Overview

overview

8

Static

static

MinecraftI...er.exe

windows7-x64

3

MinecraftI...er.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    267s
  • max time network
    270s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2022, 21:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MinecraftInstaller.exe
  • Size 31.8MB
  • Sample221229-1mryzaec36
  • SHA256 2b0e05e169643319074f306153e55f2d839adb0378d6e721c04198233b892bfa
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Registers COM server for autorun 1 TTPs 6 IoCs
    persistence
  • Loads dropped DLL 3 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 21 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4572
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    PID:1348
    • C:\Windows\system32\svchost.exe
      "svchost.exe"
      2⤵
        PID:4608
    • C:\Program Files\WindowsApps\Microsoft.GamingServices_8.71.12001.0_x64__8wekyb3d8bbwe\GamingServices.exe
      "C:\Program Files\WindowsApps\Microsoft.GamingServices_8.71.12001.0_x64__8wekyb3d8bbwe\GamingServices.exe"
      1⤵
      • Registers COM server for autorun
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1912
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /i "C:\Program Files\WindowsApps\Microsoft.GamingServices_8.71.12001.0_x64__8wekyb3d8bbwe\gameinputredist.msi" /quiet /l*v "C:\Windows\TEMP\gameinputredist.log"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4376
    • C:\Program Files\WindowsApps\Microsoft.GamingServices_8.71.12001.0_x64__8wekyb3d8bbwe\GamingServicesNet.exe
      "C:\Program Files\WindowsApps\Microsoft.GamingServices_8.71.12001.0_x64__8wekyb3d8bbwe\GamingServicesNet.exe"
      1⤵
        PID:1960
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1856
      • C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe
        "C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe"
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1588
        • C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe
          "C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe" Global\GameInputSession_1
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:212
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
        1⤵
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of WriteProcessMemory
        PID:2932
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Windows\TEMP\{c933e723-3f6d-2644-822e-1e9d30e8b7cc}\xvdd.inf" "9" "4ecdd1eeb" "0000000000000148" "Service-0x0-3e7$\Default" "0000000000000164" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_8.71.12001.0_x64__8wekyb3d8bbwe\drivers"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:4152
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "1" "0" "SWD\XvddEnum\XvddRootDevice_Instance" "" "" "48fe919b3" "0000000000000000"
          2⤵
          • Drops file in Windows directory
          PID:4516
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Windows\TEMP\{fd8adb4e-7b5f-2b49-8727-f70d353c189a}\gameflt.inf" "9" "41bf4167f" "0000000000000164" "Service-0x0-3e7$\Default" "0000000000000160" "208" "C:\Program Files\WindowsApps\Microsoft.GamingServices_8.71.12001.0_x64__8wekyb3d8bbwe\drivers"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:4636
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_6284700d01a44dd9\gameflt.inf" "0" "41bf4167f" "0000000000000178" "Service-0x0-3e7$\Default"
          2⤵
          • Drops file in Windows directory
          PID:2524
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_6284700d01a44dd9\gameflt.inf" "0" "4e7d9c3d3" "0000000000000164" "Service-0x0-3e7$\Default"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:3116

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            GameInputRedist.dll
            • Path C:\Program Files (x86)\Microsoft GameInput\x64\GameInputRedist.dll
            • Size 309KB
            • SHA256 6bb2493a395eebb9ba027202c76257ca0690788849ae48aba7f3c4d6920510b6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            gameinputsvc.exe
            • Path C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe
            • Size 89KB
            • SHA256 d700523c0803c3224761307ffbc26b8d7e77d6bd58a19647fcae76f2d62f71cb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            gameinputsvc.exe
            • Path C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe
            • Size 89KB
            • SHA256 d700523c0803c3224761307ffbc26b8d7e77d6bd58a19647fcae76f2d62f71cb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GameInputRedist.dll
            • Path C:\Program Files (x86)\Microsoft GameInput\x86\GameInputRedist.dll
            • Size 194KB
            • SHA256 624a69ec4e26ef82ee5812c3322af03f2bb9aa03c31c38a19fea89e6c46399a6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            gameplatformservices.dll
            • Path C:\Windows\SYSTEM32\gameplatformservices.dll
            • Size 449KB
            • SHA256 6edef18b5066d5e2105119e9ec764ce273ab3397d0cc61b9d4574b0ee9af7af3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dberr.txt
            • Path C:\Windows\System32\CatRoot2\dberr.txt
            • Size 2KB
            • SHA256 98402158b572a7a284198e35b648d0fbb062c94086c5b42f63111c80320a33b7
            • MD5 SHA1 SHA512
            Submit Download

            gameflt.cat
            • Path C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_6284700d01a44dd9\gameflt.cat
            • Size 11KB
            • SHA256 d163d13b6d29227eb275f39fcd84a594b5476371c4953358c943b7858501ea82
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            gameflt.inf
            • Path C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_6284700d01a44dd9\gameflt.inf
            • Size 2KB
            • SHA256 8fdc80cf6bce891ed4a2dfcbb049083f352c54ae75ed039a8cee9373192dfa16
            • MD5 SHA1 SHA512
            Submit Download

            gameflt.sys
            • Path C:\Windows\System32\DriverStore\FileRepository\gameflt.inf_amd64_6284700d01a44dd9\gameflt.sys
            • Size 147KB
            • SHA256 01d0afd8345be9d32ca33c8b77a0ac2e9c5e460b8b787e3fbd5c83d0e97b39e2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            xvdd.inf
            • Path C:\Windows\System32\DriverStore\FileRepository\xvdd.inf_amd64_eae73d4477526335\xvdd.inf
            • Size 1KB
            • SHA256 80ec0504e48def867cdbb27d4d74c17767281c3baf21677f4ba154c1c147025e
            • MD5 SHA1 SHA512
            Submit Download

            GameInputRedist.dll
            • Path C:\Windows\System32\GameInputRedist.dll
            • Size 309KB
            • SHA256 6bb2493a395eebb9ba027202c76257ca0690788849ae48aba7f3c4d6920510b6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GameInputRedist.dll
            • Path C:\Windows\System32\GameInputRedist.dll
            • Size 309KB
            • SHA256 6bb2493a395eebb9ba027202c76257ca0690788849ae48aba7f3c4d6920510b6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            gameplatformservices.dll
            • Path C:\Windows\System32\gameplatformservices.dll
            • Size 449KB
            • SHA256 6edef18b5066d5e2105119e9ec764ce273ab3397d0cc61b9d4574b0ee9af7af3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            gameinputredist.log
            • Path C:\Windows\TEMP\gameinputredist.log
            • Size 1KB
            • SHA256 ad8041cffc3d243aa59f37b617808d64699bb74b5be34c62f6c7ae6b44616429
            • MD5 SHA1 SHA512
            Submit Download

            xvdd.cat
            • Path C:\Windows\TEMP\{C933E~1\xvdd.cat
            • Size 11KB
            • SHA256 3d46434d8a331a9f97b4b68449f520945ba325272e14b0944a5890297536a7b4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            xvdd.sys
            • Path C:\Windows\TEMP\{C933E~1\xvdd.sys
            • Size 659KB
            • SHA256 f5cec1a2c850b03f6c5b30c9f5253a2ed0d05318690b9a35f4bf50f0c198d6f9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            gameflt.cat
            • Path C:\Windows\TEMP\{FD8AD~1\gameflt.cat
            • Size 11KB
            • SHA256 d163d13b6d29227eb275f39fcd84a594b5476371c4953358c943b7858501ea82
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            gameflt.sys
            • Path C:\Windows\TEMP\{FD8AD~1\gameflt.sys
            • Size 147KB
            • SHA256 01d0afd8345be9d32ca33c8b77a0ac2e9c5e460b8b787e3fbd5c83d0e97b39e2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            xvdd.inf
            • Path C:\Windows\TEMP\{c933e723-3f6d-2644-822e-1e9d30e8b7cc}\xvdd.inf
            • Size 1KB
            • SHA256 80ec0504e48def867cdbb27d4d74c17767281c3baf21677f4ba154c1c147025e
            • MD5 SHA1 SHA512
            Submit Download

            gameflt.inf
            • Path C:\Windows\TEMP\{fd8adb4e-7b5f-2b49-8727-f70d353c189a}\gameflt.inf
            • Size 2KB
            • SHA256 8fdc80cf6bce891ed4a2dfcbb049083f352c54ae75ed039a8cee9373192dfa16
            • MD5 SHA1 SHA512
            Submit Download

            oem3.inf
            • Path C:\Windows\inf\oem3.inf
            • Size 2KB
            • SHA256 8fdc80cf6bce891ed4a2dfcbb049083f352c54ae75ed039a8cee9373192dfa16
            • MD5 SHA1 SHA512
            Submit Download

            gameinputredist.dll
            • Path \??\c:\windows\system32\gameinputredist.dll
            • Size 309KB
            • SHA256 6bb2493a395eebb9ba027202c76257ca0690788849ae48aba7f3c4d6920510b6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/4572-136-0x0000000007730000-0x000000000773E000-memory.dmp
            Download

            memory/4572-132-0x00000000001E0000-0x00000000021AA000-memory.dmp
            Download

            memory/4572-135-0x000000000BB80000-0x000000000BBB8000-memory.dmp
            Download

            memory/4572-137-0x00000000027D0000-0x00000000027DA000-memory.dmp
            Download

            memory/4572-138-0x0000000007FC0000-0x0000000007FE6000-memory.dmp
            Download

            memory/4572-134-0x000000000BB70000-0x000000000BB78000-memory.dmp
            Download

            memory/4572-133-0x0000000007C90000-0x0000000007C98000-memory.dmp
            Download