f3969e0733a89f9d93925c8a4822deea9aac3e444da6bdc2a037cbd252aa1e82 | Triage

Submit
Reports

Overview

overview

Static

static

1

Minecraft Install.rar

windows10-1703-x64

Minecraft Install.rar

windows10-2004-x64

3

Resubmissions

18-04-2024 14:42

240418-r22bhsha9t 3

18-04-2024 14:11

240418-rhr9hagd6y 10

Sharing

General

Target

Minecraft Install.rar
Size

37.7MB
Sample

240418-rhr9hagd6y
MD5

489fb7829272e34697126dd5a10b7785
SHA1

5c0e5c43dc60f1db9a226cbd7b23e2fa649e767f
SHA256

f3969e0733a89f9d93925c8a4822deea9aac3e444da6bdc2a037cbd252aa1e82
SHA512

ce23cfed553c68ddac12ff12e16d78e4f0ebbd0df72640183c1afd80f863734d030304aec79711af529cea3028fd151efddb613b6ddeb614af6ad35e0c5e6c0b
SSDEEP

786432:/NuRVXyA1t6MF2Ll8HQgfYujJw+yKzfIu0qRcYHbvu+5ngAtYntgEHI+oBy5:Q9yA1tR+ewgRtRJwHiHSHAeWEMY

Score

10^/10

evasion persistence pyinstaller ransomware trojan

Static task

static1

Behavioral task

behavioral1

Sample

Minecraft Install.rar

Resource

win10-20240404-en

evasion persistence pyinstaller ransomware trojan

windows10-1703-x64

26 signatures

150 seconds

Behavioral task

behavioral2

Sample

Minecraft Install.rar

Resource

win10v2004-20240412-en

windows10-2004-x64

3 signatures

150 seconds

Malware Config

Targets

- Target
  
  Minecraft Install.rar
- Size
  
  37.7MB
- MD5
  
  489fb7829272e34697126dd5a10b7785
- SHA1
  
  5c0e5c43dc60f1db9a226cbd7b23e2fa649e767f
- SHA256
  
  f3969e0733a89f9d93925c8a4822deea9aac3e444da6bdc2a037cbd252aa1e82
- SHA512
  
  ce23cfed553c68ddac12ff12e16d78e4f0ebbd0df72640183c1afd80f863734d030304aec79711af529cea3028fd151efddb613b6ddeb614af6ad35e0c5e6c0b
- SSDEEP
  
  786432:/NuRVXyA1t6MF2Ll8HQgfYujJw+yKzfIu0qRcYHbvu+5ngAtYntgEHI+oBy5:Q9yA1tR+ewgRtRJwHiHSHAeWEMY
Score

10^/10

evasion persistence pyinstaller ransomware trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Modifies firewall policy service
  evasion
- Disables RegEdit via registry modification
  evasion
- Modifies Windows Firewall
  evasion
- Stops running service(s)
  evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Change Default File Association

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Change Default File Association

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Service Stop

Tasks

static1

behavioral1

evasionpersistencepyinstallerransomwaretrojan

behavioral2

© 2018-2025

Terms | Privacy