Analysis
- user interaction
yes - max time kernel
144s - max time network
45s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/07/2026, 11:10
General
- Target LaunchMinecraft.bat
- Size 132B
- Sample260716-m96trae17s
- SHA256 52c98fe3a2115b7b709a20891aeb3668dd480aa0170722e0960c7d03510d0a97
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\LaunchMinecraft.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& './launch.ps1' 'Microsoft.MinecraftUWP'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\uwpinject.exe"C:\Users\Admin\AppData\Local\Temp\uwpinject.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4660-0-0x00007FFC7307F000-0x00007FFC73080000-memory.dmp
memory/4660-3-0x00000240EC260000-0x00000240EC282000-memory.dmp
memory/4660-4-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/4660-5-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/4660-6-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/4660-7-0x00000240EC850000-0x00000240ECA54000-memory.dmp
memory/4660-8-0x00000240EC2B0000-0x00000240EC2CA000-memory.dmp
memory/4660-9-0x00000240EC6D0000-0x00000240EC6FA000-memory.dmp
memory/4660-12-0x00000240EC2D0000-0x00000240EC2D6000-memory.dmp
memory/4660-11-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/4660-14-0x00000240EC640000-0x00000240EC648000-memory.dmp
memory/4660-10-0x00000240EC2A0000-0x00000240EC2A8000-memory.dmp
memory/4660-15-0x00000240EC680000-0x00000240EC6A6000-memory.dmp
memory/4660-13-0x00000240EC2E0000-0x00000240EC2EA000-memory.dmp
memory/4660-16-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/4660-19-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/4660-18-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp