Overview
overview
3Static
static
1LuckyBlock...4].zip
windows7-x64
1LuckyBlock...4].zip
windows10-2004-x64
1manifest.json
windows7-x64
3manifest.json
windows10-2004-x64
3modlist.html
windows7-x64
1modlist.html
windows10-2004-x64
1overrides/...n.toml
windows7-x64
3overrides/...n.toml
windows10-2004-x64
3overrides/...t.toml
windows7-x64
3overrides/...t.toml
windows10-2004-x64
3overrides/...s.json
windows7-x64
3overrides/...s.json
windows10-2004-x64
3overrides/...t.toml
windows7-x64
3overrides/...t.toml
windows10-2004-x64
3overrides/...n.toml
windows7-x64
3overrides/...n.toml
windows10-2004-x64
3overrides/...r.toml
windows7-x64
3overrides/...r.toml
windows10-2004-x64
3overrides/...ck.zip
windows7-x64
1overrides/...ck.zip
windows10-2004-x64
1overrides/...s.json
windows7-x64
3overrides/...s.json
windows10-2004-x64
3overrides/...s.json
windows7-x64
3overrides/...s.json
windows10-2004-x64
3overrides/...s.json
windows7-x64
3overrides/...s.json
windows10-2004-x64
3overrides/...t.toml
windows7-x64
3overrides/...t.toml
windows10-2004-x64
3overrides/...n.toml
windows7-x64
3overrides/...n.toml
windows10-2004-x64
3overrides/...t.toml
windows7-x64
3overrides/...t.toml
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02-02-2024 00:30
Static task
static1
Behavioral task
behavioral1
Sample
LuckyBlockChallenge-(FORGE)-[1.0.4].zip
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
LuckyBlockChallenge-(FORGE)-[1.0.4].zip
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
manifest.json
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
manifest.json
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
modlist.html
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
modlist.html
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
overrides/config/appletreesrev-common.toml
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
overrides/config/appletreesrev-common.toml
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
overrides/config/bhmenu-client.toml
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
overrides/config/bhmenu-client.toml
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
overrides/config/biomesoplenty/biomes.json
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
overrides/config/biomesoplenty/biomes.json
Resource
win10v2004-20231222-en
Behavioral task
behavioral13
Sample
overrides/config/biomesoplenty/client.toml
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
overrides/config/biomesoplenty/client.toml
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
overrides/config/biomesoplenty/generation.toml
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
overrides/config/biomesoplenty/generation.toml
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
overrides/config/chancecubes/chancecubes-server.toml
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
overrides/config/chancecubes/chancecubes-server.toml
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
overrides/config/chancecubes/custom_rewards/CustomSounds-Resourcepack.zip
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
overrides/config/chancecubes/custom_rewards/CustomSounds-Resourcepack.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
overrides/config/chancecubes/custom_rewards/sounds/sounds.json
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
overrides/config/chancecubes/custom_rewards/sounds/sounds.json
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
overrides/config/chancecubes/global_rewards.json
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
overrides/config/chancecubes/global_rewards.json
Resource
win10v2004-20231222-en
Behavioral task
behavioral25
Sample
overrides/config/chancecubes/reward_settings.json
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
overrides/config/chancecubes/reward_settings.json
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
overrides/config/chaosawakens-client.toml
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
overrides/config/chaosawakens-client.toml
Resource
win10v2004-20231222-en
Behavioral task
behavioral29
Sample
overrides/config/chaosawakens-common.toml
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
overrides/config/chaosawakens-common.toml
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
overrides/config/configured-client.toml
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
overrides/config/configured-client.toml
Resource
win10v2004-20231215-en
General
-
Target
overrides/config/bhmenu-client.toml
-
Size
2KB
-
MD5
023b12c3290ac0f55bb9ae5f67b2cab7
-
SHA1
421a6b53b53dc70287ef8b635013b7f475688429
-
SHA256
326d12c4ed83dbf385013c7925f3abe4bfcc127f80137d41ec5be27dda0f073b
-
SHA512
7676ed178102872401d06738f4b01f0ab5940aaf700ea2a077ce15bf1be0f695294728a1b52f6cac773e6d8f410b5a5bc06582a6c3096d7c067932da65ce4e42
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\toml_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.toml\ = "toml_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\toml_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\toml_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\toml_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\toml_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.toml rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\toml_auto_file\shell\Read rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 576 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 576 AcroRd32.exe 576 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1384 wrote to memory of 324 1384 cmd.exe rundll32.exe PID 1384 wrote to memory of 324 1384 cmd.exe rundll32.exe PID 1384 wrote to memory of 324 1384 cmd.exe rundll32.exe PID 324 wrote to memory of 576 324 rundll32.exe AcroRd32.exe PID 324 wrote to memory of 576 324 rundll32.exe AcroRd32.exe PID 324 wrote to memory of 576 324 rundll32.exe AcroRd32.exe PID 324 wrote to memory of 576 324 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\overrides\config\bhmenu-client.toml1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\overrides\config\bhmenu-client.toml2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\overrides\config\bhmenu-client.toml"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD558829e8702bb47d6b6221736cd3749ad
SHA12b84a1b1ed0974a921779509ec0d3d28d546f1d1
SHA256d6ac8247309a7209050e165ffe14b9515b5a30cf6f6dea75b466c603cd58fa4c
SHA5120a6b52eba610f41c653e18e9e917d35661e624237ab94555e4d2ce96f4701bc4e6a67f29ec9625ec4ea225ebb4508eb2e31e79fd3335541a2926a9f1480cedc8