613092e7f47d13793ae6df37bca4d684e6e8d0feb81f4fb16a3518113711d536

Analysis

max time kernel
58s
platform
windows11-21h2_x64
resource
win11-20260513-de
resource tags

arch:x64arch:x86image:win11-20260513-delocale:de-deos:windows11-21h2-x64systemwindows
submitted
23/06/2026, 04:24

Target
Minecraft-1.26.31.1-Coimobile.io.apk
Size 984.3MB
Sample260623-e1p6msas5p
SHA256 613092e7f47d13793ae6df37bca4d684e6e8d0feb81f4fb16a3518113711d536
MD5 59607186f35f0b927770a99931b762ef
SHA1 e01fe3a1074dff72e1b3b0fdd1c36c49090ff61a
SHA512 7a6874bf3a8707408eb710e879b675061d18d565c4b4d8b97493a6b8a4b9ad6126bbcf2aed0904bf0ee2ea1ad05e8d5bcae1226cce817bac0940c01e04259672
SSDEEP 25165824:AXPMlJ1mG50B5IJQDtWxI9MKIDtzCk64Z6IQJRbJAr8if3Ymj:IPKiZB5IJQDm+HID5N6G8jbYv9j
TLSH
T1B2B9E008C41389BAD46FB236CA690766B33049AB8841D4977D6CFE19BFF67500783F66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4612	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Minecraft-1.26.31.1-Coimobile.io.apk
1⤵
- Modifies registry class
PID:2968

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact