Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22-05-2024 02:05

General

  • Target

    https://www.curseforge.com/minecraft/mc-mods/day-zombies-rebooted/download/4803313

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.curseforge.com/minecraft/mc-mods/day-zombies-rebooted/download/4803313
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeccd0ab58,0x7ffeccd0ab68,0x7ffeccd0ab78
      2⤵
        PID:2552
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1508 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:2
        2⤵
          PID:4076
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:8
          2⤵
            PID:4876
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2020 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:8
            2⤵
              PID:728
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:1
              2⤵
                PID:2812
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3016 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:1
                2⤵
                  PID:4388
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4336 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:1
                  2⤵
                    PID:3120
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4400 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:8
                    2⤵
                      PID:1392
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4240 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:8
                      2⤵
                        PID:4964
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4240 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:8
                        2⤵
                        • NTFS ADS
                        PID:752
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1068 --field-trial-handle=1916,i,13542093694405687103,7810602529747135268,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4668
                    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                      1⤵
                        PID:2852

                      Network

                      MITRE ATT&CK Matrix ATT&CK v13

                      Discovery

                      Query Registry

                      1
                      T1012

                      System Information Discovery

                      1
                      T1082

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                        Filesize

                        1KB

                        MD5

                        cc244357c706d1d3d908d78c4389e8a9

                        SHA1

                        f809110f7fbebdc4b00322187a5ff52ec262561c

                        SHA256

                        e355de66ec0ecae8671d59a9b8325c01c80f37749ee128d212085b8f7c99083a

                        SHA512

                        a488420e1a8964a67b66e0f6dab9eaf35c217362867e59caf238e3fd7aaebb9c047e8c9502cd667ebac9c9f1f011562ce4eb2b329e124f0600b6585b69796c00

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                        Filesize

                        7KB

                        MD5

                        f51033f39e945017bfab706037d1d7d8

                        SHA1

                        de0c1a64334ec3c3e95e6af5f052050d1600a966

                        SHA256

                        4b62e0410e3196b9086441edd0992c3ee736563a7f22ec12d3764d2c1448f661

                        SHA512

                        19680655445129f319e50e8b25e628e7fbb0f21b49c4fea371931131e6deae9638ce82d80464df194f3a6354738134feab6ad9f00d1fec0e2492548b105b3c5b

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                        Filesize

                        1KB

                        MD5

                        fc457feb94c9974746d95aa89ee3843d

                        SHA1

                        fed60f6f04ec697e325c9c598694b101e93fb393

                        SHA256

                        6741aac1cdeb8a0e23daa19b56aedd61dd073ecf6b655bccbbd52732ce85aca3

                        SHA512

                        3ff0f4234889f1eccafa43a6e6deedeac486fbad85356865c002f8b430a14d742949c71cc6bff517d563103ebc06525531241a5c5d3d168606b81686992b157b

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                        Filesize

                        7KB

                        MD5

                        ef62d390ef3fd41654d91ca7c2d3cddc

                        SHA1

                        ac709092ab0861171771286493df649bbeddc74a

                        SHA256

                        62a30c06fd3f03193f40c7cd6eecdc5098388b3c9af7f0f73c0b9fbb5e8671bc

                        SHA512

                        c24dc49b4e5293313994a7bc77a4980795ce5285cd8822a7b3322c3587a4d6d5aabbc1c24e6e9f5de5433bb3df36f49e2dd5af9f8f11da89e7c0666a811da8a9

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                        Filesize

                        7KB

                        MD5

                        933c70f9665ce76cb9d35c4132dc7f33

                        SHA1

                        12c34ae9d23ce906193657b1d4dd997d29d0eb7c

                        SHA256

                        d6ad22f6836f0f34f64cac66dee8321f468afa1c9624b9f1fa1b7ec5c7f887d6

                        SHA512

                        28e83012011c17cb16b22710f47ab0b3b13b5cc859da47f57d1d97e772bf47c25b2361bb652991b292d486244c38312cbd1b6e06bb82b90824a45cc7393fd545

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                        Filesize

                        130KB

                        MD5

                        d23c7b1ebe02d69b5915f6a0e5f507a0

                        SHA1

                        c49d7dcd0f6fd5485f10ac6d10279afe0b83082d

                        SHA256

                        1c812172ecf358b2a09646e85f898f015f65e349fe1e2db6468d66d5fcc18e2a

                        SHA512

                        9bde9c15530747922dc1eeb7bfc9a4f4a07756f0d935b3581dcdf2b3a4121c1258884f7345d8792974545eb281e4df1e9e25f1eb546335234b82b04392e006d2

                      • C:\Users\Admin\Downloads\Dayzombies_rebooted-1.0.5_1.19.2.jar:Zone.Identifier
                        Filesize

                        160B

                        MD5

                        5f131fe08e0fb760ae97b62cdf801680

                        SHA1

                        0394c72b244e28d4064b6969615875d0e631967a

                        SHA256

                        4ff96e228af6dd7cdaef9f5b967b19f1639a852d95dc90473bbaf21ca7a0d073

                        SHA512

                        7ebee0c24f6c12cdde5a129960155706212a0606d204f0b75f7a955476c161cebfe6240481314997cd70ea35e070fa8763db947f50dc8e5a50d177b19a539c46

                      • \??\pipe\crashpad_2360_TLIAUUHUPKAYFPUI
                        MD5

                        d41d8cd98f00b204e9800998ecf8427e

                        SHA1

                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                        SHA256

                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                        SHA512

                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e