Overview
overview
6Static
static
mmc-stable-win32.zip
windows10-1703-x64
1MultiMC/MultiMC.exe
windows10-1703-x64
6MultiMC/Qt5Core.dll
windows10-1703-x64
3MultiMC/Qt5Gui.dll
windows10-1703-x64
3MultiMC/Qt...rk.dll
windows10-1703-x64
3MultiMC/Qt5Svg.dll
windows10-1703-x64
3MultiMC/Qt...ts.dll
windows10-1703-x64
3MultiMC/Qt5Xml.dll
windows10-1703-x64
3MultiMC/ic...on.dll
windows10-1703-x64
1MultiMC/im...if.dll
windows10-1703-x64
1MultiMC/im...ns.dll
windows10-1703-x64
1MultiMC/im...co.dll
windows10-1703-x64
1MultiMC/im...eg.dll
windows10-1703-x64
1MultiMC/im...vg.dll
windows10-1703-x64
1MultiMC/im...mp.dll
windows10-1703-x64
1MultiMC/ja...ck.jar
windows10-1703-x64
1MultiMC/ja...ch.jar
windows10-1703-x64
1MultiMC/li...ix.dll
windows10-1703-x64
3MultiMC/li...++.dll
windows10-1703-x64
3MultiMC/li....dll.a
windows10-1703-x64
3MultiMC/li...ip.dll
windows10-1703-x64
3MultiMC/li...ow.dll
windows10-1703-x64
3MultiMC/libeay32.dll
windows10-1703-x64
1MultiMC/li...-1.dll
windows10-1703-x64
3MultiMC/libssp-0.dll
windows10-1703-x64
3MultiMC/li...-6.dll
windows10-1703-x64
3MultiMC/li...-1.dll
windows10-1703-x64
1MultiMC/pl...ws.dll
windows10-1703-x64
1MultiMC/qt.conf
windows10-1703-x64
3MultiMC/ssleay32.dll
windows10-1703-x64
1MultiMC/zlib1.dll
windows10-1703-x64
3Analysis
-
max time kernel
277s -
max time network
277s -
platform
windows10-1703_x64 -
resource
win10-20220812-es -
resource tags
arch:x64arch:x86image:win10-20220812-eslocale:es-esos:windows10-1703-x64systemwindows -
submitted
29/12/2022, 09:13
Static task
static1
Behavioral task
behavioral1
Sample
mmc-stable-win32.zip
Resource
win10-20220901-es
Behavioral task
behavioral2
Sample
MultiMC/MultiMC.exe
Resource
win10-20220812-es
Behavioral task
behavioral3
Sample
MultiMC/Qt5Core.dll
Resource
win10-20220812-es
Behavioral task
behavioral4
Sample
MultiMC/Qt5Gui.dll
Resource
win10-20220812-es
Behavioral task
behavioral5
Sample
MultiMC/Qt5Network.dll
Resource
win10-20220901-es
Behavioral task
behavioral6
Sample
MultiMC/Qt5Svg.dll
Resource
win10-20220812-es
Behavioral task
behavioral7
Sample
MultiMC/Qt5Widgets.dll
Resource
win10-20220812-es
Behavioral task
behavioral8
Sample
MultiMC/Qt5Xml.dll
Resource
win10-20220812-es
Behavioral task
behavioral9
Sample
MultiMC/iconengines/qsvgicon.dll
Resource
win10-20220901-es
Behavioral task
behavioral10
Sample
MultiMC/imageformats/qgif.dll
Resource
win10-20220812-es
Behavioral task
behavioral11
Sample
MultiMC/imageformats/qicns.dll
Resource
win10-20220812-es
Behavioral task
behavioral12
Sample
MultiMC/imageformats/qico.dll
Resource
win10-20220901-es
Behavioral task
behavioral13
Sample
MultiMC/imageformats/qjpeg.dll
Resource
win10-20220812-es
Behavioral task
behavioral14
Sample
MultiMC/imageformats/qsvg.dll
Resource
win10-20220812-es
Behavioral task
behavioral15
Sample
MultiMC/imageformats/qwbmp.dll
Resource
win10-20220812-es
Behavioral task
behavioral16
Sample
MultiMC/jars/JavaCheck.jar
Resource
win10-20220812-es
Behavioral task
behavioral17
Sample
MultiMC/jars/NewLaunch.jar
Resource
win10-20220901-es
Behavioral task
behavioral18
Sample
MultiMC/libLauncher_iconfix.dll
Resource
win10-20220812-es
Behavioral task
behavioral19
Sample
MultiMC/libLauncher_nbt++.dll
Resource
win10-20220812-es
Behavioral task
behavioral20
Sample
MultiMC/libLauncher_nbt++.dll.a
Resource
win10-20220812-es
Behavioral task
behavioral21
Sample
MultiMC/libLauncher_quazip.dll
Resource
win10-20220812-es
Behavioral task
behavioral22
Sample
MultiMC/libLauncher_rainbow.dll
Resource
win10-20220812-es
Behavioral task
behavioral23
Sample
MultiMC/libeay32.dll
Resource
win10-20220901-es
Behavioral task
behavioral24
Sample
MultiMC/libgcc_s_dw2-1.dll
Resource
win10-20220901-es
Behavioral task
