General
-
Target
minecraft.exe
-
Size
55KB
-
Sample
241029-xgxeqaybnk
-
MD5
09718d571b01cb93e6f983be7b99a4b2
-
SHA1
d2d1212212bfc691e115b24e8132ae4658e510e8
-
SHA256
6eb25168bde4a9e7f3a273229ca0fbf4f17133788b5c68bf3151eb48826e1169
-
SHA512
9c7fad95ad56c1f457be067467886c7d23fa57734547688c64d16f37f3190cc017987278a2387b217e4a8108ac04d33b1fe5353cfb350717a839ecb6dd533098
-
SSDEEP
1536:34dJooh0Wa0aer344Jw/ytUqVS5EkIijQ1fTNiPJ:34dzVTaer344JzthRZijQ1Ji
Behavioral task
behavioral1
Sample
minecraft.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
minecraft.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
minecraft.exe
-
Size
55KB
-
MD5
09718d571b01cb93e6f983be7b99a4b2
-
SHA1
d2d1212212bfc691e115b24e8132ae4658e510e8
-
SHA256
6eb25168bde4a9e7f3a273229ca0fbf4f17133788b5c68bf3151eb48826e1169
-
SHA512
9c7fad95ad56c1f457be067467886c7d23fa57734547688c64d16f37f3190cc017987278a2387b217e4a8108ac04d33b1fe5353cfb350717a839ecb6dd533098
-
SSDEEP
1536:34dJooh0Wa0aer344Jw/ytUqVS5EkIijQ1fTNiPJ:34dzVTaer344JzthRZijQ1Ji
-
Adds autorun key to be loaded by Explorer.exe on startup
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops file in Drivers directory
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
-
Possible privilege escalation attempt
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies file permissions
-
Modifies system executable filetype association
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Browser Extensions
1Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Netsh Helper DLL
1