Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
21/04/2026, 01:27
General
- Target MinecraftBedrockUnlocker.exe
- Size 11.3MB
- Sample260421-bvcftagy7n
- SHA256 e64fe899f4c0a0fc64eaa6c5ba64a5a785d2a5bf462024364b4e7dcaed4af4ed
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MinecraftBedrockUnlocker.exe"C:\Users\Admin\AppData\Local\Temp\MinecraftBedrockUnlocker.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MCUnlocker' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\MCUnlocker\install.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
install.ps1
__PSScriptPolicyTest_gs53kkjk.szl.ps1
memory/1544-46-0x0000000000F80000-0x0000000001AD5000-memory.dmp
memory/1824-18-0x000001C8FC6A0000-0x000001C8FC6AA000-memory.dmp
memory/1824-29-0x000001C8FC800000-0x000001C8FC856000-memory.dmp
memory/1824-0-0x000001C8FA320000-0x000001C8FA330000-memory.dmp
memory/1824-19-0x000001C8FC880000-0x000001C8FC89C000-memory.dmp
memory/1824-20-0x000001C8FC860000-0x000001C8FC86A000-memory.dmp
memory/1824-21-0x000001C8FC8C0000-0x000001C8FC8DA000-memory.dmp
memory/1824-22-0x000001C8FC870000-0x000001C8FC878000-memory.dmp
memory/1824-23-0x000001C8FC8A0000-0x000001C8FC8A6000-memory.dmp
memory/1824-24-0x000001C8FC8B0000-0x000001C8FC8BA000-memory.dmp
memory/1824-25-0x000001C8FA320000-0x000001C8FA330000-memory.dmp
memory/1824-28-0x000001C8FC1A0000-0x000001C8FC1B2000-memory.dmp
memory/1824-17-0x000001C8FC4E0000-0x000001C8FC593000-memory.dmp
memory/1824-16-0x000001C8FC4C0000-0x000001C8FC4DC000-memory.dmp
memory/1824-1-0x000001C8FC1D0000-0x000001C8FC1F2000-memory.dmp
memory/1824-8-0x000001C8FA320000-0x000001C8FA330000-memory.dmp
memory/1824-9-0x00007FF43CC40000-0x00007FF43CC50000-memory.dmp
memory/1860-36-0x000001B8EE410000-0x000001B8EE420000-memory.dmp
memory/1860-48-0x000001B8EE410000-0x000001B8EE420000-memory.dmp
memory/1860-47-0x000001B8EE410000-0x000001B8EE420000-memory.dmp
memory/1860-37-0x000001B8EE410000-0x000001B8EE420000-memory.dmp
memory/1860-51-0x000001B8EE8F0000-0x000001B8EE8F9000-memory.dmp
memory/1860-50-0x000001B8EE3E0000-0x000001B8EE3F2000-memory.dmp
memory/1860-49-0x000001B8EC4B0000-0x000001B8EC64A000-memory.dmp