Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    15s
  • max time network
    17s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/01/2023, 01:12

General

  • Target

    minecraft launcher.exe

  • Size

    6.9MB

  • MD5

    b0713c1e85f293ef59958bfd5e68c697

  • SHA1

    b158a9392011a02774b8da7edf10719366eec62c

  • SHA256

    01eb04ae97b21ec2dcd74bb5a247c3b402900781b94936d269db028f8769679f

  • SHA512

    2555c69e9f49a3cd715148c15dec5d4afb617ed98e82ddd6f4ff9a04a1c257d28127c976fd1ab75f340d026b5fa67d48b1246a00502e3689b93dac4e8dbcf21f

  • SSDEEP

    196608:IGWqwrHKfwQTRUISWhbywML2X9tnwlJMLjACLl:FWjTKoatbywMLU9tnwlJ7u

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\minecraft launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\minecraft launcher.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MCLAUN~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MCLAUN~1.EXE
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2220

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MCLAUN~1.EXE

    Filesize

    6.1MB

    MD5

    ec1964887fe0b171dc8dbd7f0a8b8782

    SHA1

    06279153902f1517b64de99776b186de3cbf3e2d

    SHA256

    fb306b5ce723d1d4d96d3c49f218a5f23ef2ef35c1f6fca8b72ee01bfb59bb5a

    SHA512

    a04531ba8c384512b6c2828eded271f4970bd7beb8f3f9503c8a9f6925439f702ce962dd364b9dd0aaa8b16c874cae64e39bdd48535f3906a601f687add83757

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MCLAUN~1.EXE

    Filesize

    6.1MB

    MD5

    ec1964887fe0b171dc8dbd7f0a8b8782

    SHA1

    06279153902f1517b64de99776b186de3cbf3e2d

    SHA256

    fb306b5ce723d1d4d96d3c49f218a5f23ef2ef35c1f6fca8b72ee01bfb59bb5a

    SHA512

    a04531ba8c384512b6c2828eded271f4970bd7beb8f3f9503c8a9f6925439f702ce962dd364b9dd0aaa8b16c874cae64e39bdd48535f3906a601f687add83757

  • memory/2220-135-0x00000185A0AD0000-0x00000185A10F2000-memory.dmp

    Filesize

    6.1MB

  • memory/2220-136-0x00007FFCA79B0000-0x00007FFCA8471000-memory.dmp

    Filesize

    10.8MB

  • memory/2220-137-0x00000185A2CE0000-0x00000185A2D02000-memory.dmp

    Filesize

    136KB

  • memory/2220-138-0x0000018DC5BC0000-0x0000018DC6366000-memory.dmp

    Filesize

    7.6MB

  • memory/2220-139-0x00000185BB7B9000-0x00000185BB7BF000-memory.dmp

    Filesize

    24KB