Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19/03/2024, 19:36

General

  • Target

    MinecraftInstaller.exe

  • Size

    32.3MB

  • MD5

    cfd9316537bf9aebd4c98e4939085948

  • SHA1

    2b2e14d098308c0204ab57f4c6abfb230ae19762

  • SHA256

    9c00e8dd5a6c9a8d22a4ae2e5a8bdeecf73b7ba6dbe12e787e5e8bf9bbb0c1c9

  • SHA512

    cb9fd36106b915811bcfaaa4359ac2cdd8caad562f4954b9cc21b09b60111c0fb3d2ce06714d0de5339ca7fd62cc658c494b873f4a7062e309746e6a92552975

  • SSDEEP

    393216:kbekuyo9nMK50UGRXLePuq2ZWy/c5zFviMKe2OHmwv9CsTmsueFFza9y5:/Zn/G4Gqk1cWe2iTVCMue3X

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe
      "C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe" scenarioMinecraft
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      PID:760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe

    Filesize

    573KB

    MD5

    0d05a797214e62f36e15d2149e6f4005

    SHA1

    bf634ecf71e833be051672aebb5367392fee44b2

    SHA256

    2dea72909788e997892e7219f859b3361910291eb3feb156dafa8b1ceee20c86

    SHA512

    3b5f3bcb1c54c010bcc9e19a5cbec06061fede5a2a56a730fbf920214af02bdec2c2d602bb51a800c543c011368c4eecbc5aa50fd494e719925d2a80a91283b3

  • memory/2520-5-0x00000000085C0000-0x00000000085C8000-memory.dmp

    Filesize

    32KB

  • memory/2520-13-0x000000000D180000-0x000000000D18A000-memory.dmp

    Filesize

    40KB

  • memory/2520-3-0x0000000007800000-0x00000000079C2000-memory.dmp

    Filesize

    1.8MB

  • memory/2520-0-0x0000000074640000-0x0000000074DF1000-memory.dmp

    Filesize

    7.7MB

  • memory/2520-6-0x00000000076F0000-0x0000000007700000-memory.dmp

    Filesize

    64KB

  • memory/2520-8-0x00000000076F0000-0x0000000007700000-memory.dmp

    Filesize

    64KB

  • memory/2520-2-0x00000000076F0000-0x0000000007700000-memory.dmp

    Filesize

    64KB

  • memory/2520-9-0x000000000B2B0000-0x000000000B2B8000-memory.dmp

    Filesize

    32KB

  • memory/2520-11-0x000000000B810000-0x000000000B81E000-memory.dmp

    Filesize

    56KB

  • memory/2520-10-0x000000000B850000-0x000000000B888000-memory.dmp

    Filesize

    224KB

  • memory/2520-14-0x000000000D210000-0x000000000D236000-memory.dmp

    Filesize

    152KB

  • memory/2520-1-0x0000000000950000-0x00000000029AA000-memory.dmp

    Filesize

    32.4MB

  • memory/2520-27-0x0000000074640000-0x0000000074DF1000-memory.dmp

    Filesize

    7.7MB

  • memory/2520-28-0x00000000076F0000-0x0000000007700000-memory.dmp

    Filesize

    64KB

  • memory/2520-29-0x00000000076F0000-0x0000000007700000-memory.dmp

    Filesize

    64KB

  • memory/2520-30-0x00000000076F0000-0x0000000007700000-memory.dmp

    Filesize

    64KB