97fab78b42550c369c9447575ea2fd6593c67b66683ca0eb744896dab244911b

Analysis

max time kernel
13s
max time network
15s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 16:16

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

texturepackminecraft.exe
Size

5.8MB
MD5

2f39c064126b2fbf1ecdb1ac1a3a0888
SHA1

8e1c2b6e09af431d08f90f458e3d9a0431f2ad41
SHA256

97fab78b42550c369c9447575ea2fd6593c67b66683ca0eb744896dab244911b
SHA512

e004c427f3f10b89bcc5b91a5ade5ddbebf107c8ce201c2b784056d5b591682575b99588252a3510fa3be0a39ef1209256fd9d01f50c5d96b420241c8776d6ad
SSDEEP

98304:Xz8V3eHIzb71QGQCPDbZfzuOqV6l7ayCb7BJ5mjwNwwMeZYobSr+8/8dTxCf:XzyawdQmRrdA6l7aycBIGpEoo/aTx

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2620	texturepackminecraft.exe
2620	texturepackminecraft.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "156"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1324	shutdown.exe
Token: SeRemoteShutdownPrivilege	1324	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2012	LogonUI.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 2620	4784	texturepackminecraft.exe	83
PID 4784 wrote to memory of 2620	4784	texturepackminecraft.exe	83
PID 2620 wrote to memory of 4608	2620	texturepackminecraft.exe	85
PID 2620 wrote to memory of 4608	2620	texturepackminecraft.exe	85
PID 4608 wrote to memory of 1324	4608	cmd.exe	86
PID 4608 wrote to memory of 1324	4608	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\texturepackminecraft.exe
"C:\Users\Admin\AppData\Local\Temp\texturepackminecraft.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Users\Admin\AppData\Local\Temp\texturepackminecraft.exe
  "C:\Users\Admin\AppData\Local\Temp\texturepackminecraft.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c shutdown -s -c "Arrete de jouer avec moi. Je suis beaucoup plus puissant allez bye :)" -t 10 -f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Windows\system32\shutdown.exe
      shutdown -s -c "Arrete de jouer avec moi. Je suis beaucoup plus puissant allez bye :)" -t 10 -f
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1324

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3969055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI47842\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47842\base_library.zip

Filesize
1.0MB

MD5
2f2762f45831de8f3747753312745361

SHA1
22691eff142243d221507f79f70a85a6407ddbe7

SHA256
d33ebc0eb48830f7708460f0c4ef81785951c364f526250d09f43c4453253b41

SHA512
5f26e9e668aaeb5ca91998e829a95632c44d589cf61c9c4584b57f526efcae2604d57ee5dfec6aff73d32ac76e1f16ff4dda4d350e60f4dc8775cd95440156ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI47842\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit