Overview

overview

8

Static

static

MinecraftI...er.exe

windows7-x64

3

MinecraftI...er.exe

windows10-2004-x64

8

Resubmissions

18/06/2024, 07:57

240618-jtd71sthkb 1

01/06/2024, 14:06

240601-rehwnaec6y 1

29/12/2022, 21:46

221229-1mryzaec36 8

Analysis

  • max time kernel
    267s
  • max time network
    270s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2022, 21:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MinecraftInstaller.exe

  • Size

    31.8MB

  • MD5

    24c96f96660bcedbf8648c8e43c3630c

  • SHA1

    127dbeec1e9a7b8db42704172ba9e9bae0269754

  • SHA256

    2b0e05e169643319074f306153e55f2d839adb0378d6e721c04198233b892bfa

  • SHA512

    ed01d726284b92f0c594db2b4644903109c1f7ec650b6572207d1f1d8fe26e97dd3d89df6296b625023f0c63148b5ae543db21573c60aa487c57414219e3916c

  • SSDEEP

    393216:Ubekuyo9nMK50UGRXLePuq2ZWy/c5zFviMKe2OHmwv9CsTmsueFFza9yt:vZn/G4Gqk1cWe2iTVCMue3T

Score
8/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Registers COM server for autorun 1 TTPs 6 IoCs
    persistence
  • Loads dropped DLL 3 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 21 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4572
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    PID:1348
    • C:\Windows\system32\svchost.exe
      "svchost.exe"
      2⤵
        PID:4608
    • C:\Program Files\WindowsApps\Microsoft.GamingServices_8.71.12001.0_x64__8wekyb3d8bbwe\GamingServices.exe
      "C:\Program Files\WindowsApps\Microsoft.GamingServices_8.71.12001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
      1⤵
      • Registers COM server for autorun
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1912
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /i "C:\Program Files\WindowsApps\Microsoft.GamingServices_8.71.12001.0_x64__8wekyb3d8bbwe\gameinputredist.msi" /quiet /l*v "C:\Windows\TEMP\gameinputredist.log"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4376
    • C:\Program Files\WindowsApps\Microsoft.GamingServices_8.71.12001.0_x64__8wekyb3d8bbwe\GamingServicesNet.exe
      "C:\Program Files\WindowsApps\Microsoft.GamingServices_8.71.12001.0_x64__8wekyb3d8bbwe\GamingServicesNet.exe"
      1⤵
        PID:1960
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1856
      • C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe
        "C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe"
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1588
        • C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe
          "C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe" Global\GameInputSession_1
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:212
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
        1⤵
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of WriteProcessMemory
        PID:2932
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Windows\TEMP\{c933e723-3f6d-2644-822e-1e9d30e8b7cc}\xvdd.inf" "9" "4ecdd1eeb" "0000000000000148" "Service-0x0-3e7$\Default" "0000000000000164" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_8.71.12001.0_x64__8wekyb3d8bbwe\drivers"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:4152
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "1" "0" "SWD\XvddEnum\XvddRootDevice_Instance" "" "" "48fe919b3" "0000000000000000"
          2⤵
          • Drops file in Windows directory
          PID:4516
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Windows\TEMP\{fd8adb4e-7b5f-2b49-8727-f70d353c189a}\gameflt.inf" "9" "41bf4167f" "0000000000000164" "Service-0x0-3e7$\Default" "0000000000000160" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_8.71.12001.0_x64__8wekyb3d8bbwe\drivers"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:4636
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_6284700d01a44dd9\gameflt.inf" "0" "41bf4167f" "0000000000000178" "Service-0x0-3e7$\Default"
          2⤵
          • Drops file in Windows directory
          PID:2524
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_6284700d01a44dd9\gameflt.inf" "0" "4e7d9c3d3" "0000000000000164" "Service-0x0-3e7$\Default"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:3116

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft GameInput\x64\GameInputRedist.dll
        Filesize

        309KB

        MD5

        4e24767339e4fba8a58743bebed614fe

        SHA1

        f7c509725564e7d1cf4aaccfa6d902b2baec6b3e

        SHA256

        6bb2493a395eebb9ba027202c76257ca0690788849ae48aba7f3c4d6920510b6

        SHA512

        0cfcd3be6ff7ff453759b599666a1f91c45c02a4db2b5c51654edbcaaaaff31dcb030a7456789703762482b2f5168a9b22030462addfecfc845d8b628739c2ba

