Overview
overview
7Static
static
3jdMinecraf...er.exe
windows7-x64
7jdMinecraf...er.exe
windows10-2004-x64
7PyQt6/Qt6/...in.dll
windows7-x64
1PyQt6/Qt6/...in.dll
windows10-2004-x64
1PyQt6/Qt6/...in.dll
windows7-x64
1PyQt6/Qt6/...in.dll
windows10-2004-x64
1PyQt6/Qt6/...ate.js
windows7-x64
1PyQt6/Qt6/...ate.js
windows10-2004-x64
1PyQt6/Qt6/...in.dll
windows7-x64
1PyQt6/Qt6/...in.dll
windows10-2004-x64
1PyQt6/Qt6/...in.dll
windows7-x64
1PyQt6/Qt6/...in.dll
windows10-2004-x64
1PyQt6/Qt6/...in.dll
windows7-x64
1PyQt6/Qt6/...in.dll
windows10-2004-x64
1PyQt6/Qt6/...in.dll
windows7-x64
1PyQt6/Qt6/...in.dll
windows10-2004-x64
1PyQt6/Qt6/...ate.js
windows7-x64
1PyQt6/Qt6/...ate.js
windows10-2004-x64
1PyQt6/Qt6/...low.js
windows7-x64
1PyQt6/Qt6/...low.js
windows10-2004-x64
1PyQt6/Qt6/...in.dll
windows7-x64
1PyQt6/Qt6/...in.dll
windows10-2004-x64
1PyQt6/Qt6/...in.dll
windows7-x64
1PyQt6/Qt6/...in.dll
windows10-2004-x64
1PyQt6/Qt6/...in.dll
windows7-x64
1PyQt6/Qt6/...in.dll
windows10-2004-x64
1PyQt6/Qt6/...in.dll
windows7-x64
1PyQt6/Qt6/...in.dll
windows10-2004-x64
1PyQt6/Qt6/...in.dll
windows7-x64
1PyQt6/Qt6/...in.dll
windows10-2004-x64
1PyQt6/Qt6/...in.dll
windows7-x64
1PyQt6/Qt6/...in.dll
windows10-2004-x64
1Analysis
- max time kernel
120s - max time network
141s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system - submitted
21/02/2024, 12:25
Behavioral task
behavioral1
Sample
jdMinecraftLauncher-5.2-WindowsInstaller.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
jdMinecraftLauncher-5.2-WindowsInstaller.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Basic/impl/qtquickcontrols2basicstyleimplplugin.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Basic/impl/qtquickcontrols2basicstyleimplplugin.dll
Resource
win10v2004-20240220-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Basic/qtquickcontrols2basicstyleplugin.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Basic/qtquickcontrols2basicstyleplugin.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Fusion/TreeViewDelegate.js
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral8
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Fusion/TreeViewDelegate.js
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Fusion/impl/qtquickcontrols2fusionstyleimplplugin.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral10
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Fusion/impl/qtquickcontrols2fusionstyleimplplugin.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Fusion/qtquickcontrols2fusionstyleplugin.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral12
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Fusion/qtquickcontrols2fusionstyleplugin.dll
Resource
win10v2004-20240220-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Imagine/impl/qtquickcontrols2imaginestyleimplplugin.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral14
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Imagine/impl/qtquickcontrols2imaginestyleimplplugin.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Imagine/qtquickcontrols2imaginestyleplugin.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral16
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Imagine/qtquickcontrols2imaginestyleplugin.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Material/TreeViewDelegate.js
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral18
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Material/TreeViewDelegate.js
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Material/impl/RectangularGlow.js
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral20
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Material/impl/RectangularGlow.js
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Material/impl/qtquickcontrols2materialstyleimplplugin.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral22
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Material/impl/qtquickcontrols2materialstyleimplplugin.dll
Resource
win10v2004-20240220-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Material/qtquickcontrols2materialstyleplugin.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral24
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Material/qtquickcontrols2materialstyleplugin.dll
Resource
win10v2004-20240220-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Universal/impl/qtquickcontrols2universalstyleimplplugin.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral26
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Universal/impl/qtquickcontrols2universalstyleimplplugin.dll
Resource
win10v2004-20240220-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Universal/qtquickcontrols2universalstyleplugin.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral28
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Universal/qtquickcontrols2universalstyleplugin.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Windows/qtquickcontrols2windowsstyleplugin.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral30
Sample
PyQt6/Qt6/qml/QtQuick/Controls/Windows/qtquickcontrols2windowsstyleplugin.dll
Resource
win10v2004-20240221-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
PyQt6/Qt6/qml/QtQuick/Controls/qtquickcontrols2plugin.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral32
Sample
PyQt6/Qt6/qml/QtQuick/Controls/qtquickcontrols2plugin.dll
Resource
win10v2004-20240220-en
windows10-2004-x64
General
- Target jdMinecraftLauncher-5.2-WindowsInstaller.exe
- Size 97.2MB
- Sample240221-plqtqsfa81
- SHA256 53eca4e7e09796a9c547e9aaaa9b4718bed3d61675197e377b2adba0c36729d9
- MD5 6a21aceb285fd0e970afa82da8713ee1
- SHA1 cdc0372b26b528c61616b37cf646570659349728
- SHA512 3c8a8778d29958c3b0a1e3c03d412c0676e74dab39431a9dc85377b92696d754742ef7bef7f4bbdfcf2c9eeecca6f37e72c7e867dbc953110e3e63207304f1f3
- SSDEEP 3145728:IHkUT0kh2xnZ+yi/q8GI6T1MwmVR21UqljpoQan:UFT0m2a/qbgwmVLMoQan
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2556 jdMinecraftLauncher.exe 1324 Process not Found - Loads dropped DLL 7 IoCs
pid Process 2380 jdMinecraftLauncher-5.2-WindowsInstaller.exe 2380 jdMinecraftLauncher-5.2-WindowsInstaller.exe 2380 jdMinecraftLauncher-5.2-WindowsInstaller.exe 2380 jdMinecraftLauncher-5.2-WindowsInstaller.exe 2556 jdMinecraftLauncher.exe 1324 Process not Found 1324 Process not Found - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Basic\Button.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\designer\SwipeViewSpecifics.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\designer\images\cube16.png jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Basic\SwipeDelegate.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Material\Frame.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\_queue.pyd jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\QtWidgets.pyd jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\designer\images\textarea-icon.png jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\designer\images\toolbar-icon.png jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\Effects\designer\MotionBlurSpecifics.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\Particles3D\designer\images\[email protected] jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\translations\qtwebengine_locales\ru.pak jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\bin\Qt6DBus.dll jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\translations\qt_hr.qm jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Material\SwitchDelegate.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\Physics\designer\PlaneShapeSpecifics.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\designer\images\[email protected] jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\Particles3D\designer\TrailEmitter3DSection.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\Physics\designer\images\staticrigidbody16.png jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Material\ScrollIndicator.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\Particles3D\designer\images\emitter-16px.png jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\translations\qtwebengine_locales\pt-PT.pak jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Fusion\TextArea.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\MaterialEditor\PreviewControls.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\translations\qtwebengine_locales\el.pak jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\designer\images\groupbox-icon16.png jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\Effects\designer\BrushStrokesSpecifics.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\Effects\designer\DepthOfFieldHQBlurSection.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\translations\qtdeclarative_ru.qm jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Imagine\ProgressBar.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\designer\images\loader3d.png jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\translations\qtwebengine_locales\sk.pak jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Imagine\CheckBox.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Dialogs\quickimpl\qmldir jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\ParticleEffects\designer\images\color_table.png jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\Particles3D\designer\images\[email protected] jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\Particles3D\designer\source\particlesystem_particletrail_template.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\Physics\designer\images\[email protected] jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Material\DialogButtonBox.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Universal\ScrollView.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\Effects\TiltShift.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\designer\DefaultMaterialSpecifics.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Fusion\ToolButton.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\tooling\qmldir jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\Helpers\designer\images\proceduralskytexturedata16.png jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\Particles3D\designer\images\particle-shape-16px.png jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\designer\images\cone.png jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\designer\images\[email protected] jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Imagine\RoundButton.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\Helpers\designer\images\instancemodel16.png jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\Particles3D\designer\LineParticle3DSpecifics.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\jdMinecraftLauncher\translations\jdMinecraftLauncher_de.qm jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Fusion\Drawer.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Fusion\RadioDelegate.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Material\RangeSlider.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Particles\plugins.qmltypes jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\Particles3D\designer\images\[email protected] jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\translations\qtdeclarative_tr.qm jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Imagine\ToolButton.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\Effects\DepthOfFieldHQBlur.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\Helpers\designer\images\heightfieldgeometry16.png jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Fusion\SelectionRectangle.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Material\MenuBar.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe File created C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Universal\VerticalHeaderView.qml jdMinecraftLauncher-5.2-WindowsInstaller.exe - Detects Pyinstaller 1 IoCs
resource yara_rule behavioral1/files/0x0006000000017550-3246.dat pyinstaller - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jdMinecraftLauncher\shell\open jdMinecraftLauncher-5.2-WindowsInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jdMinecraftLauncher\shell\open\command jdMinecraftLauncher-5.2-WindowsInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jdMinecraftLauncher\shell\open\command\ = "\"C:\\Program Files\\jdMinecraftLauncher\\jdMinecraftLauncher.exe\" \"%1\"" jdMinecraftLauncher-5.2-WindowsInstaller.exe Key created \REGISTRY\MACHINE\Software\Classes\jdMinecraftLauncher jdMinecraftLauncher-5.2-WindowsInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jdMinecraftLauncher\URL Protocol jdMinecraftLauncher-5.2-WindowsInstaller.exe Key created \REGISTRY\MACHINE\Software\Classes\jdMinecraftLauncher\shell\open\command jdMinecraftLauncher-5.2-WindowsInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jdMinecraftLauncher jdMinecraftLauncher-5.2-WindowsInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jdMinecraftLauncher\shell jdMinecraftLauncher-5.2-WindowsInstaller.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2380 jdMinecraftLauncher-5.2-WindowsInstaller.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2556 2380 jdMinecraftLauncher-5.2-WindowsInstaller.exe 30 PID 2380 wrote to memory of 2556 2380 jdMinecraftLauncher-5.2-WindowsInstaller.exe 30 PID 2380 wrote to memory of 2556 2380 jdMinecraftLauncher-5.2-WindowsInstaller.exe 30 PID 2380 wrote to memory of 2556 2380 jdMinecraftLauncher-5.2-WindowsInstaller.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\jdMinecraftLauncher-5.2-WindowsInstaller.exe"C:\Users\Admin\AppData\Local\Temp\jdMinecraftLauncher-5.2-WindowsInstaller.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Program Files\jdMinecraftLauncher\jdMinecraftLauncher.exe"C:\Program Files\jdMinecraftLauncher\jdMinecraftLauncher.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\designer\images\dummy.png
- Size 375B
- SHA256 fbc370c541a931e22eeba5157b47f30fc60c7e29580b9b4904703b6e17910bf3
