Resubmissions

18/06/2024, 07:57

240618-jtd71sthkb 1

01/06/2024, 14:06

240601-rehwnaec6y 1

29/12/2022, 21:46

221229-1mryzaec36 8

Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    18/06/2024, 07:57

General

  • Target

    MinecraftInstaller.exe

  • Size

    31.8MB

  • MD5

    24c96f96660bcedbf8648c8e43c3630c

  • SHA1

    127dbeec1e9a7b8db42704172ba9e9bae0269754

  • SHA256

    2b0e05e169643319074f306153e55f2d839adb0378d6e721c04198233b892bfa

  • SHA512

    ed01d726284b92f0c594db2b4644903109c1f7ec650b6572207d1f1d8fe26e97dd3d89df6296b625023f0c63148b5ae543db21573c60aa487c57414219e3916c

  • SSDEEP

    393216:Ubekuyo9nMK50UGRXLePuq2ZWy/c5zFviMKe2OHmwv9CsTmsueFFza9yt:vZn/G4Gqk1cWe2iTVCMue3T

Score
1/10

Malware Config

Signatures

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:2492
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2492-0-0x00000000751DE000-0x00000000751DF000-memory.dmp

    Filesize

    4KB

  • memory/2492-1-0x00000000007D0000-0x000000000279A000-memory.dmp

    Filesize

    31.8MB

  • memory/2492-2-0x00000000075B0000-0x0000000007772000-memory.dmp

    Filesize

    1.8MB

  • memory/2492-4-0x00000000751D0000-0x0000000075981000-memory.dmp

    Filesize

    7.7MB

  • memory/2492-5-0x0000000008270000-0x0000000008278000-memory.dmp

    Filesize

    32KB

  • memory/2492-6-0x00000000751D0000-0x0000000075981000-memory.dmp

    Filesize

    7.7MB

  • memory/2492-7-0x000000000AA00000-0x000000000AA08000-memory.dmp

    Filesize

    32KB

  • memory/2492-9-0x000000000AAB0000-0x000000000AABE000-memory.dmp

    Filesize

    56KB

  • memory/2492-8-0x000000000B130000-0x000000000B168000-memory.dmp

    Filesize

    224KB

  • memory/2492-10-0x00000000751D0000-0x0000000075981000-memory.dmp

    Filesize

    7.7MB

  • memory/2492-11-0x00000000751DE000-0x00000000751DF000-memory.dmp

    Filesize

    4KB

  • memory/2492-12-0x00000000751D0000-0x0000000075981000-memory.dmp

    Filesize

    7.7MB

  • memory/2492-13-0x0000000002E80000-0x0000000002E8A000-memory.dmp

    Filesize

    40KB

  • memory/2492-14-0x000000000B640000-0x000000000B666000-memory.dmp

    Filesize

    152KB