Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
19/03/2024, 19:36
Static task
static1
Behavioral task
behavioral1
Sample
MinecraftInstaller.exe
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
MinecraftInstaller.exe
Resource
win11-20240221-en
General
-
Target
MinecraftInstaller.exe
-
Size
32.3MB
-
MD5
cfd9316537bf9aebd4c98e4939085948
-
SHA1
2b2e14d098308c0204ab57f4c6abfb230ae19762
-
SHA256
9c00e8dd5a6c9a8d22a4ae2e5a8bdeecf73b7ba6dbe12e787e5e8bf9bbb0c1c9
-
SHA512
cb9fd36106b915811bcfaaa4359ac2cdd8caad562f4954b9cc21b09b60111c0fb3d2ce06714d0de5339ca7fd62cc658c494b873f4a7062e309746e6a92552975
-
SSDEEP
393216:kbekuyo9nMK50UGRXLePuq2ZWy/c5zFviMKe2OHmwv9CsTmsueFFza9y5:/Zn/G4Gqk1cWe2iTVCMue3X
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 760 GamingRepair.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GamingRepair.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GamingRepair.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2520 MinecraftInstaller.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2520 wrote to memory of 760 2520 MinecraftInstaller.exe 82 PID 2520 wrote to memory of 760 2520 MinecraftInstaller.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe"C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe" scenarioMinecraft2⤵
- Executes dropped EXE
- Checks processor information in registry
PID:760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
573KB
MD50d05a797214e62f36e15d2149e6f4005
SHA1bf634ecf71e833be051672aebb5367392fee44b2
SHA2562dea72909788e997892e7219f859b3361910291eb3feb156dafa8b1ceee20c86
SHA5123b5f3bcb1c54c010bcc9e19a5cbec06061fede5a2a56a730fbf920214af02bdec2c2d602bb51a800c543c011368c4eecbc5aa50fd494e719925d2a80a91283b3