        Download Submit

      • C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe
        Filesize

        89KB

        MD5

        a7fc52c5d696905d21add3993f65c167

        SHA1

        0fcab224024b27a30674e37356819dc5b6eb257d

        SHA256

        d700523c0803c3224761307ffbc26b8d7e77d6bd58a19647fcae76f2d62f71cb

        SHA512

        288d2f7495dcb6c994db96df17c565b75fbb506439eac9e71b0a45e93e9be05a2d2d76a2a95b84658a31db32321c651a33be70f4e8ca17c0ceecf220692a61a8

        Download Submit

      • C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe
        Filesize

        89KB

        MD5

        a7fc52c5d696905d21add3993f65c167

        SHA1

        0fcab224024b27a30674e37356819dc5b6eb257d

        SHA256

        d700523c0803c3224761307ffbc26b8d7e77d6bd58a19647fcae76f2d62f71cb

        SHA512

        288d2f7495dcb6c994db96df17c565b75fbb506439eac9e71b0a45e93e9be05a2d2d76a2a95b84658a31db32321c651a33be70f4e8ca17c0ceecf220692a61a8

        Download Submit

      • C:\Program Files (x86)\Microsoft GameInput\x86\GameInputRedist.dll
        Filesize

        194KB

        MD5

        0f2dce8e055ddfbc411d61d8be0865aa

        SHA1

        83b5d12b40dc5773f37188ad2f789f38c81e7a27

        SHA256

        624a69ec4e26ef82ee5812c3322af03f2bb9aa03c31c38a19fea89e6c46399a6

        SHA512

        2c2ec83d46d6372400f37b75b79e57af2cca1d46469f925d3dc5ad20284c9c2c1d2f9f6befcd3e1e3f59536c81205da6df61585a3da4cf4bfb9339364c62e527

        Download Submit

      • C:\Windows\SYSTEM32\gameplatformservices.dll
        Filesize

        449KB

        MD5

        9f20e413755a01138104efd82d8f625b

        SHA1

        46d76e8df934ea76ea26b1492e26f72d72145086

        SHA256

        6edef18b5066d5e2105119e9ec764ce273ab3397d0cc61b9d4574b0ee9af7af3

        SHA512

        4b2f496b3f29dbb6d106efc23a14c4d1cb543690eb19e09d8fb33f20505af229992e5afb149af053edff4023e9b097ef98734be9ab70e5e12a52259e3673f686

        Download Submit

      • C:\Windows\System32\CatRoot2\dberr.txt
        Filesize

        2KB

        MD5

        48da913a87044ed6e4774582c40b3040

        SHA1

        7ca19dea0e3b9b51c72def364a089ec70207c523

        SHA256

        98402158b572a7a284198e35b648d0fbb062c94086c5b42f63111c80320a33b7

        SHA512

        d93369c6b236accd868c364e2e2e3a83617e7828b39912e55767a6361aa7ccda06406fc4b8832649819ebc0ec4786925a48c82e7a9f23134ca8f8c23fc67dc82

        Download Submit

      • C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_6284700d01a44dd9\gameflt.cat
        Filesize

        11KB

        MD5

        97bae2895240df0703cd2b4c4b26369a

        SHA1

        cd864ce39287dbd3cf05ddbe1979872410e02e24

        SHA256

        d163d13b6d29227eb275f39fcd84a594b5476371c4953358c943b7858501ea82

        SHA512

        e731eeb561bdfe87ca16c468481dbeb0efd893e6fade3e8932b51d59743e739e7262bed12c4a8446fe46efbf80989adab4913b99093437160b617017a101d196

        Download Submit

      • C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_6284700d01a44dd9\gameflt.inf
        Filesize

        2KB

        MD5

        838b501597050731b5898710a2389c17

        SHA1

        a4729ebdbb824ff91fc21dccc2bae7459f5353fb

        SHA256

        8fdc80cf6bce891ed4a2dfcbb049083f352c54ae75ed039a8cee9373192dfa16

        SHA512

        3a689d850e194757c46838ac38c52ad34e85f515a925cb35a8935d86467f33e53454ac705f7fef7f9aa72907511f6ef384c143d3836acaa49d94a240d169882f

        Download Submit

      • C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_6284700d01a44dd9\gameflt.sys
        Filesize

        147KB

        MD5

        44559b9f38c85b0f33725978a3bfda69

        SHA1

        6e6d84ad324bb93e5d22240e2caedc8a26c8e9be

        SHA256

        01d0afd8345be9d32ca33c8b77a0ac2e9c5e460b8b787e3fbd5c83d0e97b39e2

        SHA512

        12bd911564f5535bf9c17e0be4980922356071b5c7d61682e48f368beff755350bdfad3fbe5e69905b9355bfa339b98b36fb9db2a5a4229f99bd17c108bf98e7

