e7b3db67c5b22fb6175be7299d1ad622d6183210d212ca3ce464292b627400f1

General

Target

LauncherFenix-Minecraft-v7.jar
Size

65KB
MD5

fea39379db50e2a8feee8bac75ab769d
SHA1

1b1df2b43088ddff1394d50d515901570ab18f40
SHA256

e7b3db67c5b22fb6175be7299d1ad622d6183210d212ca3ce464292b627400f1
SHA512

25487310a04b60b561d013b01e7d595e545e1da3b352e046774b95a54f2877ffad2b64d961dc8ed99532dc8c83719f0e281cf0540cf25e4b0708d2c5d64c7c79
SSDEEP

1536:paoqO4pFE7IxmtlSBszOg+0HUad8vr7lK:p56K7ItBjgXHUYCnlK

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb	java.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "1"	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1420546310-613437930-2990200354-1000\{56811DED-7F54-48D5-9CE1-BBCDE8503E2B}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1420546310-613437930-2990200354-1000\{EB116D1B-F45B-4E17-B504-B28FA5364B6E}	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1348	OpenWith.exe
2068	java.exe
2068	java.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2068

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:2780

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Modifies registry class
PID:4776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
- Modifies data under HKEY_USERS
PID:4632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Modifies registry class
PID:4404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
memory/2068-222-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2068-257-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2068-151-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2068-157-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2068-158-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2068-161-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2068-162-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2068-168-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2068-181-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2068-186-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2068-145-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2068-227-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2068-147-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2068-217-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2068-195-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2068-226-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2068-230-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2068-232-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2068-234-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2068-235-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2068-238-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2068-241-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2068-245-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2068-256-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2068-137-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2068-258-0x0000000001610000-0x0000000001611000-memory.dmp

Filesize
4KB

Download
memory/2068-277-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing