8662964a0c03e181d3a7cd58824a4367a4e970f333d693a995af83bada214c05

Analysis

max time kernel
151s
max time network
134s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/03/2023, 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MultiMC/MultiMC.exe
Size

8.8MB
MD5

38c782c12952ecaeb3af973a7338790d
SHA1

3167c8152fde81d9b3aebbb41d38a607ba5b48b7
SHA256

4fc7abd9769e631fe1831b8b0da7b924322b77fee774dba6c5d0ccf6f69242f4
SHA512

e72b69bee5cf6ca2c45d8b84f128126dd1c81f03e7dfae4d03e3d906f79bb7e1f9ecad6030e4447783657e59c75017df72f590ca786edcfd2996c88345542a1a
SSDEEP

196608:LjeHzMAqhnF5SdEy/vgiBkxqSdXh9NWompJIwFsBEeVgVvV3rABVLVVkNWV+O8VU:OHOer/vAUpyRVgVvV3rABVLVVkNWV+On

Score

1^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1996	MultiMC.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1996	MultiMC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1996	MultiMC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1188	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1188	AUDIODG.EXE
Token: 33	1188	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1188	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1996	MultiMC.exe
1996	MultiMC.exe
1996	MultiMC.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2012	1996	MultiMC.exe	28
PID 1996 wrote to memory of 2012	1996	MultiMC.exe	28
PID 1996 wrote to memory of 2012	1996	MultiMC.exe	28
PID 1996 wrote to memory of 2012	1996	MultiMC.exe	28
PID 1996 wrote to memory of 1756	1996	MultiMC.exe	29
PID 1996 wrote to memory of 1756	1996	MultiMC.exe	29
PID 1996 wrote to memory of 1756	1996	MultiMC.exe	29
PID 1996 wrote to memory of 1756	1996	MultiMC.exe	29

C:\Users\Admin\AppData\Local\Temp\MultiMC\MultiMC.exe
"C:\Users\Admin\AppData\Local\Temp\MultiMC\MultiMC.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar C:/Users/Admin/AppData/Local/Temp/MultiMC/jars/JavaCheck.jar
  2⤵
  PID:2012
- C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe
  "C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe" -jar C:/Users/Admin/AppData/Local/Temp/MultiMC/jars/JavaCheck.jar
  2⤵
  PID:1756

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x46c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MultiMC\translations\index_v2.json

Filesize
15KB

MD5
4d18ce01732ff1fe8305af3d74e6cb41

SHA1
43437da4cbc9e0e6adbc88a76e75721963c07d3b

SHA256
284159c2183faff37ff5659330ea42e31acc1ab105f68f9efb5faffc83ca98fe

SHA512
d2e9466bfeb76eb46d9d1cd144ef04c3f51512bf92b2f15d3d62344e90beeabc5b117a5afbcac860cfd4910e66f8716f59a68837bcd125851a15d548bff122af

Download Submit
memory/1996-81-0x0000000064940000-0x0000000064954000-memory.dmp

Filesize
80KB

Download
memory/1996-92-0x000000006A880000-0x000000006A9F6000-memory.dmp

Filesize
1.5MB

Download
memory/1996-58-0x0000000061740000-0x0000000061771000-memory.dmp

Filesize
196KB

Download
memory/1996-59-0x000000006C8C0000-0x000000006C8FF000-memory.dmp

Filesize
252KB

Download
memory/1996-60-0x0000000000F60000-0x00000000015A4000-memory.dmp

Filesize
6.3MB

Download
memory/1996-62-0x0000000000400000-0x0000000000A1E000-memory.dmp

Filesize
6.1MB

Download
memory/1996-72-0x0000000004DE0000-0x0000000004FF2000-memory.dmp

Filesize
2.1MB

Download
memory/1996-77-0x0000000000400000-0x0000000000A1E000-memory.dmp

Filesize
6.1MB

Download
memory/1996-78-0x0000000070940000-0x000000007095C000-memory.dmp

Filesize
112KB

Download
memory/1996-79-0x0000000068880000-0x0000000068DAF000-memory.dmp

Filesize
5.2MB

Download
memory/1996-80-0x000000006E940000-0x000000006E964000-memory.dmp

Filesize
144KB

Download
memory/1996-54-0x0000000000330000-0x0000000000348000-memory.dmp

Filesize
96KB

Download
memory/1996-57-0x0000000070940000-0x000000007095C000-memory.dmp

Filesize
112KB

Download
memory/1996-82-0x000000006FC40000-0x000000006FD41000-memory.dmp

Filesize
1.0MB

Download
memory/1996-89-0x0000000069700000-0x0000000069894000-memory.dmp

Filesize
1.6MB

Download
memory/1996-85-0x0000000061740000-0x0000000061771000-memory.dmp

Filesize
196KB

Download
memory/1996-87-0x0000000000330000-0x0000000000348000-memory.dmp

Filesize
96KB

Download
memory/1996-88-0x0000000063400000-0x0000000063415000-memory.dmp

Filesize
84KB

Download
memory/1996-84-0x0000000000020000-0x000000000002C000-memory.dmp

Filesize
48KB

Download
memory/1996-86-0x000000006C8C0000-0x000000006C8FF000-memory.dmp

Filesize
252KB

Download
memory/1996-90-0x0000000000F60000-0x00000000015A4000-memory.dmp

Filesize
6.3MB

Download
memory/1996-91-0x0000000066C00000-0x0000000066C3E000-memory.dmp

Filesize
248KB

Download
memory/1996-83-0x0000000061940000-0x0000000061EB5000-memory.dmp

Filesize
5.5MB

Download
memory/1996-93-0x000000006E600000-0x000000006E674000-memory.dmp

Filesize
464KB

Download
memory/1996-94-0x0000000004DE0000-0x0000000004FF2000-memory.dmp

Filesize
2.1MB

Download
memory/1996-55-0x0000000000F60000-0x00000000015A4000-memory.dmp

Filesize
6.3MB

Download