0fc1ded9a9459789b76104275682e603868181a0e1928ec0681810e7c8e2bf17

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MinecraftInstaller.exe
Size 32.3MB
Sample260701-vzv89sbs8k
SHA256 0fc1ded9a9459789b76104275682e603868181a0e1928ec0681810e7c8e2bf17
MD5 afc010d82c412d72c66f51768671a976
SHA1 5069c9d61d180af0ed8924cb951423fc4ca74511
SHA512 dac5da0f57c4156fa042aa34e7b65af457052343def137f4497d66eae4c755ed592e83c7546af04d6457851fde77cb4b19c3ab9b2316bd48620e68ab287ff020
SSDEEP 393216:vbekuyo9nMK50UGRXLePuq2ZWy/c5zFviMKe2OHmwv9CsTmsueFFza9yV:iZn/G4Gqk1cWe2iTVCMue3X
TLSH
T10C77CF7808069695C173A2F89E2EF0499831FC0154FA74D563BDF3BB897EE21DE2914B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "3"	GamingRepair.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	MinecraftInstaller.exe

Executes dropped EXE 1 IoCs

pid	Process
740	GamingRepair.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MinecraftInstaller.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GamingRepair.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GamingRepair.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4224	MinecraftInstaller.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 740	4224	MinecraftInstaller.exe	94

C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\MinecraftInstaller.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe
  "C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe" scenarioMinecraft
  2⤵
  - Modifies security service
  - Executes dropped EXE
  - Checks processor information in registry
  PID:740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deviceId.txt

Path C:\Users\Admin\AppData\Local\MinecraftInstaller\deviceId.txt
Size 36B
SHA256 c7bee3efc47e01804f5eb3f05f5273a7dbc9e1b80f0364b883e1ab8bc4558b40
MD5 a471869f39b10bb6435401cbef37098e
SHA1 30d2dce0a259901e3c61e4be83f6ede465a64c07
SHA512 0f786c76b310c43b6a33103b8f547935ee8c87b88aa4dbf5197359799f30de0e7e6e43fe4a2f468e1136dfc9f4351f85252aab244cfe03219f4c32a49540d555
MD5 SHA1 SHA512

Submit Download

GamingRepair.exe

Path C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe
Size 569KB
SHA256 5730682b87bf48c341a14779a20602cdfbf0bcd916901a0837cfa40041fe9963
MD5 934d1cfb2330920f5ca9033a3a93eda3
SHA1 4b78508cb8197e1369aa87ad6c07388bbc382e72
SHA512 c0af09ffca0c42bd0f9f8edbd3158dcc80a834f1bcfdadec93fed8656d2741870f08976c89f63446c223ef424a5f80c8135511dc58c82dc5e57a4315ad52f22e
SSDEEP 12288:afmqJMKmKA4gBP2aINr9J0dD8cOK8nyienwI:auqnmxjI6xMyieV
TLSH
T12EC45C26DBEC43F4E077E274C9F68116F67178461B318B8F5291465E0F276A2AE3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4224-9-0x000000000B010000-0x000000000B048000-memory.dmp

Download

memory/4224-12-0x0000000007660000-0x000000000766A000-memory.dmp

Download

memory/4224-6-0x0000000006CE0000-0x0000000006CF0000-memory.dmp

Download

memory/4224-7-0x0000000006CE0000-0x0000000006CF0000-memory.dmp

Download

memory/4224-8-0x000000000A930000-0x000000000A938000-memory.dmp

Download

memory/4224-10-0x000000000A9E0000-0x000000000A9EE000-memory.dmp

Download

memory/4224-0-0x0000000000050000-0x00000000020AA000-memory.dmp

Download

memory/4224-4-0x0000000007CA0000-0x0000000007CA8000-memory.dmp

Download

memory/4224-13-0x000000000CEB0000-0x000000000CED6000-memory.dmp

Download

memory/4224-2-0x0000000006E60000-0x0000000007022000-memory.dmp

Download

memory/4224-26-0x0000000006CE0000-0x0000000006CF0000-memory.dmp

Download

memory/4224-28-0x0000000006CE0000-0x0000000006CF0000-memory.dmp

Download

memory/4224-1-0x0000000006CE0000-0x0000000006CF0000-memory.dmp

Download

memory/4224-31-0x0000000006CE0000-0x0000000006CF0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads