Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 20:49

General

  • Target

    Minecraft Launcher.exe

  • Size

    1.6MB

  • MD5

    689568710a8ab5c54dcba95acd2e3b53

  • SHA1

    9739db03da71e8b79b7cecaf8908975d37a26a73

  • SHA256

    28148908befb0382c4c3f629c1a5f9a4f93b09855968e444de78d95c6dad86a4

  • SHA512

    701871548f4dd7f3c00f601e0a4c3f9b9cbf28fc6b98a4adedc7f861dd253dbba3dfb91d2edd5d589944fde935c184d0049e4ea7c760feb8e218878d031bf056

  • SSDEEP

    49152:7NY/oae1UgHrnRAST8XrhaRY0T+nqO4P4dj:q/BWrn3T8hiVT+ne4dj

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Minecraft Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Minecraft Launcher.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5112
    • C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Xms256m -Xmx512m -jar "C:\Users\Admin\AppData\Local\Temp\Minecraft Launcher.exe"
      2⤵
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1400
      • C:\Windows\system32\icacls.exe
        C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
        3⤵
        • Modifies file permissions
        PID:1144

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

          Filesize

          46B

          MD5

          f32df0c4e54c588304997d449a783ffd

          SHA1

          f23155799d908e85f296868067ac556e715f8d28

          SHA256

          37941c33139ca3a299700de330f001e4f7aa49ecd5f1be90b417338ac683fbf1

          SHA512

          8efbc22b358b28cfc6b55440e7cbee1fd1c1a01f13b4b394e8305b29ab74bff4d9a52f7b8cf11378f438589fdecbfd2decfeab3b37e0c0587d8c750fb0f2b8cb

        • memory/1400-44-0x0000017307730000-0x0000017307740000-memory.dmp

          Filesize

          64KB

        • memory/1400-46-0x00000173076C0000-0x00000173076D0000-memory.dmp

          Filesize

          64KB

        • memory/1400-13-0x00000173073C0000-0x00000173073C1000-memory.dmp

          Filesize

          4KB

        • memory/1400-27-0x00000173073E0000-0x00000173083E0000-memory.dmp

          Filesize

          16.0MB

        • memory/1400-33-0x00000173073E0000-0x00000173083E0000-memory.dmp

          Filesize

          16.0MB

        • memory/1400-39-0x00000173073E0000-0x00000173083E0000-memory.dmp

          Filesize

          16.0MB

        • memory/1400-41-0x0000017307660000-0x0000017307670000-memory.dmp

          Filesize

          64KB

        • memory/1400-42-0x00000173076A0000-0x00000173076B0000-memory.dmp

          Filesize

          64KB

        • memory/1400-43-0x00000173076F0000-0x0000017307700000-memory.dmp

          Filesize

          64KB

        • memory/1400-55-0x00000173073E0000-0x00000173083E0000-memory.dmp

          Filesize

          16.0MB

        • memory/1400-3-0x00000173073E0000-0x00000173083E0000-memory.dmp

          Filesize

          16.0MB

        • memory/1400-47-0x00000173076D0000-0x00000173076E0000-memory.dmp

          Filesize

          64KB

        • memory/1400-45-0x0000017307690000-0x00000173076A0000-memory.dmp

          Filesize

          64KB

        • memory/1400-48-0x00000173076E0000-0x00000173076F0000-memory.dmp

          Filesize

          64KB

        • memory/1400-50-0x00000173073E0000-0x00000173083E0000-memory.dmp

          Filesize

          16.0MB

        • memory/1400-49-0x0000017307700000-0x0000017307710000-memory.dmp

          Filesize

          64KB

        • memory/1400-51-0x0000017307710000-0x0000017307720000-memory.dmp

          Filesize

          64KB

        • memory/1400-52-0x0000017307720000-0x0000017307730000-memory.dmp

          Filesize

          64KB

        • memory/1400-53-0x0000017307740000-0x0000017307750000-memory.dmp

          Filesize

          64KB

        • memory/1400-54-0x0000017307750000-0x0000017307760000-memory.dmp

          Filesize

          64KB

        • memory/5112-0-0x0000000000400000-0x0000000000416000-memory.dmp

          Filesize

          88KB