Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
21/04/2026, 01:27
General
- Target MinecraftBedrockUnlocker.exe
- Size 11.3MB
- Sample260421-bvcftagy7n
- SHA256 e64fe899f4c0a0fc64eaa6c5ba64a5a785d2a5bf462024364b4e7dcaed4af4ed
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MinecraftBedrockUnlocker.exe"C:\Users\Admin\AppData\Local\Temp\MinecraftBedrockUnlocker.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MCUnlocker' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\MCUnlocker\install.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
install.ps1
__PSScriptPolicyTest_v4mhzpd5.i5s.ps1
memory/2648-12-0x000002626A600000-0x000002626A60C000-memory.dmp
memory/2648-0-0x000002626A5E0000-0x000002626A5F0000-memory.dmp
memory/2648-2-0x000002626AD70000-0x000002626AD92000-memory.dmp
memory/2648-1-0x000002626A5E0000-0x000002626A5F0000-memory.dmp
memory/3748-20-0x00000212EB020000-0x00000212EB030000-memory.dmp
memory/3748-19-0x00000212EB020000-0x00000212EB030000-memory.dmp
memory/3748-30-0x00000212EB020000-0x00000212EB030000-memory.dmp
memory/3748-31-0x00000212EB020000-0x00000212EB030000-memory.dmp
memory/3748-32-0x00000212EB020000-0x00000212EB030000-memory.dmp
memory/3748-34-0x00000212EA8D0000-0x00000212EA8DC000-memory.dmp
memory/3748-35-0x00000212EB560000-0x00000212EB675000-memory.dmp
memory/3748-36-0x00000212EB020000-0x00000212EB030000-memory.dmp
memory/4908-33-0x00000000005F0000-0x0000000001145000-memory.dmp