792b4a85239d6d453b514d40e2014c81dce1535edcd7dfe175cfd227739f34fd1c46e9948415d77b0bc1a05abf9e883c14a0f9298ae71c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\mlf2v8h\imagestore.dat

Filesize
2KB

MD5
069e886e862a8e8898b2438e45311ea1

SHA1
40514b0396b38795ada3c80e088fc84029866e09

SHA256
5831711a6829d6cb0aed1e740a2f9045ab0d4f65f8b8a69e970c00880ddf2e4f

SHA512
17eb12b5f91ff0ec93b1d78ec5e155c4afa8c76bae29741a0aee99489ddd6683f234a3f7b2bce1734286d41d20b484dd56f7006ae7bdde4e23188b6294a32222

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4PS3XPDW.txt

Filesize
601B

MD5
76bdc0797bc2e473216a53cdd5856b3d

SHA1
c3d16c9a6b77a1d31caa30c6400b9bb0e04cba88

SHA256
a7639f8a598b0a0baf3762465cfb781322992344a39fa72e242e1a3ce6298a66

SHA512
dc12881a45951dc837da8b2b50a5ac4c9aeb1fbf02a403e1fc8f325ebeca88578e487bf9d7a0439386946e432a64702158fc20c5fa3a8af8e0ac5874e463dacc

Download Submit
memory/1204-54-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download