01eb04ae97b21ec2dcd74bb5a247c3b402900781b94936d269db028f8769679f

Analysis

max time kernel
15s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2023, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

minecraft launcher.exe
Size

6.9MB
MD5

b0713c1e85f293ef59958bfd5e68c697
SHA1

b158a9392011a02774b8da7edf10719366eec62c
SHA256

01eb04ae97b21ec2dcd74bb5a247c3b402900781b94936d269db028f8769679f
SHA512

2555c69e9f49a3cd715148c15dec5d4afb617ed98e82ddd6f4ff9a04a1c257d28127c976fd1ab75f340d026b5fa67d48b1246a00502e3689b93dac4e8dbcf21f
SSDEEP

196608:IGWqwrHKfwQTRUISWhbywML2X9tnwlJMLjACLl:FWjTKoatbywMLU9tnwlJ7u

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2220	MCLAUN~1.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	minecraft launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	minecraft launcher.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	MCLAUN~1.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2220	MCLAUN~1.EXE
2220	MCLAUN~1.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 2220	1520	minecraft launcher.exe	81
PID 1520 wrote to memory of 2220	1520	minecraft launcher.exe	81

C:\Users\Admin\AppData\Local\Temp\minecraft launcher.exe
"C:\Users\Admin\AppData\Local\Temp\minecraft launcher.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MCLAUN~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MCLAUN~1.EXE
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MCLAUN~1.EXE

Filesize
6.1MB

MD5
ec1964887fe0b171dc8dbd7f0a8b8782

SHA1
06279153902f1517b64de99776b186de3cbf3e2d

SHA256
fb306b5ce723d1d4d96d3c49f218a5f23ef2ef35c1f6fca8b72ee01bfb59bb5a

SHA512
a04531ba8c384512b6c2828eded271f4970bd7beb8f3f9503c8a9f6925439f702ce962dd364b9dd0aaa8b16c874cae64e39bdd48535f3906a601f687add83757

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MCLAUN~1.EXE

Filesize
6.1MB

MD5
ec1964887fe0b171dc8dbd7f0a8b8782

SHA1
06279153902f1517b64de99776b186de3cbf3e2d

SHA256
fb306b5ce723d1d4d96d3c49f218a5f23ef2ef35c1f6fca8b72ee01bfb59bb5a

SHA512
a04531ba8c384512b6c2828eded271f4970bd7beb8f3f9503c8a9f6925439f702ce962dd364b9dd0aaa8b16c874cae64e39bdd48535f3906a601f687add83757

Download Submit
memory/2220-135-0x00000185A0AD0000-0x00000185A10F2000-memory.dmp

Filesize
6.1MB

Download
memory/2220-136-0x00007FFCA79B0000-0x00007FFCA8471000-memory.dmp

Filesize
10.8MB

Download
memory/2220-137-0x00000185A2CE0000-0x00000185A2D02000-memory.dmp

Filesize
136KB

Download
memory/2220-138-0x0000018DC5BC0000-0x0000018DC6366000-memory.dmp

Filesize
7.6MB

Download
memory/2220-139-0x00000185BB7B9000-0x00000185BB7BF000-memory.dmp

Filesize
24KB

Download