51a8d363bee48c41e89fc5ff6b9659d93d9521d94b824df9cf907588c2246f44

Analysis

max time kernel
67s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2023, 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Minecraft Launcher.exe
Size

4.4MB
MD5

62da1cde5869df964fc628ab9d226fb4
SHA1

6b4ebcd1685180d4e4477f5a7e9c36138e2e9aed
SHA256

51a8d363bee48c41e89fc5ff6b9659d93d9521d94b824df9cf907588c2246f44
SHA512

d29dc55c6ef957e624f445ca746db1e0bc4ba543df6e4aea4dc2f0ed8284bab80ff6268dc834722d695044cd1bb32cd6ca2086327aee22312b3d33bbd6b33d97
SSDEEP

98304:9Gz4kB1F8O+ZJpzMkqvc+tymgjSnm2Mwp3CTua:9YBcO+P2kqvchunHMwp3CTua

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
5392	Minecraft Launcher.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb	javaw.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4568	chrome.exe
4568	chrome.exe
3364	chrome.exe
3364	chrome.exe
5388	chrome.exe
5388	chrome.exe
5464	chrome.exe
5464	chrome.exe
5152	chrome.exe
5152	chrome.exe
5328	chrome.exe
5328	chrome.exe
5772	chrome.exe
5772	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1248	javaw.exe
1248	javaw.exe
1248	javaw.exe
1248	javaw.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 1248	4936	Minecraft Launcher.exe	83
PID 4936 wrote to memory of 1248	4936	Minecraft Launcher.exe	83
PID 3364 wrote to memory of 3980	3364	chrome.exe	92
PID 3364 wrote to memory of 3980	3364	chrome.exe	92
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 1084	3364	chrome.exe	95
PID 3364 wrote to memory of 4568	3364	chrome.exe	96
PID 3364 wrote to memory of 4568	3364	chrome.exe	96
PID 3364 wrote to memory of 1196	3364	chrome.exe	98
PID 3364 wrote to memory of 1196	3364	chrome.exe	98
PID 3364 wrote to memory of 1196	3364	chrome.exe	98
PID 3364 wrote to memory of 1196	3364	chrome.exe	98
PID 3364 wrote to memory of 1196	3364	chrome.exe	98
PID 3364 wrote to memory of 1196	3364	chrome.exe	98
PID 3364 wrote to memory of 1196	3364	chrome.exe	98
PID 3364 wrote to memory of 1196	3364	chrome.exe	98
PID 3364 wrote to memory of 1196	3364	chrome.exe	98
PID 3364 wrote to memory of 1196	3364	chrome.exe	98
PID 3364 wrote to memory of 1196	3364	chrome.exe	98
PID 3364 wrote to memory of 1196	3364	chrome.exe	98
PID 3364 wrote to memory of 1196	3364	chrome.exe	98
PID 3364 wrote to memory of 1196	3364	chrome.exe	98
PID 3364 wrote to memory of 1196	3364	chrome.exe	98
PID 3364 wrote to memory of 1196	3364	chrome.exe	98
PID 3364 wrote to memory of 1196	3364	chrome.exe	98
PID 3364 wrote to memory of 1196	3364	chrome.exe	98

C:\Users\Admin\AppData\Local\Temp\Minecraft Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Minecraft Launcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -Xms256m -Xmx512m -jar "C:\Users\Admin\AppData\Local\Temp\Minecraft Launcher.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:1248

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffecdb34f50,0x7ffecdb34f60,0x7ffecdb34f70
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1660 /prefetch:2
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2292 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4636 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  PID:5508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:5712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=896 /prefetch:8
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:5396
- C:\Users\Admin\Downloads\Minecraft Launcher.exe
  "C:\Users\Admin\Downloads\Minecraft Launcher.exe"
  2⤵
  - Executes dropped EXE
  PID:5392
- - C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
    "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -Xms256m -Xmx512m -jar "C:\Users\Admin\Downloads\Minecraft Launcher.exe"
    3⤵
    PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,18018101557162134932,256405898183307362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
PID:5604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
94cc40b9f974e9b5fd5c007084c41479

SHA1
5486064835654227efb80dc416e3260fbca852d4

SHA256
00696ffa66aa273023d5064a80a31834e04fc2b99227663b2604cda253a26b7d

SHA512
9bc50c129186dbd0ef58635a3f6624fe77fbbd29aa47d8b79ebe39b9b04026d216cf72ebbf3dd910c4e44b3560ee768dec99ae65c388e95f8a58f715ad45cb47

