Overview
overview
3Static
static
1LuckyBlock...4].zip
windows7-x64
1LuckyBlock...4].zip
windows10-2004-x64
1manifest.json
windows7-x64
3manifest.json
windows10-2004-x64
3modlist.html
windows7-x64
1modlist.html
windows10-2004-x64
1overrides/...n.toml
windows7-x64
3overrides/...n.toml
windows10-2004-x64
3overrides/...t.toml
windows7-x64
3overrides/...t.toml
windows10-2004-x64
3overrides/...s.json
windows7-x64
3overrides/...s.json
windows10-2004-x64
3overrides/...t.toml
windows7-x64
3overrides/...t.toml
windows10-2004-x64
3overrides/...n.toml
windows7-x64
3overrides/...n.toml
windows10-2004-x64
3overrides/...r.toml
windows7-x64
3overrides/...r.toml
windows10-2004-x64
3overrides/...ck.zip
windows7-x64
1overrides/...ck.zip
windows10-2004-x64
1overrides/...s.json
windows7-x64
3overrides/...s.json
windows10-2004-x64
3overrides/...s.json
windows7-x64
3overrides/...s.json
windows10-2004-x64
3overrides/...s.json
windows7-x64
3overrides/...s.json
windows10-2004-x64
3overrides/...t.toml
windows7-x64
3overrides/...t.toml
windows10-2004-x64
3overrides/...n.toml
windows7-x64
3overrides/...n.toml
windows10-2004-x64
3overrides/...t.toml
windows7-x64
3overrides/...t.toml
windows10-2004-x64
3Analysis
-
max time kernel
129s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02-02-2024 00:30
Static task
static1
Behavioral task
behavioral1
Sample
LuckyBlockChallenge-(FORGE)-[1.0.4].zip
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
LuckyBlockChallenge-(FORGE)-[1.0.4].zip
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
manifest.json
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
manifest.json
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
modlist.html
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
modlist.html
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
overrides/config/appletreesrev-common.toml
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
overrides/config/appletreesrev-common.toml
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
overrides/config/bhmenu-client.toml
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
overrides/config/bhmenu-client.toml
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
overrides/config/biomesoplenty/biomes.json
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
overrides/config/biomesoplenty/biomes.json
Resource
win10v2004-20231222-en
Behavioral task
behavioral13
Sample
overrides/config/biomesoplenty/client.toml
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
overrides/config/biomesoplenty/client.toml
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
overrides/config/biomesoplenty/generation.toml
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
overrides/config/biomesoplenty/generation.toml
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
overrides/config/chancecubes/chancecubes-server.toml
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
overrides/config/chancecubes/chancecubes-server.toml
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
overrides/config/chancecubes/custom_rewards/CustomSounds-Resourcepack.zip
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
overrides/config/chancecubes/custom_rewards/CustomSounds-Resourcepack.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
overrides/config/chancecubes/custom_rewards/sounds/sounds.json
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
overrides/config/chancecubes/custom_rewards/sounds/sounds.json
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
overrides/config/chancecubes/global_rewards.json
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
overrides/config/chancecubes/global_rewards.json
Resource
win10v2004-20231222-en
Behavioral task
behavioral25
Sample
overrides/config/chancecubes/reward_settings.json
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
overrides/config/chancecubes/reward_settings.json
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
overrides/config/chaosawakens-client.toml
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
overrides/config/chaosawakens-client.toml
Resource
win10v2004-20231222-en
Behavioral task
behavioral29
Sample
overrides/config/chaosawakens-common.toml
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
overrides/config/chaosawakens-common.toml
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
overrides/config/configured-client.toml
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
overrides/config/configured-client.toml
Resource
win10v2004-20231215-en
General
-
Target
overrides/config/biomesoplenty/client.toml
-
Size
115B
-
MD5
5606d64f4f6e3d2d43b6ca68df7ae680
-
SHA1
3c9a9ed0e0b344e132737bffa869731b06afc123
-
SHA256
38fd5adb6d3817a74f41e21fd859b266f0d9a2ada8a3d7058b49b1cd5af82598
-
SHA512
81088bd2baab2033eb4a1c0a13dd9e033be116dc0c1519384c51b3621547019d5160c5abdd33d281e1f439b7c41a7bb50ea28dffcf77bd92fdfb1f721457490e
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\toml_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\toml_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\toml_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.toml\ = "toml_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\toml_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.toml rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\toml_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\toml_auto_file\shell rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2704 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2704 AcroRd32.exe 2704 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2320 wrote to memory of 2060 2320 cmd.exe rundll32.exe PID 2320 wrote to memory of 2060 2320 cmd.exe rundll32.exe PID 2320 wrote to memory of 2060 2320 cmd.exe rundll32.exe PID 2060 wrote to memory of 2704 2060 rundll32.exe AcroRd32.exe PID 2060 wrote to memory of 2704 2060 rundll32.exe AcroRd32.exe PID 2060 wrote to memory of 2704 2060 rundll32.exe AcroRd32.exe PID 2060 wrote to memory of 2704 2060 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\overrides\config\biomesoplenty\client.toml1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\overrides\config\biomesoplenty\client.toml2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\overrides\config\biomesoplenty\client.toml"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5a5fbf9febeac2cbc273ca6cddc54483b
SHA13b5a946153b912c3efe1e400f8eeadcc5f493ec8
SHA256c57e614594dabfae0561519e3c4fe5a19d8791099f5d5e832d3d935590f6fbe0
SHA512d19a3cdd973192000c8f007381165624dde636823feb25eda311e096ed1b18a2515a7ea3155f17455c1fffbcd9d72cec4875cfa2da96f916f921aee0932e6981