behavioral25
Sample
MultiMC/libssp-0.dll
Resource
win10-20220812-es
Behavioral task
behavioral26
Sample
MultiMC/libstdc++-6.dll
Resource
win10-20220812-es
Behavioral task
behavioral27
Sample
MultiMC/libwinpthread-1.dll
Resource
win10-20220901-es
Behavioral task
behavioral28
Sample
MultiMC/platforms/qwindows.dll
Resource
win10-20220812-es
Behavioral task
behavioral29
Sample
MultiMC/qt.conf
Resource
win10-20220812-es
Behavioral task
behavioral30
Sample
MultiMC/ssleay32.dll
Resource
win10-20220812-es
Behavioral task
behavioral31
Sample
MultiMC/zlib1.dll
Resource
win10-20220812-es
General
-
Target
MultiMC/MultiMC.exe
-
Size
8.6MB
-
MD5
86ec72e400abe379ed8453af49bbef32
-
SHA1
374abd6b7aa5687fc738ceee1df52be0994fd8bc
-
SHA256
10e44003255706995674e8dfdd43ce8242ee5f8402cafc8ec01e614d7c93dfa7
-
SHA512
846619daf0bce719aa8ce63962b5e68f498010a36608c842dd94f7235fa5ef36e35be77aba528169eb132f7971e4f6f6298b102cf49b0ed3a41e9dbbff98b4ae
-
SSDEEP
196608:jSFXkbPNSzhxpI+nIrTGEhiKhxJunHR/OcdpIX9uVvVV5cVY7VjVMSrV4rNVVjVJ:aXWWwwdiYVvVV5cVY7VjVMSrV4rNVVj7
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 43 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff MultiMC.exe Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 MultiMC.exe Set value (data) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff MultiMC.exe Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 MultiMC.exe Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 MultiMC.exe Set value (int) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\NodeSlot = "1" MultiMC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance MultiMC.exe Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance MultiMC.exe Set value (data) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 MultiMC.exe Set value (int) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" MultiMC.exe Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 MultiMC.exe Set value (data) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff MultiMC.exe Set value (data) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c004346534616003100000000000c55a789120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe0c55a7890c55a7892e000000a55201000000010000000000000000000000000000003478c5004100700070004400610074006100000042000000 MultiMC.exe Set value (data) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff MultiMC.exe Set value (data) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000009d55e551100054656d7000003a0009000400efbe0c55a7899d55e5512e000000b9520100000001000000000000000000000000000000b3a12f00540065006d007000000014000000 MultiMC.exe Set value (data) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff MultiMC.exe Set value (int) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" MultiMC.exe Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings MultiMC.exe Set value (data) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000009d55125210004d756c74694d4300400009000400efbe9d55d4519d5512522e0000005dac0100000007000000000000000000000000000000885263004d0075006c00740069004d004300000016000000 MultiMC.exe Set value (int) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" MultiMC.exe Set value (int) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" MultiMC.exe Set value (data) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots MultiMC.exe Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 MultiMC.exe Set value (data) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000c55079910004c6f63616c003c0009000400efbe0c55a7890c5507992e000000b85201000000010000000000000000000000000000005a4604014c006f00630061006c00000014000000 MultiMC.exe Set value (data) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = ffffffff MultiMC.exe Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags MultiMC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" MultiMC.exe Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg MultiMC.exe Set value (int) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" MultiMC.exe Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU MultiMC.exe Set value (data) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 MultiMC.exe Set value (data) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 MultiMC.exe Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell MultiMC.exe Set value (data) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 MultiMC.exe Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell MultiMC.exe Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 MultiMC.exe Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} MultiMC.exe Set value (int) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" MultiMC.exe Set value (int) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" MultiMC.exe Set value (data) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff MultiMC.exe Set value (int) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" MultiMC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" MultiMC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" MultiMC.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2132 MultiMC.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2132 MultiMC.exe 2132 MultiMC.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2132 MultiMC.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 4560 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4560 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2132 MultiMC.exe 2132 MultiMC.exe 2132 MultiMC.exe 2132 MultiMC.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2132 wrote to memory of 3572 2132 MultiMC.exe 66 PID 2132 wrote to memory of 3572 2132 MultiMC.exe 66 PID 2132 wrote to memory of 3804 2132 MultiMC.exe 67 PID 2132 wrote to memory of 3804 2132 MultiMC.exe 67 PID 2132 wrote to memory of 4332 2132 MultiMC.exe 68 PID 2132 wrote to memory of 4332 2132 MultiMC.exe 68 PID 2132 wrote to memory of 3204 2132 MultiMC.exe 69 PID 2132 wrote to memory of 3204 2132 MultiMC.exe 69
Processes
-
C:\Users\Admin\AppData\Local\Temp\MultiMC\MultiMC.exe"C:\Users\Admin\AppData\Local\Temp\MultiMC\MultiMC.exe"1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar C:/Users/Admin/AppData/Local/Temp/MultiMC/jars/JavaCheck.jar2⤵PID:3572
-
-
C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe" -jar C:/Users/Admin/AppData/Local/Temp/MultiMC/jars/JavaCheck.jar2⤵PID:3804
-
-
C:\ProgramData\Oracle\Java\javapath\javaw.exejavaw -jar C:/Users/Admin/AppData/Local/Temp/MultiMC/jars/JavaCheck.jar2⤵PID:4332
-
-
C:\ProgramData\Oracle\Java\javapath\javaw.exejavaw -Xms512m -Xmx1024m -jar C:/Users/Admin/AppData/Local/Temp/MultiMC/jars/JavaCheck.jar2⤵PID:3204
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3e81⤵
- Suspicious use of AdjustPrivilegeToken
PID:4560
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD5d449961a7c18206bcfc8251b79678a9d
SHA12766085da487fc2c34e1a6c08b52c304f53e73df
SHA2561d3f357f71ee4d0371c65ae07e4ff32d5ed701f912caefa527860a16e49a8b2f
SHA5129e4b28d2440fd8f9364fb720bce63de4cfc7fd2f1b303e93da5840cb0f59512b11040f1fe5f413515e3a1fa85630faaa8314716c7571c4c0b8dfb9a5fa3a5080
-
Filesize
50B
MD5c55c023258bc544680e2eefef0c9cdf2
SHA132808abca8814818a988efcae762cc4ef45d127a
SHA2561ffeb506e4dc445a403edcca02fc0f0d13c8401f1d0a36f221f798c5c5093e1c
SHA51202ff0d0abbfb6413d2be18b309c534d454a96c18bf360a4ccf5f448502b87004daba4284d7e4754c43b7acd326695d0f76f3ea4cec7c9b3404174246c306f9e3