e5aa82f024d02398b56ce550807b281248b692f3a8f73de561dd29a9812ad24f

Analysis

max time kernel
151s
max time network
132s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11-04-2023 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MultiMC/MultiMC.exe
Size

8.8MB
MD5

16d44d6924d6bb8f91cd3900439985f1
SHA1

46af81c1683e8215afa138a2c684e2396555a37c
SHA256

425f6bec52574ae759bb41c003b646d48a7633556ee4fdd90c0d48827504bf51
SHA512

a27413890f5afc2e0e6f9d30a2e348267d6522f888548317551adf1e0ddca6022951b3899a1a675b9b9ed314b096e798a94785730bce82d4589648a47bc9fa72
SSDEEP

196608:Y+sc5oZ9MQ6CJnqzF2mc28M1RSdpdrmZ5p00oxdALFeVgVvV3rZBVLVV3WV+F8VI:iccPa2mJJ0n9VgVvV3rZBVLVV3WV+F8u

Score

1^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1268	MultiMC.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1268	MultiMC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1268	MultiMC.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1268	MultiMC.exe
1268	MultiMC.exe
1268	MultiMC.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1892	1268	MultiMC.exe	26
PID 1268 wrote to memory of 1892	1268	MultiMC.exe	26
PID 1268 wrote to memory of 1892	1268	MultiMC.exe	26
PID 1268 wrote to memory of 1892	1268	MultiMC.exe	26
PID 1268 wrote to memory of 1644	1268	MultiMC.exe	27
PID 1268 wrote to memory of 1644	1268	MultiMC.exe	27
PID 1268 wrote to memory of 1644	1268	MultiMC.exe	27
PID 1268 wrote to memory of 1644	1268	MultiMC.exe	27

C:\Users\Admin\AppData\Local\Temp\MultiMC\MultiMC.exe
"C:\Users\Admin\AppData\Local\Temp\MultiMC\MultiMC.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar C:/Users/Admin/AppData/Local/Temp/MultiMC/jars/JavaCheck.jar
  2⤵
  PID:1892
- C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe
  "C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe" -jar C:/Users/Admin/AppData/Local/Temp/MultiMC/jars/JavaCheck.jar
  2⤵
  PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MultiMC\translations\index_v2.json

Filesize
15KB

MD5
4d18ce01732ff1fe8305af3d74e6cb41

SHA1
43437da4cbc9e0e6adbc88a76e75721963c07d3b

SHA256
284159c2183faff37ff5659330ea42e31acc1ab105f68f9efb5faffc83ca98fe

SHA512
d2e9466bfeb76eb46d9d1cd144ef04c3f51512bf92b2f15d3d62344e90beeabc5b117a5afbcac860cfd4910e66f8716f59a68837bcd125851a15d548bff122af

Download Submit
memory/1268-81-0x0000000064940000-0x0000000064954000-memory.dmp

Filesize
80KB

Download
memory/1268-58-0x0000000061740000-0x0000000061771000-memory.dmp

Filesize
196KB

Download
memory/1268-83-0x0000000061940000-0x0000000061EB5000-memory.dmp

Filesize
5.5MB

Download
memory/1268-84-0x0000000000020000-0x000000000002C000-memory.dmp

Filesize
48KB

Download
memory/1268-60-0x0000000000B40000-0x0000000001184000-memory.dmp

Filesize
6.3MB

Download
memory/1268-62-0x0000000000400000-0x0000000000A1E000-memory.dmp

Filesize
6.1MB

Download
memory/1268-72-0x0000000004E10000-0x0000000005022000-memory.dmp

Filesize
2.1MB

Download
memory/1268-77-0x0000000000400000-0x0000000000A1E000-memory.dmp

Filesize
6.1MB

Download
memory/1268-78-0x0000000070940000-0x000000007095C000-memory.dmp

Filesize
112KB

Download
memory/1268-79-0x0000000068880000-0x0000000068DAF000-memory.dmp

Filesize
5.2MB

Download
memory/1268-80-0x000000006E940000-0x000000006E964000-memory.dmp

Filesize
144KB

Download
memory/1268-54-0x00000000002C0000-0x00000000002D8000-memory.dmp

Filesize
96KB

Download
memory/1268-55-0x0000000000B40000-0x0000000001184000-memory.dmp

Filesize
6.3MB

Download
memory/1268-57-0x0000000070940000-0x000000007095C000-memory.dmp

Filesize
112KB

Download
memory/1268-59-0x000000006C8C0000-0x000000006C8FF000-memory.dmp

Filesize
252KB

Download
memory/1268-85-0x0000000061740000-0x0000000061771000-memory.dmp

Filesize
196KB

Download
memory/1268-86-0x000000006C8C0000-0x000000006C8FF000-memory.dmp

Filesize
252KB

Download
memory/1268-88-0x0000000063400000-0x0000000063415000-memory.dmp

Filesize
84KB

Download
memory/1268-87-0x00000000002C0000-0x00000000002D8000-memory.dmp

Filesize
96KB

Download
memory/1268-89-0x0000000069700000-0x0000000069894000-memory.dmp

Filesize
1.6MB

Download
memory/1268-90-0x0000000000B40000-0x0000000001184000-memory.dmp

Filesize
6.3MB

Download
memory/1268-91-0x0000000066C00000-0x0000000066C3E000-memory.dmp

Filesize
248KB

Download
memory/1268-92-0x000000006A880000-0x000000006A9F6000-memory.dmp

Filesize
1.5MB

Download
memory/1268-93-0x000000006E600000-0x000000006E674000-memory.dmp

Filesize
464KB

Download
memory/1268-94-0x0000000004E10000-0x0000000005022000-memory.dmp

Filesize
2.1MB

Download
memory/1268-82-0x000000006FC40000-0x000000006FD41000-memory.dmp

Filesize
1.0MB

Download