Analysis
-
max time kernel
76s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04/02/2023, 21:24
Static task
static1
Behavioral task
behavioral1
Sample
LauncherFenix-Minecraft-v7.exe
Resource
win7-20221111-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
LauncherFenix-Minecraft-v7.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
LauncherFenix-Minecraft-v7.exe
-
Size
397KB
-
MD5
d99bb55b57712065bc88be297c1da38c
-
SHA1
fb6662dd31e8e5be380fbd7a33a50a45953fe1e7
-
SHA256
122bfbb9f67e355340991deeacb167be9c12ad726b5a7c5779448dd0cc4af0cb
-
SHA512
3eb5d57faea4c0146c2af40102deaac18235b379f5e81fe35a977b642e3edf70704c8cedd835e94f27b04c8413968f7469fccf82c1c9339066d38d3387c71b17
-
SSDEEP
3072:puzvch1rugYc4wqYSRR756K7ItBjgXHUYCnlK:Wch1aIqYSRVM+unlK
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1704 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1704 taskmgr.exe -
Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe -
Suspicious use of SendNotifyMessage 58 IoCs
pid Process 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe 1704 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1552 javaw.exe 1552 javaw.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1504 wrote to memory of 1552 1504 LauncherFenix-Minecraft-v7.exe 28 PID 1504 wrote to memory of 1552 1504 LauncherFenix-Minecraft-v7.exe 28 PID 1504 wrote to memory of 1552 1504 LauncherFenix-Minecraft-v7.exe 28 PID 1504 wrote to memory of 1552 1504 LauncherFenix-Minecraft-v7.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe"C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:1552
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1704