Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
22-05-2024 02:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.curseforge.com/minecraft/mc-mods/day-zombies-rebooted/download/4803313
Resource
win11-20240426-en
General
-
Target
https://www.curseforge.com/minecraft/mc-mods/day-zombies-rebooted/download/4803313
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608171639734705" chrome.exe -
NTFS ADS 1 IoCs
Processes:
chrome.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\Dayzombies_rebooted-1.0.5_1.19.2.jar:Zone.Identifier chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 2360 chrome.exe 2360 chrome.exe 4668 chrome.exe 4668 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe Token: SeShutdownPrivilege 2360 chrome.exe Token: SeCreatePagefilePrivilege 2360 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
chrome.exepid process 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
chrome.exepid process 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe 2360 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2360 wrote to memory of 2552 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 2552 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4076 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4876 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 4876 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe PID 2360 wrote to memory of 728 2360 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.curseforge.com/minecraft/mc-mods/day-zombies-rebooted/download/48033131⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeccd0ab58,0x7ffeccd0ab68,0x7ffeccd0ab782⤵PID:2552
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1508 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:22⤵PID:4076
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:82⤵PID:4876
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2020 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:82⤵PID:728
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:12⤵PID:2812
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3016 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:12⤵PID:4388
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4336 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:12⤵PID:3120
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4400 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:82⤵PID:1392
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4240 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:82⤵PID:4964
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4240 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:82⤵
- NTFS ADS
PID:752 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1068 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4668
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5cc244357c706d1d3d908d78c4389e8a9
SHA1f809110f7fbebdc4b00322187a5ff52ec262561c
SHA256e355de66ec0ecae8671d59a9b8325c01c80f37749ee128d212085b8f7c99083a
SHA512a488420e1a8964a67b66e0f6dab9eaf35c217362867e59caf238e3fd7aaebb9c047e8c9502cd667ebac9c9f1f011562ce4eb2b329e124f0600b6585b69796c00
-
Filesize
7KB
MD5f51033f39e945017bfab706037d1d7d8
SHA1de0c1a64334ec3c3e95e6af5f052050d1600a966
SHA2564b62e0410e3196b9086441edd0992c3ee736563a7f22ec12d3764d2c1448f661
SHA51219680655445129f319e50e8b25e628e7fbb0f21b49c4fea371931131e6deae9638ce82d80464df194f3a6354738134feab6ad9f00d1fec0e2492548b105b3c5b
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD5fc457feb94c9974746d95aa89ee3843d
SHA1fed60f6f04ec697e325c9c598694b101e93fb393
SHA2566741aac1cdeb8a0e23daa19b56aedd61dd073ecf6b655bccbbd52732ce85aca3
SHA5123ff0f4234889f1eccafa43a6e6deedeac486fbad85356865c002f8b430a14d742949c71cc6bff517d563103ebc06525531241a5c5d3d168606b81686992b157b
-
Filesize
7KB
MD5ef62d390ef3fd41654d91ca7c2d3cddc
SHA1ac709092ab0861171771286493df649bbeddc74a
SHA25662a30c06fd3f03193f40c7cd6eecdc5098388b3c9af7f0f73c0b9fbb5e8671bc
SHA512c24dc49b4e5293313994a7bc77a4980795ce5285cd8822a7b3322c3587a4d6d5aabbc1c24e6e9f5de5433bb3df36f49e2dd5af9f8f11da89e7c0666a811da8a9
-
Filesize
7KB
MD5933c70f9665ce76cb9d35c4132dc7f33
SHA112c34ae9d23ce906193657b1d4dd997d29d0eb7c
SHA256d6ad22f6836f0f34f64cac66dee8321f468afa1c9624b9f1fa1b7ec5c7f887d6
SHA51228e83012011c17cb16b22710f47ab0b3b13b5cc859da47f57d1d97e772bf47c25b2361bb652991b292d486244c38312cbd1b6e06bb82b90824a45cc7393fd545
-
Filesize
130KB
MD5d23c7b1ebe02d69b5915f6a0e5f507a0
SHA1c49d7dcd0f6fd5485f10ac6d10279afe0b83082d
SHA2561c812172ecf358b2a09646e85f898f015f65e349fe1e2db6468d66d5fcc18e2a
SHA5129bde9c15530747922dc1eeb7bfc9a4f4a07756f0d935b3581dcdf2b3a4121c1258884f7345d8792974545eb281e4df1e9e25f1eb546335234b82b04392e006d2
-
Filesize
160B
MD55f131fe08e0fb760ae97b62cdf801680
SHA10394c72b244e28d4064b6969615875d0e631967a
SHA2564ff96e228af6dd7cdaef9f5b967b19f1639a852d95dc90473bbaf21ca7a0d073
SHA5127ebee0c24f6c12cdde5a129960155706212a0606d204f0b75f7a955476c161cebfe6240481314997cd70ea35e070fa8763db947f50dc8e5a50d177b19a539c46
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e