Analysis
- max time kernel
28s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 15:01
General
- Target e4mc_minecraft-fabric-5.4.1.jar
- Size 569KB
- Sample260503-sd9hnae16p
- SHA256 42d722bceb020190509d1c228d3bd9714cf9090903ba80ad2fd525fe830e70bf
Score
6/10
Malware Config
Signatures
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\e4mc_minecraft-fabric-5.4.1.jar1⤵
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/576-14-0x000001BF1C050000-0x000001BF1C0FF000-memory.dmp
memory/1200-2-0x0000026DC73E0000-0x0000026DC7650000-memory.dmp
memory/1200-11-0x0000026DC73C0000-0x0000026DC73C1000-memory.dmp
memory/1200-12-0x0000026DC73E0000-0x0000026DC7650000-memory.dmp
memory/2248-13-0x000002C6A6980000-0x000002C6A6A2F000-memory.dmp
memory/3772-16-0x000001F4D31E0000-0x000001F4D31F2000-memory.dmp
memory/3772-15-0x000001F4D3100000-0x000001F4D31AF000-memory.dmp
memory/3772-17-0x000001F4D3100000-0x000001F4D31AF000-memory.dmp