        Download Submit

      • C:\Windows\System32\DriverStore\FileRepository\xvdd.inf_amd64_eae73d4477526335\xvdd.inf
        Filesize

        1KB

        MD5

        a8fb1dc60adc6780fc29477b381c18df

        SHA1

        8e4318fb70cd6f2d1dc762204d699632924b3b4f

        SHA256

        80ec0504e48def867cdbb27d4d74c17767281c3baf21677f4ba154c1c147025e

        SHA512

        21d95d28a3f73e14c95aa194a07f9bb361865022b679ec53c82245b4e889368f88a4c9eb3de7d729d96b5378ed28934b374e58bdd796d4dbd4098103f558b307

        Download Submit

      • C:\Windows\System32\GameInputRedist.dll
        Filesize

        309KB

        MD5

        4e24767339e4fba8a58743bebed614fe

        SHA1

        f7c509725564e7d1cf4aaccfa6d902b2baec6b3e

        SHA256

        6bb2493a395eebb9ba027202c76257ca0690788849ae48aba7f3c4d6920510b6

        SHA512

        0cfcd3be6ff7ff453759b599666a1f91c45c02a4db2b5c51654edbcaaaaff31dcb030a7456789703762482b2f5168a9b22030462addfecfc845d8b628739c2ba

        Download Submit

      • C:\Windows\System32\GameInputRedist.dll
        Filesize

        309KB

        MD5

        4e24767339e4fba8a58743bebed614fe

        SHA1

        f7c509725564e7d1cf4aaccfa6d902b2baec6b3e

        SHA256

        6bb2493a395eebb9ba027202c76257ca0690788849ae48aba7f3c4d6920510b6

        SHA512

        0cfcd3be6ff7ff453759b599666a1f91c45c02a4db2b5c51654edbcaaaaff31dcb030a7456789703762482b2f5168a9b22030462addfecfc845d8b628739c2ba

        Download Submit

      • C:\Windows\System32\gameplatformservices.dll
        Filesize

        449KB

        MD5

        9f20e413755a01138104efd82d8f625b

        SHA1

        46d76e8df934ea76ea26b1492e26f72d72145086

        SHA256

        6edef18b5066d5e2105119e9ec764ce273ab3397d0cc61b9d4574b0ee9af7af3

        SHA512

        4b2f496b3f29dbb6d106efc23a14c4d1cb543690eb19e09d8fb33f20505af229992e5afb149af053edff4023e9b097ef98734be9ab70e5e12a52259e3673f686

        Download Submit

      • C:\Windows\TEMP\gameinputredist.log
        Filesize

        1KB

        MD5

        a2d37173f18fb0bcc843fd5c708c3007

        SHA1

        15224bbc9050551aae1c0e0870c1369dab6cadb2

        SHA256

        ad8041cffc3d243aa59f37b617808d64699bb74b5be34c62f6c7ae6b44616429

        SHA512

        5104c5e75e61402d452e4aac5b51550206031cbe9118bbf4aaf7e8d86b9477a7a239bc456caba516081cf74ca291a0700223b5f3d5865d7e775fcf89b223c114

        Download Submit

      • C:\Windows\TEMP\{C933E~1\xvdd.cat
        Filesize

        11KB

        MD5

        a9445e4d7e7a561b252aad7a1bed1e5f

        SHA1

        2171d312cef14843249bf197d5a9db6727f7a581

        SHA256

        3d46434d8a331a9f97b4b68449f520945ba325272e14b0944a5890297536a7b4

        SHA512

        409c2ac68b1cc5511132ccdee160dbe6deed167fe805563b52f7f490117da4e5bfabc9e9977f12cdbab960d4353456e4114cef433529d9d36f20b981841136b7

        Download Submit

      • C:\Windows\TEMP\{C933E~1\xvdd.sys
        Filesize

        659KB

        MD5

        a97cc88ebaf58378f16971e6875fe5a1

        SHA1

        4238e160cfe1cb554951fc49fac7ad0eb88cf944

        SHA256

        f5cec1a2c850b03f6c5b30c9f5253a2ed0d05318690b9a35f4bf50f0c198d6f9

        SHA512

        6031bfd32631d69eca431f4af28e1d76c2f3c90e3e621fc1c5ec69a3e13610aca6ea136ff673fd10fa121b3bb051d53e66d5087a06a77624e89c73d97167053d

