e7b3db67c5b22fb6175be7299d1ad622d6183210d212ca3ce464292b627400f1

General

Target

LauncherFenix-Minecraft-v7.jar
Size

65KB
MD5

fea39379db50e2a8feee8bac75ab769d
SHA1

1b1df2b43088ddff1394d50d515901570ab18f40
SHA256

e7b3db67c5b22fb6175be7299d1ad622d6183210d212ca3ce464292b627400f1
SHA512

25487310a04b60b561d013b01e7d595e545e1da3b352e046774b95a54f2877ffad2b64d961dc8ed99532dc8c83719f0e281cf0540cf25e4b0708d2c5d64c7c79
SSDEEP

1536:paoqO4pFE7IxmtlSBszOg+0HUad8vr7lK:p56K7ItBjgXHUYCnlK

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4544	icacls.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "6"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "7"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "8"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "2"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "3"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "4"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "5"	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4124900551-4068476067-3491212533-1000\{8F8008F1-BC23-47A7-A9D3-D9F09628B025}	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4676	OpenWith.exe
3124	OpenWith.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4676	OpenWith.exe
5060	java.exe
5060	java.exe
3124	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 4544	5060	java.exe	83
PID 5060 wrote to memory of 4544	5060	java.exe	83

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\LauncherFenix-Minecraft-v7.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4544

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:3744

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:4632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:2064

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
bd53f4fb4913b8e879753381720a6cd8

SHA1
fd1a625a094e3b32b1b4b9f229cf477b9db1eb23

SHA256
2ef5c5b66d5455488f18baf42cfe90d7c876d656f5c206125ee289e5ace129e7

SHA512
66383aca3e272dd440d8d423a3ae1d4b9ee78f22c264de822e8c3c773c0e2c29e504eee54dd7416133cae84ee8796d65b982be5b5c5e0413ce95505f2c7200ea

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\launcherfenix.jar

Filesize
500KB

MD5
84591cf8bbe4b94d5a83b2cdd605d4b5

SHA1
85f1dbf03d2b4c52e067849b93c3f4c7ec284886

SHA256
b8c2bf47cb70a77582c302284554ecd4a29f9ee55c09fc2193b3ba942d5884ae

SHA512
31ff3523bedc87efd5040c46fdaff325c29fa109a912b729c81660c0737505e9dbd2f9bc0a443bfce12ede2569d023cc1f56f6bea0943a669f4f85e0f420830d

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
memory/5060-2-0x00000271A5850000-0x00000271A5AC0000-memory.dmp

Filesize
2.4MB

Download
memory/5060-16-0x00000271A3EA0000-0x00000271A3EA1000-memory.dmp

Filesize
4KB

Download
memory/5060-55-0x00000271A3EA0000-0x00000271A3EA1000-memory.dmp

Filesize
4KB

Download
memory/5060-60-0x00000271A3EA0000-0x00000271A3EA1000-memory.dmp

Filesize
4KB

Download
memory/5060-82-0x00000271A3EA0000-0x00000271A3EA1000-memory.dmp

Filesize
4KB

Download
memory/5060-107-0x00000271A3EA0000-0x00000271A3EA1000-memory.dmp

Filesize
4KB

Download
memory/5060-111-0x00000271A3EA0000-0x00000271A3EA1000-memory.dmp

Filesize
4KB

Download
memory/5060-150-0x00000271A3EA0000-0x00000271A3EA1000-memory.dmp

Filesize
4KB

Download
memory/5060-655-0x00000271A5850000-0x00000271A5AC0000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing