Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
22-05-2024 03:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.curseforge.com/minecraft/mc-mods/storage-drawers/download/3884263
Resource
win11-20240426-en
General
-
Target
https://www.curseforge.com/minecraft/mc-mods/storage-drawers/download/3884263
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608212339876552" chrome.exe -
NTFS ADS 1 IoCs
Processes:
chrome.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\StorageDrawers-1.19-11.1.2.jar:Zone.Identifier chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 1720 chrome.exe 1720 chrome.exe 4996 chrome.exe 4996 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe Token: SeShutdownPrivilege 1720 chrome.exe Token: SeCreatePagefilePrivilege 1720 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
chrome.exepid process 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
chrome.exepid process 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe 1720 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1720 wrote to memory of 4760 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 4760 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3176 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3952 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 3952 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe PID 1720 wrote to memory of 444 1720 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.curseforge.com/minecraft/mc-mods/storage-drawers/download/38842631⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa1d5cab58,0x7ffa1d5cab68,0x7ffa1d5cab782⤵PID:4760
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1576 --field-trial-handle=1824,i,207681521222444011,16586387527957544404,131072 /prefetch:22⤵PID:3176
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1824,i,207681521222444011,16586387527957544404,131072 /prefetch:82⤵PID:3952
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2148 --field-trial-handle=1824,i,207681521222444011,16586387527957544404,131072 /prefetch:82⤵PID:444
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2936 --field-trial-handle=1824,i,207681521222444011,16586387527957544404,131072 /prefetch:12⤵PID:2772
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1824,i,207681521222444011,16586387527957544404,131072 /prefetch:12⤵PID:1996
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3916 --field-trial-handle=1824,i,207681521222444011,16586387527957544404,131072 /prefetch:12⤵PID:3704
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 --field-trial-handle=1824,i,207681521222444011,16586387527957544404,131072 /prefetch:82⤵PID:3592
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4388 --field-trial-handle=1824,i,207681521222444011,16586387527957544404,131072 /prefetch:82⤵PID:1332
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4384 --field-trial-handle=1824,i,207681521222444011,16586387527957544404,131072 /prefetch:82⤵
- NTFS ADS
PID:3000 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1824,i,207681521222444011,16586387527957544404,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4996
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5cec818ad6699451d86b9a32aa191668a
SHA1a1893b5b6a949ec02963f1e7865adc866ff3f6f3
SHA25688520a8c8a153c7582ab488f3b1ad954c8ab323b653b8a71ace5ab15da676eca
SHA512a5e4ef758172a185b78f9f9bac47084685fead3cbbb1ddd22bb666818518f9444708a2d338c15094cb664d86fbc3bc4eb95c489b26f9fb960ad26345f12a3cf1
-
Filesize
7KB
MD5585bb970f4a54f2e037c6869f315b472
SHA1228ca2a058d22e04ac0d265bf6b1cec1ce632446
SHA25609d90c6780dafde04de11b0f3a8d3c9b8f589f21fb8bb23195cd173c02ce8078
SHA5125ec467b3b16c18de21f781403c6050c404fbbbd3fb32d3c1f1f076805f4b6824b5d00e5306e4757c8b3bdca39c0fb76137b2ef0a57668116d9d094aa0b830795
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD5865f20ef17d3c8512fd08a31259dabb5
SHA179df8980eabf1d5f3fa359c8f4c7c9da4f7f665b
SHA2564653a00e8262a8acc97a2ab7ccc6e9c229023812f2fa1c73c06284c989b114e7
SHA51294570b89472be351aa875f2a59be23e374c902557d32b95bd8e616e7b3b4daa5c5ee056eb92bda8d4111dab4e04780f6297efeb3cac6ef76c6dc4ec951e276ad
-
Filesize
7KB
MD5cf7f99d54400f4b590aa4370259506d6
SHA1dd036600a0c0003915e5ea98041a9a4360b40128
SHA256a8fba8a2e810da0980e3b1ff95d9c82f078e0138d82b57017349821743e90290
SHA512690d5bfec1244c8cfa3303d00786559baec8bcfc3e24640058eb0e9713b9386de0a0b3d99ee33bd28a17ff93c86c6d754e7421859a24a506bc2b187c01d4265c
-
Filesize
7KB
MD5f3232ba6e5705784b0355461503ef282
SHA1547de7b916c3c807529f115a119f068341674afc
SHA256d546dd82aff4495109eb862372ca1458b4c3c779c3b3686a55d7239866f87a27
SHA5120257722483d21954c42467e5d111a62aee4f70b4bc060545a53228bbf50de490ca2241174ffe4b936eb339a52f163da855089e495f93df8e4433b47498c1b2c3
-
Filesize
130KB
MD5ec8e2549d9b7728b78fe06259b7892f5
SHA1fc70a4505f3d95267067dbd66e80ff9f7b41b374
SHA2563300262d5292587dce03d4f5b92c4434c01052359e2a6d4d56b0202929b005d7
SHA512ae99ee3180e1036a58d939f07241354ac319eba8b61fd8834eb11e635d434698ab70c6a2da67aedd637f456fa15c52961f07d60cc45f1d988a66145ed7c33e8c
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
567KB
MD53f65972ac73962b980a5c7facf24292e
SHA1afe617926602371af9461c549a8b1378872843d9
SHA25645cf9a7b48cd4961a93a53abbcca43d8bb6d9a767e96633b2854db8fb69867be
SHA51269b99aa6e7629b3a5f5048422e6feed3afd18cdc9728d71e116b60a0c36b9a4d96c0b1f167ce681690e1e8b8c8f25579c9c17c62b4b9708d697d2a1f0f2c0149
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e