File name:

minecraftsp.exe

Full analysis: https://app.any.run/tasks/d6ca6855-0fd7-4ef5-ac6c-8f52493df6d2
Verdict: Malicious activity
Analysis date: January 15, 2024, 15:04:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5:

605A171C61A0607BDCF6BE80ED07CF95

SHA1:

477D4391B0D84406127E43EAD289A3596AC1E5E5

SHA256:

09B78DC85713CA0F27F17D94C939CC606A59847C1F2B5CDD281B52A48CDAEAB9

SSDEEP:

6144:4mmx3k74XODG40zQG7NP0nuc6Hzp3wT66vlm4LbHL+pNn40yY7MmI2lPN:ax3u9q400uB74fKL0mB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • minecraftsp.exe (PID: 116)

  • SUSPICIOUS

    • Checks for Java to be installed

      • minecraftsp.exe (PID: 116)
      • javaw.exe (PID: 268)

    • Executable content was dropped or overwritten

      • minecraftsp.exe (PID: 116)

  • INFO

    • Checks supported languages

      • minecraftsp.exe (PID: 116)
      • java.exe (PID: 1072)
      • javaw.exe (PID: 268)
      • i4jdel0.exe (PID: 1632)

    • Create files in a temporary directory

      • minecraftsp.exe (PID: 116)
      • java.exe (PID: 1072)
      • javaw.exe (PID: 268)

    • Creates files in the program directory

      • java.exe (PID: 1072)

    • Reads the machine GUID from the registry

      • minecraftsp.exe (PID: 116)

    • Reads the computer name

      • minecraftsp.exe (PID: 116)

    • Manual execution by a user

      • WINWORD.EXE (PID: 2056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (35)
.exe | Win64 Executable (generic) (30.9)
.scr | Windows screen saver (14.6)
.dll | Win32 Dynamic Link Library (generic) (7.3)
.exe | Win32 Executable (generic) (5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:06:14 16:51:18+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, No debug
PEType: PE32
LinkerVersion: 2.56
CodeSize: 128000
InitializedDataSize: 494592
UninitializedDataSize: 50688
EntryPoint: 0x11d8
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 12.1.2.0
ProductVersionNumber: 12.1.2.0
FileFlagsMask: 0x0017
FileFlags: Debug
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: AnjoCaido
FileDescription: Free launcher for Minecraft Alpha
FileVersion: 12.1.2.0
LegalCopyright: 2010 AnjoCaido (but Mojang have the rights over the game, you pirate!)
ProductName: MinecraftSP
ProductVersion: 12.1.2.0
OriginalFileName: MinecraftSP.exe
InternalName: MinecraftSP
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start minecraftsp.exe java.exe no specs icacls.exe no specs javaw.exe no specs i4jdel0.exe no specs PhotoViewer.dll no specs winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\AppData\Local\Temp\minecraftsp.exe" C:\Users\admin\AppData\Local\Temp\minecraftsp.exe
explorer.exe
User:
admin
Company:
AnjoCaido
Integrity Level:
MEDIUM
Description:
Free launcher for Minecraft Alpha
Exit code:
0
Version:
12.1.2.0
Modules
Images
c:\users\admin\appdata\local\temp\minecraftsp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
268javaw -Xms512m -Xmx1024m -Dsun.java2d.noddraw=true -Dsun.java2d.d3d=false -Dsun.java2d.opengl=false -Dsun.java2d.pmoffscreen=false -classpath /C:/Users/admin/AppData/Local/Temp/e4jF780.tmp_dir/MinecraftSP.jar net.minecraft.LauncherFrameC:\Program Files\Common Files\Oracle\Java\javapath_target_52116515\javaw.exe—minecraftsp.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
Modules
Images
c:\program files\common files\oracle\java\javapath_target_52116515\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1072c:\PROGRA~1\java\JRE18~1.0_2\bin\java.exe -versionC:\Program Files\Java\jre1.8.0_271\bin\java.exe—minecraftsp.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.2710.9
Modules
Images
c:\program files\java\jre1.8.0_271\bin\java.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1596C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1632C:\Users\admin\AppData\Local\Temp\i4jdel0.exe i4j724911930559368777.tmpC:\Users\admin\AppData\Local\Temp\i4jdel0.exe—minecraftsp.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\i4jdel0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2056"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\regardingrequired.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
2068C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\System32\icacls.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
Total events
3 248
Read events
3 071
Write events
36
Delete events
141

Modification events

(PID) Process:(1596) dllhost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Explorer.EXE
(PID) Process:(1596) dllhost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Photo Viewer\Viewer
Operation:writeName:MainWndPos
Value:
6000000034000000A00400008002000000000000
(PID) Process:(1596) dllhost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Photo Viewer\Viewer
Operation:writeName:MainWndPos
Value:
6000000034000000A00400008002000001000000
(PID) Process:(2056) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2056) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(2056) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(2056) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(2056) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(2056) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(2056) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
Executable files
5
Suspicious files
7
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2056WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRCB6A.tmp.cvr —
MD5:—
SHA256:—
116minecraftsp.exeC:\Users\admin\AppData\Local\Temp\e4jF780.tmp_dir\exe4jlib.jarjava
MD5:C97D4F24CE40002EBDCBEB9148617E44
SHA256:411F86A58A889912D462EAD6BF382547476787AEC915BCC047CE7638608531B9
116minecraftsp.exeC:\Users\admin\AppData\Local\Temp\e4jF7A0.tmptext
MD5:04C435364568AB98120F802C798CFD68
SHA256:7A7FE5291BA42E11E8FA94839E219AB65E3B1411244ECDEFA4222CC60A63ED61
116minecraftsp.exeC:\Users\admin\AppData\Local\Temp\e4jF780.tmp_dir\i4jdel.exeexecutable
MD5:24F6D923EF6956ABD0449C879F36D7C7
SHA256:B8FE41DD005BB309F2ED4B81300CE0FBE4DDFC2A379A5101C11ECE47462D1997
116minecraftsp.exeC:\Users\admin\AppData\Local\Temp\i4j724911930559368777.tmpbinary
MD5:FDBEAC77F45EDDF8AC314CF61C8B690A
SHA256:2E76EFC64A23CF90EE982A7C7344985A0AEDC68086E024BE186C7D2FF7FD01AA
116minecraftsp.exeC:\Users\admin\AppData\Local\Temp\i4jdel0.exeexecutable
MD5:24F6D923EF6956ABD0449C879F36D7C7
SHA256:B8FE41DD005BB309F2ED4B81300CE0FBE4DDFC2A379A5101C11ECE47462D1997
116minecraftsp.exeC:\Users\admin\AppData\Local\Temp\e4jF780.tmp_dir\MinecraftSP.jarjava
MD5:4ECA7879FF514CDD79C290701443EEDD
SHA256:3D1DBCA922045D5ECCC744E6F9F6E56FEF73A371A8BC0826E76FB041824073C0
1072java.exeC:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8061.timestamptext
MD5:27A0C11379D8B0D05B5BCE4D3E71D908
SHA256:3395130B424161060CCE41E6340FBF0F695B026F48937D3B637E72B5018D8A9C
2056WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:007A839E1CA39F280F7719CB16AB494A
SHA256:CBC1CF549C985916CDE25E1FA818AB354805DEC12A7615A6257904A227E5B409
2056WINWORD.EXEC:\Users\admin\Desktop\~$gardingrequired.rtfbinary
MD5:52A20C659E3B463EEABDDC963ED4BFFC
SHA256:3E1A5B250795E8247A2E364A8AA1C3A294B27560D5D1CC78F027479A92625F8B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
minecraftsp.exe