- MD5 762ab24b219270dc7ee7183da2f1ef79
- SHA1 de4b6ccb4d5b6743903e91915d8ff00e52f1336a
- SHA512 c11bae321fe32044d8c7f05590bf30f15585283c0a95ea2a2eac63e3e493bd3386354de050df13b554b197cceebe03069b523286fd3297d16cc0a27072cdc031
- MD5 SHA1 SHA512
- Path C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\designer\images\dummy16.png
- Size 253B
- SHA256 20367abdb3621f0bbbe473dc2c16708318303c600356dd3a53c9465c8a694e22
- MD5 bbff95cfc3d26e011d4cd5b6a978625b
- SHA1 6e2c4e01dcc78e1210ec39a236ccb4388a71cd5f
- SHA512 7378c69a5c23a36226c9f82aa2ef7cb693868425989a1baced24b73830917e354949af640b7b5aef82124902275debfba1d8fd46a2767c71189dfc935bcfc738
- MD5 SHA1 SHA512
- Path C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick3D\designer\images\[email protected]
- Size 499B
- SHA256 ac0ced9846290510f32ffb115d29e5329442fec01b6527a863ebf541ca8c8ed5
- MD5 73dd25fb185b415c0590f122bf05cf7b
- SHA1 0d268a5bfeaacb8744a9b372409caeb6f1039653
- SHA512 7c3d69594d8d73414f3ea35443a7417fe75fed45a0ac6d07f29bebccc119375d6c50a7ca78fc0a349304ce21f71847098e7c83ba9a8b624729ca6bc4e986faad
- MD5 SHA1 SHA512
- Path C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\Material\ScrollView.qml
- Size 1KB
- SHA256 78b5fc58e6d881d16351e92d32b8cadea6b14fbf8c20c1bc7e56d02946467ae8
- MD5 63340c8fcb71734ce4bbac29a86821b5
- SHA1 0cfd02b3e95fa482cbd4bd83b0f2d9214acc9709
- SHA512 fe035bb77a32d0fe9d4983d90c65d4c2600a019ac20743dbec409f29ffbfbecd8bca2d15abfffb2e71b77e3c105e248627a176942cdf9d7b98ed9113e6f73ba0
- MD5 SHA1 SHA512
- Path C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\designer\RadioDelegateSpecifics.qml
- Size 559B
- SHA256 f8d2bf5bc61e2575380c2be7e6516bc0426200025ba333c744d1f212108ffe4f
- MD5 268ca4343417ef1bbec6111772662306
- SHA1 5180059a57f944bdcd2d55639289ac14bcfc2ba4
- SHA512 c83bbb2807a98255dc3388c4b531c25d4984c77deb71f964f963ad84651fdf52f1ac1213318bf1476da3fc575b86607692657df739ff5218d661b02cab3cc63a
- MD5 SHA1 SHA512
- Path C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\Controls\designer\SwitchSpecifics.qml
- Size 494B
- SHA256 f09e9acf39237df1404d0bdb520ef0df2d35d9586f519e91416b9c02228252ed
- MD5 6fd2055c93332727a0f0a80fbd0a6c9a
- SHA1 099d4cf01e806280f72afd8e2f2502ae256a82d2
- SHA512 c839ae74896cb6c0edcaabfd5319bc9af22db94204ab6a025a1488aeb3b0326152e5fc96c3950dc9cda6a493089a4154b188944ca4b367b27fcaaabadcbc14ee
- MD5 SHA1 SHA512
- Path C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\qml\QtQuick\tooling\quicktooling.qmltypes
- Size 215B
- SHA256 a96c7bf5832767bdc9d91e2290a3920aec3abfbf2e3814bce38b49483f16f84a
- MD5 2006d4b7d0da455aa4c7414653c0018a
- SHA1 6685b8360b97799aa4d6b18789bf84a343e9e891
- SHA512 703804e6fab0cf44317b7292c547a1348e2e7395e4b71367c32c3b097bcfb3344d3296179bf4ba33a4c752ae58a3873af57d8cdef35a34564205356bb4e6fd84
- MD5 SHA1 SHA512
- Path C:\Program Files\jdMinecraftLauncher\PyQt6\Qt6\translations\qtlocation_en.qm
- Size 16B
- SHA256 9959b510b15d18937848ad13007e30459d2e993c67e564badbfc18f935695c85
- MD5 bcebcf42735c6849bdecbb77451021dd
- SHA1 4884fd9af6890647b7af1aefa57f38cca49ad899
- SHA512 f951b511ffb1a6b94b1bcae9df26b41b2ff829560583d7c83e70279d1b5304bde299b3679d863cad6bb79d0beda524fc195b7f054ecf11d2090037526b451b78
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nso5A14.tmp\modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files\jdMinecraftLauncher\jdMinecraftLauncher.exe
- Size 2.3MB
- SHA256 135bad4ca1e8c46ae6920c74569e09248824e9a4ba9e3aacadbb9055013e126e
- MD5 43dd6ee3ce32f058cffdbba13fc99aee
- SHA1 c2582cd447fcfca628b77deb202f3d52c256f97f
- SHA512 d84cc0ce027353d7b01686de221d1870753518f2dac6df4c0965d02e04c6a36b5133a9f3374f5a764931312be9147ca1e6f791e16745d668557c42983698c282
- SSDEEP 49152:nfGfj7z9FJRSvwpcJ1YrPdpq17NXRfcl9DCLrNwrKeOM05Ug:+fRZSopcJ1YPy1hRcBCvSmUTg
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files\jdMinecraftLauncher\python311.dll
- Size 5.5MB
- SHA256 0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae
- MD5 1fe47c83669491bf38a949253d7d960f
- SHA1 de5cc181c0e26cbcb31309fe00d9f2f5264d2b25
- SHA512 05cc6f00db128fbca02a14f60f86c049855f429013f65d91e14ea292d468bf9bfdeebc00ec2d54a9fb5715743a57ae3ab48a95037016240c02aabe4bfa1a2ff4
- SSDEEP 98304:ZjCxzAISyt+EaudO141ibXHkMLyP59mJ3:ZjCxzAISXElO13L09
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nso5A14.tmp\System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nso5A14.tmp\UserInfo.dll
- Size 4KB
- SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
- MD5 2f69afa9d17a5245ec9b5bb03d56f63c
- SHA1 e0a133222136b3d4783e965513a690c23826aec9
- SHA512 bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\nso5A14.tmp\nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- MD5 SHA1 SHA512 SSDEEP