Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
14-07-2023 17:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
LauncherFenix-Minecraft-v7.exe
Resource
win7-20230712-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
LauncherFenix-Minecraft-v7.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
5 signatures
300 seconds
General
-
Target
LauncherFenix-Minecraft-v7.exe
-
Size
397KB
-
MD5
d99bb55b57712065bc88be297c1da38c
-
SHA1
fb6662dd31e8e5be380fbd7a33a50a45953fe1e7
-
SHA256
122bfbb9f67e355340991deeacb167be9c12ad726b5a7c5779448dd0cc4af0cb
-
SHA512
3eb5d57faea4c0146c2af40102deaac18235b379f5e81fe35a977b642e3edf70704c8cedd835e94f27b04c8413968f7469fccf82c1c9339066d38d3387c71b17
-
SSDEEP
3072:puzvch1rugYc4wqYSRR756K7ItBjgXHUYCnlK:Wch1aIqYSRVM+unlK
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2864 taskmgr.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe -
Suspicious use of SendNotifyMessage 39 IoCs
pid Process 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe 2864 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1732 javaw.exe 1732 javaw.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2188 wrote to memory of 1732 2188 LauncherFenix-Minecraft-v7.exe 30 PID 2188 wrote to memory of 1732 2188 LauncherFenix-Minecraft-v7.exe 30 PID 2188 wrote to memory of 1732 2188 LauncherFenix-Minecraft-v7.exe 30 PID 2188 wrote to memory of 1732 2188 LauncherFenix-Minecraft-v7.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe"C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:1732
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2864