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\servers.dat

Filesize
112B

MD5
009b730618eb922205fbb3e29bc81b9d

SHA1
8176e9feaa66024fb7750aac5475c6bf8ae5dda3

SHA256
517284d561f3b06bae25f16c36b4ffdddfc6c1234fbc4943c268eaf06d0f6403

SHA512
b354df26f4d620cc6a8e7d9eda37368905a65f2ebebbdfc3e219f63f5b626b9cc2ad4255e6bb107bb645f7a606646fb8176e8b3fd72029f2ef715c18ac92f6a5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4246620582-653642754-1174164128-1000\83aa4cc77f591dfc2374580bbd95f6ba_26355f79-4f6c-4ae9-abeb-84bfcbb996ec

Filesize
45B

MD5
c8366ae350e7019aefc9d1e6e6a498c6

SHA1
5731d8a3e6568a5f2dfbbc87e3db9637df280b61

SHA256
11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

SHA512
33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

Download Submit
C:\Users\Admin\Downloads\Minecraft Launcher.exe

Filesize
4.4MB

MD5
62da1cde5869df964fc628ab9d226fb4

SHA1
6b4ebcd1685180d4e4477f5a7e9c36138e2e9aed

SHA256
51a8d363bee48c41e89fc5ff6b9659d93d9521d94b824df9cf907588c2246f44

SHA512
d29dc55c6ef957e624f445ca746db1e0bc4ba543df6e4aea4dc2f0ed8284bab80ff6268dc834722d695044cd1bb32cd6ca2086327aee22312b3d33bbd6b33d97

Download Submit
C:\Users\Admin\Downloads\Minecraft Launcher.exe

Filesize
4.4MB

MD5
62da1cde5869df964fc628ab9d226fb4

SHA1
6b4ebcd1685180d4e4477f5a7e9c36138e2e9aed

SHA256
51a8d363bee48c41e89fc5ff6b9659d93d9521d94b824df9cf907588c2246f44

SHA512
d29dc55c6ef957e624f445ca746db1e0bc4ba543df6e4aea4dc2f0ed8284bab80ff6268dc834722d695044cd1bb32cd6ca2086327aee22312b3d33bbd6b33d97

Download Submit
memory/1248-162-0x0000000002700000-0x0000000003700000-memory.dmp

Filesize
16.0MB

Download
memory/1248-151-0x0000000002700000-0x0000000003700000-memory.dmp

Filesize
16.0MB

Download
memory/1248-159-0x0000000002700000-0x0000000003700000-memory.dmp

Filesize
16.0MB

Download
memory/1248-142-0x0000000002700000-0x0000000003700000-memory.dmp

Filesize
16.0MB

Download
memory/1248-149-0x0000000002700000-0x0000000003700000-memory.dmp

Filesize
16.0MB

Download
memory/1248-156-0x0000000002700000-0x0000000003700000-memory.dmp

Filesize
16.0MB

Download
memory/5384-176-0x00000000029C0000-0x00000000039C0000-memory.dmp

Filesize
16.0MB

Download
memory/5384-186-0x00000000029C0000-0x00000000039C0000-memory.dmp

Filesize
16.0MB

Download
memory/5384-188-0x00000000029C0000-0x00000000039C0000-memory.dmp

Filesize
16.0MB

Download
memory/5384-192-0x00000000029C0000-0x00000000039C0000-memory.dmp

Filesize
16.0MB

Download
memory/5384-184-0x00000000029C0000-0x00000000039C0000-memory.dmp

Filesize
16.0MB

Download
memory/5384-199-0x00000000029C0000-0x00000000039C0000-memory.dmp

Filesize
16.0MB

Download
memory/5384-202-0x00000000029C0000-0x00000000039C0000-memory.dmp

Filesize
16.0MB

Download
memory/5384-205-0x00000000029C0000-0x00000000039C0000-memory.dmp

Filesize
16.0MB

Download
memory/5384-209-0x00000000029C0000-0x00000000039C0000-memory.dmp

Filesize
16.0MB

Download
memory/5384-211-0x00000000029C0000-0x00000000039C0000-memory.dmp

Filesize
16.0MB

Download
memory/5384-212-0x00000000029C0000-0x00000000039C0000-memory.dmp

Filesize
16.0MB

Download