        Download Submit

      • C:\Windows\TEMP\{FD8AD~1\gameflt.cat
        Filesize

        11KB

        MD5

        97bae2895240df0703cd2b4c4b26369a

        SHA1

        cd864ce39287dbd3cf05ddbe1979872410e02e24

        SHA256

        d163d13b6d29227eb275f39fcd84a594b5476371c4953358c943b7858501ea82

        SHA512

        e731eeb561bdfe87ca16c468481dbeb0efd893e6fade3e8932b51d59743e739e7262bed12c4a8446fe46efbf80989adab4913b99093437160b617017a101d196

        Download Submit

      • C:\Windows\TEMP\{FD8AD~1\gameflt.sys
        Filesize

        147KB

        MD5

        44559b9f38c85b0f33725978a3bfda69

        SHA1

        6e6d84ad324bb93e5d22240e2caedc8a26c8e9be

        SHA256

        01d0afd8345be9d32ca33c8b77a0ac2e9c5e460b8b787e3fbd5c83d0e97b39e2

        SHA512

        12bd911564f5535bf9c17e0be4980922356071b5c7d61682e48f368beff755350bdfad3fbe5e69905b9355bfa339b98b36fb9db2a5a4229f99bd17c108bf98e7

        Download Submit

      • C:\Windows\TEMP\{c933e723-3f6d-2644-822e-1e9d30e8b7cc}\xvdd.inf
        Filesize

        1KB

        MD5

        a8fb1dc60adc6780fc29477b381c18df

        SHA1

        8e4318fb70cd6f2d1dc762204d699632924b3b4f

        SHA256

        80ec0504e48def867cdbb27d4d74c17767281c3baf21677f4ba154c1c147025e

        SHA512

        21d95d28a3f73e14c95aa194a07f9bb361865022b679ec53c82245b4e889368f88a4c9eb3de7d729d96b5378ed28934b374e58bdd796d4dbd4098103f558b307

        Download Submit

      • C:\Windows\TEMP\{fd8adb4e-7b5f-2b49-8727-f70d353c189a}\gameflt.inf
        Filesize

        2KB

        MD5

        838b501597050731b5898710a2389c17

        SHA1

        a4729ebdbb824ff91fc21dccc2bae7459f5353fb

        SHA256

        8fdc80cf6bce891ed4a2dfcbb049083f352c54ae75ed039a8cee9373192dfa16

        SHA512

        3a689d850e194757c46838ac38c52ad34e85f515a925cb35a8935d86467f33e53454ac705f7fef7f9aa72907511f6ef384c143d3836acaa49d94a240d169882f

        Download Submit

      • C:\Windows\inf\oem3.inf
        Filesize

        2KB

        MD5

        838b501597050731b5898710a2389c17

        SHA1

        a4729ebdbb824ff91fc21dccc2bae7459f5353fb

        SHA256

        8fdc80cf6bce891ed4a2dfcbb049083f352c54ae75ed039a8cee9373192dfa16

        SHA512

        3a689d850e194757c46838ac38c52ad34e85f515a925cb35a8935d86467f33e53454ac705f7fef7f9aa72907511f6ef384c143d3836acaa49d94a240d169882f

        Download Submit

      • \??\c:\windows\system32\gameinputredist.dll
        Filesize

        309KB

        MD5

        4e24767339e4fba8a58743bebed614fe

        SHA1

        f7c509725564e7d1cf4aaccfa6d902b2baec6b3e

        SHA256

        6bb2493a395eebb9ba027202c76257ca0690788849ae48aba7f3c4d6920510b6

        SHA512

        0cfcd3be6ff7ff453759b599666a1f91c45c02a4db2b5c51654edbcaaaaff31dcb030a7456789703762482b2f5168a9b22030462addfecfc845d8b628739c2ba

        Download Submit

      • memory/4572-136-0x0000000007730000-0x000000000773E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4572-132-0x00000000001E0000-0x00000000021AA000-memory.dmp

        Filesize

        31.8MB

        Download

      • memory/4572-135-0x000000000BB80000-0x000000000BBB8000-memory.dmp

        Filesize

        224KB

        Download

      • memory/4572-137-0x00000000027D0000-0x00000000027DA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4572-138-0x0000000007FC0000-0x0000000007FE6000-memory.dmp

        Filesize

        152KB

        Download

      • memory/4572-134-0x000000000BB70000-0x000000000BB78000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4572-133-0x0000000007C90000-0x0000000007C98000-memory.dmp

        Filesize

        32KB

        Download