Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
22-05-2024 01:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.curseforge.com/minecraft/mc-mods/mrcrayfishs-gun-mod/download/4718583
Resource
win11-20240508-en
General
-
Target
https://www.curseforge.com/minecraft/mc-mods/mrcrayfishs-gun-mod/download/4718583
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608164411089618" chrome.exe -
NTFS ADS 1 IoCs
Processes:
chrome.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\cgm-forge-1.19.2-1.3.7.jar:Zone.Identifier chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 412 chrome.exe 412 chrome.exe 2860 chrome.exe 2860 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 412 chrome.exe 412 chrome.exe 412 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
chrome.exepid process 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
chrome.exepid process 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 412 wrote to memory of 4988 412 chrome.exe chrome.exe PID 412 wrote to memory of 4988 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 2944 412 chrome.exe chrome.exe PID 412 wrote to memory of 1036 412 chrome.exe chrome.exe PID 412 wrote to memory of 1036 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe PID 412 wrote to memory of 3104 412 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.curseforge.com/minecraft/mc-mods/mrcrayfishs-gun-mod/download/47185831⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbb2bab58,0x7ffbbb2bab68,0x7ffbbb2bab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 --field-trial-handle=1800,i,10467009883425905624,11278953533292267485,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1800,i,10467009883425905624,11278953533292267485,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2136 --field-trial-handle=1800,i,10467009883425905624,11278953533292267485,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1800,i,10467009883425905624,11278953533292267485,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1800,i,10467009883425905624,11278953533292267485,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4120 --field-trial-handle=1800,i,10467009883425905624,11278953533292267485,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 --field-trial-handle=1800,i,10467009883425905624,11278953533292267485,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 --field-trial-handle=1800,i,10467009883425905624,11278953533292267485,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1800,i,10467009883425905624,11278953533292267485,131072 /prefetch:82⤵
- NTFS ADS
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4604 --field-trial-handle=1800,i,10467009883425905624,11278953533292267485,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD558124595c620bc4b661cf56ce250fcbb
SHA1563f2cd39c775dfc40888958506c299318e2be7b
SHA2568bfdf9cafa8b0743bc1b69e877364a93445bd8a4561d0dee59d296dac6c7a72e
SHA51210def2d4e1fc83461b89ec9589cfd3dbcb8d7d3061c1591a5b61fe2a1d8dc05f2206e07714c577f16985c6297df14d846319cbab26cf52e9c573097b46ffe2b0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
8KB
MD59cee8f72bb0e3174f09723e7e07ccdc9
SHA1b16542adb06abfae93a5e3e3da020b1fc6848deb
SHA2563d50e53f2cd28b9bac1e0ccbe71d18b27274ea44e76ad0ec155a0876cd757ae9
SHA512c5b5a41fceb937b131c9766df6da361859cbe5705aec9aa49dba101924c9b0c7bfeebeed9ae4834a35589994f0f29703cc1a9e74aa191804a779c696d4003ebc
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5dfbdc6f990ce5001cf4362588db589f1
SHA1172e080a700fc0e1a9bf8dbb6f8fb17f5e05deae
SHA2561b05c3f11d1a02d1083dc4cb7343d7ebc11a893e600899f17573c378f3b09c38
SHA512855f62f008bc9e95c66a59fdda6f65883d45e4500fec2803457fddedb04a393fa76ff69e42fc7c3dafe165cd15ee87de1675ab5726a8973495134d28afbb5418
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD51798d8831a98b186cf86584284913647
SHA14b5c199c6ba0779aea9b8b6ebfa7d176fd13ff66
SHA25641015c646ed3a772c5e2095855ffceb72028816abf15e80510b966ef5ab83bad
SHA512a88722a8dc43df204b284042cfcf945e3c5111dacfa9f84eff61f84cd794e42085dce69d620b6f8ba0706aefa6bc7cb2199776361841d1540ab93569a6888ed9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD559ea78cae7c74b45e1045cccccdc7c2a
SHA1dae9a5c5b4a23db148592cf2c13b7687f9c72abc
SHA2560bb1d0363c0ab937d67370c4bc6be2787a14ebe2bb16423e3c9423d221e301cb
SHA51278fbef7dc26a2d69fa12a6842786e2ba8ccc494db41509c464588f40c7910bdf63ba9f27d3496ebb2add880162ed86d37307dc438ce4926be22b2edf4d0502a0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
129KB
MD5ded6aa06f529ff16995e27e72551a6ca
SHA1e26fd3bd6cb317490c2318ff5eccd90d03567c2f
SHA256700cde35a595f2ddcf5f2032355dc11dc9eadaa5aa96172d18ba97c8c7772be9
SHA512ea5d847c4c5943a3bff580495211c0910b934d732c79199df0d1ae40c72365c2e4fd7f5e00b1db4d278f37478bd1d373bffd06db5c8855d4dacb484304869769
-
C:\Users\Admin\Downloads\cgm-forge-1.19.2-1.3.7.jar:Zone.IdentifierFilesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
\??\pipe\crashpad_412_ZRROQGRCISYNLMFAMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e