Overview
overview
7Static
static
7Minecraft ...mo.exe
windows10-2004-x64
6Minecraft ...32.dll
windows10-2004-x64
7Minecraft ...64.dll
windows10-2004-x64
1Minecraft ...x8.dll
windows10-2004-x64
3Minecraft ...64.dll
windows10-2004-x64
1Minecraft ...aw.dll
windows10-2004-x64
3Minecraft ...64.dll
windows10-2004-x64
1Minecraft ...ut.jar
windows10-2004-x64
6Minecraft ...gl.dll
windows10-2004-x64
7Minecraft ...gl.jar
windows10-2004-x64
6Minecraft ...64.dll
windows10-2004-x64
1Minecraft ...il.jar
windows10-2004-x64
6Minecraft ...00.dat
windows10-2004-x64
3Minecraft ...00.exe
windows10-2004-x64
7Analysis
-
max time kernel
101s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10-08-2024 20:16
Behavioral task
behavioral1
Sample
Minecraft PC Gamer Demo/Minecraft_PCGamer_Demo.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
Minecraft PC Gamer Demo/OpenAL32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Minecraft PC Gamer Demo/OpenAL64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
Minecraft PC Gamer Demo/jinput-dx8.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Minecraft PC Gamer Demo/jinput-dx8_64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral6
Sample
Minecraft PC Gamer Demo/jinput-raw.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Minecraft PC Gamer Demo/jinput-raw_64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
Minecraft PC Gamer Demo/jinput.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Minecraft PC Gamer Demo/lwjgl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
Minecraft PC Gamer Demo/lwjgl.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Minecraft PC Gamer Demo/lwjgl64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
Minecraft PC Gamer Demo/lwjgl_util.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Minecraft PC Gamer Demo/unins000.dat
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
Minecraft PC Gamer Demo/unins000.exe
Resource
win10v2004-20240802-en
General
-
Target
Minecraft PC Gamer Demo/Minecraft_PCGamer_Demo.exe
-
Size
2.5MB
-
MD5
774bfe3122213edb20481d3f69d49f2d
-
SHA1
4e3f157b48102b099581c726a00ca00d0cb64301
-
SHA256
c2c77dee7ff48fde9558c0d1967db8d51d3c4b12905c05c9a08561551b3e7cf3
-
SHA512
5d3170d6d3d9276e05f35d43cf945b56c897c48af42ddb6abc489f5aa6cf931820cc897cf1fa192d8b3dcb03edc679b875e0d9bb1ac2845d5ab3db67e8f847fd
-
SSDEEP
49152:5bYMoXP0qSH9W/abzMvaP8C+OoHDKHc9iqNMxqLvn8bLvsn5:5QMfw/a6aB+z2Hclf4LK5
Malware Config
Signatures
-
pid Process 2864 GameBarPresenceWriter.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Minecraft_PCGamer_Demo.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4396 javaw.exe 4396 javaw.exe 1980 OpenWith.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4872 wrote to memory of 4396 4872 Minecraft_PCGamer_Demo.exe 85 PID 4872 wrote to memory of 4396 4872 Minecraft_PCGamer_Demo.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\Minecraft PC Gamer Demo\Minecraft_PCGamer_Demo.exe"C:\Users\Admin\AppData\Local\Temp\Minecraft PC Gamer Demo\Minecraft_PCGamer_Demo.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Xms800m -Xmx800m -Dsun.java2d.noddraw=true -Dsun.awt.noerasebackground=true -Dsun.java2d.d3d=false -Dsun.java2d.opengl=false -Dsun.java2d.pmoffscreen=false -classpath "C:\Users\Admin\AppData\Local\Temp\Minecraft PC Gamer Demo\Minecraft_PCGamer_Demo.exe;lwjgl.jar;lwjgl_util.jar;jinput.jar;minecraft.jar" net.minecraft.client.Minecraft2⤵
- Suspicious use of SetWindowsHookEx
PID:4396
-
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
PID:2864
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:1980