Resubmissions
02-09-2024 07:57
240902-jtll4awarp 7Analysis
-
max time kernel
285s -
max time network
301s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-09-2024 07:57
Static task
static1
Behavioral task
behavioral1
Sample
CmlLib.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
ICSharpCode.SharpZipLib.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
OfflineMinecraftLauncher.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
OfflineMinecraftLauncher.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral6
Sample
SevenZip.dll
Resource
win10v2004-20240802-en
General
-
Target
OfflineMinecraftLauncher.exe
-
Size
308KB
-
MD5
f8a1b87d17f7c247935c1f3bf48c5670
-
SHA1
0b26092a7e92921905939a2f96ce638f1984d8ce
-
SHA256
d2fabf7f3179b69c2a78f8943c192a483370d2053c8c38799544790ce0c708d7
-
SHA512
875d7ef307e8ac2fd9a71c3ead27e3b69b669a827b8535a2e659dc0b99df8b7cfa23ac88ad9763a98f5ded963347663b4b7cf669b1a9c2c295ce1fe54776e111
-
SSDEEP
3072:Oczkitvo4BpYN/6mBPry8TXROLdW5m4mUR59OOGk0kfcq:OA4NCmBPry/N2lOOhZc
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
OfflineMinecraftLauncher.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation OfflineMinecraftLauncher.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
Processes
-
C:\Users\Admin\AppData\Local\Temp\OfflineMinecraftLauncher.exe"C:\Users\Admin\AppData\Local\Temp\OfflineMinecraftLauncher.exe"1⤵
- Checks computer location settings
PID:940
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3796,i,3239535018877284530,3457823197501312703,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:81⤵PID:644