Resubmissions

17/11/2024, 14:35

241117-rydq2swpcq 10

17/11/2024, 14:32

241117-rwqb3a1mfs 10

Analysis

  • max time kernel
    13s
  • max time network
    15s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17/11/2024, 14:35

General

  • Target

    MinecraftInstaller.exe

  • Size

    32.3MB

  • MD5

    4f02ac057355b5dc73ea28aecd2d56b4

  • SHA1

    32591cb75779a3e308a44e75a76f821e7dee11e0

  • SHA256

    83a5f942b2a15eab4826ef1709ec6a7f9637a7ec0fce16585776848797307fa4

  • SHA512

    9eb08f85559df6af9192bec8904097d4e43a832ba9e9cc1c7be1a366af8d103c3a6db3886f00927ae5eb62055fbc770c7b5a3d2a122a0b460b51136083015368

  • SSDEEP

    393216:nbekuyo9nMK50UGRXLePuq2ZWy/c5zFviMKe2OHmwv9CsTmsueFFza9ye:6Zn/G4Gqk1cWe2iTVCMue3E

Score
10/10

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3080
    • C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe
      "C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe" scenarioMinecraft
      2⤵
      • Modifies security service
      • Executes dropped EXE
      • Checks processor information in registry
      PID:4656

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe

          Filesize

          557KB

          MD5

          8a4e72a29c08ae2cd13bc8ec414b8fc6

          SHA1

          26f8d73bc6f5ace5cec6e3652fc6410a71298498

          SHA256

          6513546697c3c9deb50d8dbb0cc9aa0be55487538ed482ec16b6264579de1539

          SHA512

          77eba566c65de1327bcacadb1483f538b4e5da67c3607398d745173ade25e987f59524a5ecf065dd5f95e26654cbb5a48dc80fae995d5d2dd63c63b2cd98fb98

        • memory/3080-5-0x0000000008660000-0x0000000008668000-memory.dmp

          Filesize

          32KB

        • memory/3080-13-0x0000000008380000-0x000000000838A000-memory.dmp

          Filesize

          40KB

        • memory/3080-4-0x0000000074920000-0x00000000750D1000-memory.dmp

          Filesize

          7.7MB

        • memory/3080-0-0x000000007492E000-0x000000007492F000-memory.dmp

          Filesize

          4KB

        • memory/3080-7-0x0000000074920000-0x00000000750D1000-memory.dmp

          Filesize

          7.7MB

        • memory/3080-8-0x000000000B2A0000-0x000000000B2A8000-memory.dmp

          Filesize

          32KB

        • memory/3080-9-0x0000000074920000-0x00000000750D1000-memory.dmp

          Filesize

          7.7MB

        • memory/3080-11-0x000000000B350000-0x000000000B35E000-memory.dmp

          Filesize

          56KB

        • memory/3080-2-0x00000000079F0000-0x0000000007BB2000-memory.dmp

          Filesize

          1.8MB

        • memory/3080-14-0x000000000C150000-0x000000000C176000-memory.dmp

          Filesize

          152KB

        • memory/3080-10-0x000000000B900000-0x000000000B938000-memory.dmp

          Filesize

          224KB

        • memory/3080-1-0x0000000000B30000-0x0000000002B86000-memory.dmp

          Filesize

          32.3MB

        • memory/3080-28-0x000000007492E000-0x000000007492F000-memory.dmp

          Filesize

          4KB

        • memory/3080-29-0x0000000074920000-0x00000000750D1000-memory.dmp

          Filesize

          7.7MB

        • memory/3080-30-0x0000000074920000-0x00000000750D1000-memory.dmp

          Filesize

          7.7MB

        • memory/3080-31-0x0000000074920000-0x00000000750D1000-memory.dmp

          Filesize

          7.7MB

        • memory/3080-33-0x0000000074920000-0x00000000750D1000-memory.dmp

          Filesize

          7.7MB