File name:

minecraftsp.exe

Full analysis: https://app.any.run/tasks/13af148a-d224-49cf-b633-2dae3e1bda4c
Verdict: Malicious activity
Analysis date: January 22, 2024, 21:50:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5:

605A171C61A0607BDCF6BE80ED07CF95

SHA1:

477D4391B0D84406127E43EAD289A3596AC1E5E5

SHA256:

09B78DC85713CA0F27F17D94C939CC606A59847C1F2B5CDD281B52A48CDAEAB9

SSDEEP:

6144:4mmx3k74XODG40zQG7NP0nuc6Hzp3wT66vlm4LbHL+pNn40yY7MmI2lPN:ax3u9q400uB74fKL0mB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • minecraftsp.exe (PID: 116)

  • SUSPICIOUS

    • Checks for Java to be installed

      • minecraftsp.exe (PID: 116)
      • javaw.exe (PID: 268)

    • Executable content was dropped or overwritten

      • minecraftsp.exe (PID: 116)

  • INFO

    • Checks supported languages

      • minecraftsp.exe (PID: 116)
      • java.exe (PID: 1072)
      • javaw.exe (PID: 268)
      • i4jdel0.exe (PID: 1344)

    • Create files in a temporary directory

      • java.exe (PID: 1072)
      • minecraftsp.exe (PID: 116)
      • javaw.exe (PID: 268)

    • Creates files in the program directory

      • java.exe (PID: 1072)

    • Reads the machine GUID from the registry

      • minecraftsp.exe (PID: 116)

    • Reads the computer name

      • minecraftsp.exe (PID: 116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (35)
.exe | Win64 Executable (generic) (30.9)
.scr | Windows screen saver (14.6)
.dll | Win32 Dynamic Link Library (generic) (7.3)
.exe | Win32 Executable (generic) (5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:06:14 16:51:18+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, No debug
PEType: PE32
LinkerVersion: 2.56
CodeSize: 128000
InitializedDataSize: 494592
UninitializedDataSize: 50688
EntryPoint: 0x11d8
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 12.1.2.0
ProductVersionNumber: 12.1.2.0
FileFlagsMask: 0x0017
FileFlags: Debug
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: AnjoCaido
FileDescription: Free launcher for Minecraft Alpha
FileVersion: 12.1.2.0
LegalCopyright: 2010 AnjoCaido (but Mojang have the rights over the game, you pirate!)
ProductName: MinecraftSP
ProductVersion: 12.1.2.0
OriginalFileName: MinecraftSP.exe
InternalName: MinecraftSP
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start minecraftsp.exe java.exe no specs icacls.exe no specs javaw.exe no specs i4jdel0.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\AppData\Local\Temp\minecraftsp.exe" C:\Users\admin\AppData\Local\Temp\minecraftsp.exe
explorer.exe
User:
admin
Company:
AnjoCaido
Integrity Level:
MEDIUM
Description:
Free launcher for Minecraft Alpha
Exit code:
0
Version:
12.1.2.0
Modules
Images
c:\users\admin\appdata\local\temp\minecraftsp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
268javaw -Xms512m -Xmx1024m -Dsun.java2d.noddraw=true -Dsun.java2d.d3d=false -Dsun.java2d.opengl=false -Dsun.java2d.pmoffscreen=false -classpath /C:/Users/admin/AppData/Local/Temp/e4jF87A.tmp_dir/MinecraftSP.jar net.minecraft.LauncherFrameC:\Program Files\Common Files\Oracle\Java\javapath_target_52116515\javaw.exe—minecraftsp.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
1
Version:
8.0.2710.9
Modules
Images
c:\program files\common files\oracle\java\javapath_target_52116515\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1072c:\PROGRA~1\java\JRE18~1.0_2\bin\java.exe -versionC:\Program Files\Java\jre1.8.0_271\bin\java.exe—minecraftsp.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\java.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1344C:\Users\admin\AppData\Local\Temp\i4jdel0.exe i4j3127910663911961288.tmpC:\Users\admin\AppData\Local\Temp\i4jdel0.exe—minecraftsp.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\i4jdel0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2068C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\System32\icacls.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
Total events
649
Read events
649
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
1
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
116minecraftsp.exeC:\Users\admin\AppData\Local\Temp\e4jF87B.tmptext
MD5:04C435364568AB98120F802C798CFD68
SHA256:7A7FE5291BA42E11E8FA94839E219AB65E3B1411244ECDEFA4222CC60A63ED61
116minecraftsp.exeC:\Users\admin\AppData\Local\Temp\e4jF87A.tmp_dir\MinecraftSP.jarjava
MD5:4ECA7879FF514CDD79C290701443EEDD
SHA256:3D1DBCA922045D5ECCC744E6F9F6E56FEF73A371A8BC0826E76FB041824073C0
116minecraftsp.exeC:\Users\admin\AppData\Local\Temp\i4jdel0.exeexecutable
MD5:24F6D923EF6956ABD0449C879F36D7C7
SHA256:B8FE41DD005BB309F2ED4B81300CE0FBE4DDFC2A379A5101C11ECE47462D1997
1072java.exeC:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8061.timestamptext
MD5:A55EE7F6E7C77ACDE8D8F921DDD58DAB
SHA256:97B9DBDABB6A4AE5EA3492CA210B9941D658B43B7BE16047288CF765A6D23127
116minecraftsp.exeC:\Users\admin\AppData\Local\Temp\e4jF87A.tmp_dir\i4jdel.exeexecutable
MD5:24F6D923EF6956ABD0449C879F36D7C7
SHA256:B8FE41DD005BB309F2ED4B81300CE0FBE4DDFC2A379A5101C11ECE47462D1997
116minecraftsp.exeC:\Users\admin\AppData\Local\Temp\e4jF87A.tmp_dir\exe4jlib.jarjava
MD5:C97D4F24CE40002EBDCBEB9148617E44
SHA256:411F86A58A889912D462EAD6BF382547476787AEC915BCC047CE7638608531B9
116minecraftsp.exeC:\Users\admin\AppData\Local\Temp\i4j3127910663911961288.tmpbinary
MD5:025288A9A7C5AAF438DCEFB0AE3CFC99
SHA256:14C8E6D9E9E0982345F88A8B473814FEF090A0A90054EBD0E44F2F2D71CD5D0A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
minecraftsp.exe