122bfbb9f67e355340991deeacb167be9c12ad726b5a7c5779448dd0cc4af0cb

Analysis

max time kernel
135s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LauncherFenix-Minecraft-v7.exe
Size

397KB
MD5

d99bb55b57712065bc88be297c1da38c
SHA1

fb6662dd31e8e5be380fbd7a33a50a45953fe1e7
SHA256

122bfbb9f67e355340991deeacb167be9c12ad726b5a7c5779448dd0cc4af0cb
SHA512

3eb5d57faea4c0146c2af40102deaac18235b379f5e81fe35a977b642e3edf70704c8cedd835e94f27b04c8413968f7469fccf82c1c9339066d38d3387c71b17
SSDEEP

3072:puzvch1rugYc4wqYSRR756K7ItBjgXHUYCnlK:Wch1aIqYSRVM+unlK

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4112 icacls.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

javaw.exeOpenWith.exe

pid process

3380 javaw.exe
3380 javaw.exe
4288 OpenWith.exe

pid	process
4112	icacls.exe

pid	process
3380	javaw.exe
3380	javaw.exe
4288	OpenWith.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

LauncherFenix-Minecraft-v7.exejavaw.exe

description	pid	process	target process
PID 3000 wrote to memory of 3380	3000	LauncherFenix-Minecraft-v7.exe	javaw.exe
PID 3000 wrote to memory of 3380	3000	LauncherFenix-Minecraft-v7.exe	javaw.exe
PID 3380 wrote to memory of 4112	3380	javaw.exe	icacls.exe
PID 3380 wrote to memory of 4112	3380	javaw.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe
"C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3000

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.exe"
2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
3⤵
- Modifies file permissions
PID:4112

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:1288

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1516,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=1044 /prefetch:8
1⤵
PID:1764

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
6530bd754313bf456b54ebc82d659883

SHA1
1a128e32375fd1b1f8414f587b9317af4f5fa4cb

SHA256
730929f75e178f93f5b54fe207eb8a969beda4d6cddacb4ed59099281d8e46bf

SHA512
746ddea9f3ff9e3c6fb216f106fcba1b9eb94722c4893b6fc59eb107e57ce9982fc490ca26122b3c7540979eaef68f7a06a3880fe21541554d14fb20c75f4446

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\launcherfenix.jar
Filesize
500KB

MD5
84591cf8bbe4b94d5a83b2cdd605d4b5

SHA1
85f1dbf03d2b4c52e067849b93c3f4c7ec284886

SHA256
b8c2bf47cb70a77582c302284554ecd4a29f9ee55c09fc2193b3ba942d5884ae

SHA512
31ff3523bedc87efd5040c46fdaff325c29fa109a912b729c81660c0737505e9dbd2f9bc0a443bfce12ede2569d023cc1f56f6bea0943a669f4f85e0f420830d

Download Submit
memory/3000-17-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3380-76-0x00000242F4C30000-0x00000242F4C31000-memory.dmp

Filesize
4KB

Download
memory/3380-42-0x00000242F4C30000-0x00000242F4C31000-memory.dmp

Filesize
4KB

Download
memory/3380-58-0x00000242F4C30000-0x00000242F4C31000-memory.dmp

Filesize
4KB

Download
memory/3380-63-0x00000242F4C30000-0x00000242F4C31000-memory.dmp

Filesize
4KB

Download
memory/3380-71-0x00000242F4C30000-0x00000242F4C31000-memory.dmp

Filesize
4KB

Download
memory/3380-2-0x0000024280000000-0x0000024280270000-memory.dmp

Filesize
2.4MB

Download
memory/3380-85-0x00000242F4C30000-0x00000242F4C31000-memory.dmp

Filesize
4KB

Download
memory/3380-110-0x00000242F4C30000-0x00000242F4C31000-memory.dmp

Filesize
4KB

Download
memory/3380-108-0x00000242F4C30000-0x00000242F4C31000-memory.dmp

Filesize
4KB

Download
memory/3380-117-0x00000242F4C30000-0x00000242F4C31000-memory.dmp

Filesize
4KB

Download
memory/3380-147-0x00000242F4C30000-0x00000242F4C31000-memory.dmp

Filesize
4KB

Download
memory/3380-18-0x00000242F4C30000-0x00000242F4C31000-memory.dmp

Filesize
4KB

Download
memory/3380-653-0x0000024280000000-0x0000024280270000-memory.dmp

Filesize
2.4MB

Download