URL:

https://www.minecraft.net/en-us/download

Full analysis: https://app.any.run/tasks/2ad0733f-d3cd-4eb1-8b08-6a2ed4e5f2ef
Verdict: Malicious activity
Analysis date: May 16, 2023, 13:39:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

A7F56903A5D6B07D351552EE0B4C516D

SHA1:

F3E2283A5C4AA77EB74F6D720389962B45B21D2E

SHA256:

3CA624430FC285396A3E100917D1475BEA3BE5E2A4FA22C108BE3977327CE298

SSDEEP:

3:N8DSLdE10Qd4z:2OLGKQdM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads settings of System Certificates

      • msiexec.exe (PID: 616)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 616)
      • msiexec.exe (PID: 2544)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 616)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1228)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3956)
      • msiexec.exe (PID: 2544)

    • The process checks LSA protection

      • msiexec.exe (PID: 616)
      • msiexec.exe (PID: 2544)
      • msiexec.exe (PID: 3764)
      • VSSVC.exe (PID: 1228)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3956)
      • iexplore.exe (PID: 1924)

    • Checks supported languages

      • msiexec.exe (PID: 2544)
      • msiexec.exe (PID: 3764)

    • Reads the computer name

      • msiexec.exe (PID: 2544)
      • msiexec.exe (PID: 3764)

    • Create files in a temporary directory

      • iexplore.exe (PID: 3956)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 2544)
      • msiexec.exe (PID: 3764)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs msiexec.exe no specs msiexec.exe no specs minecraftlauncher.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
616"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\MinecraftInstaller.msi" C:\Windows\System32\msiexec.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
1228C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1328C:\Windows\system32\MsiExec.exe -Embedding B20EA7BA1581B224B112241851FCF186 E Global\MSI0000C:\Windows\System32\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
1924"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3956 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2544C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3072"C:\Program Files\Minecraft Launcher\MinecraftLauncher.exe" C:\Program Files\Minecraft Launcher\MinecraftLauncher.exe—msiexec.exe
User:
admin
Company:
Mojang
Integrity Level:
MEDIUM
Description:
Minecraft Launcher
Exit code:
0
Version:
1.0.1.0
3164C:\Windows\system32\MsiExec.exe -Embedding A0E1F4AD49D04D132F8C242EC2D0054EC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3764C:\Windows\system32\MsiExec.exe -Embedding CF5C4738525F56C97A1522A42776C143 CC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3956"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.minecraft.net/en-us/download"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\version.dll
Total events
21 035
Read events
20 888
Write events
143
Delete events
4

Modification events

(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
11
Suspicious files
35
Text files
72
Unknown types
0

Dropped files

PID
Process
Filename
Type
1924iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
1924iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\headerclientLibNew.f443fbdcfbddc486e7f389a8ad1fbf99[1].csstext
MD5:F443FBDCFBDDC486E7F389A8AD1FBF99
SHA256:F437BAFB70D581BF774720E28B55CE7F83DFCF5DA0BFA7B4EE02BF51D563D7B8
1924iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:651DEDAECC42691C81E56A2F90E9F3B7
SHA256:18D10D439B3BF540844F4C5497ACC2E5C44FC70764068476F09DFD781D02531E
1924iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\7LX7KLY1.txttext
MD5:72DBD0EE493C56880006ED84EB0A36BF
SHA256:2741D931289DC61A7A58FEB58B3507CD2066400E6BA5F58C43338A5727CE0D2A
1924iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\footerclientLibNew.4298254c2f521026839606298de36594[1].csstext
MD5:4298254C2F521026839606298DE36594
SHA256:6C5CBFA62813B1710244BADE0E58DFFF2DF0F4517A8415012B2199DA2A197C1B
1924iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\components.fd32652655e83ceeb3c5aacb684a2964[1].csstext
MD5:FD32652655E83CEEB3C5AACB684A2964
SHA256:AECA2E42E5C54FDC2A87DE94705DEBB7D2A69D04FFEBDF63EAF5DD8AE4C11064
1924iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\dependencies.b6b906e8287b7e514c31dce6d060321f[1].csstext
MD5:B6B906E8287B7E514C31DCE6D060321F
SHA256:247F219B9497EDB5C995844BD311CA60271C0FF626A1793F153BB12988160F8D
1924iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\download[1].htmhtml
MD5:0EDAFCA4F27ADC6FA3C21FE52010BC16
SHA256:63CC1D60DA012866379228EAA3D04006C617DE1D5A798758DB8DC583F7A1161C
1924iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\container.027d01df25f17066242db969c9bf2ade[1].jstext
MD5:027D01DF25F17066242DB969C9BF2ADE
SHA256:FE05972EC9E5BDD020C2CBDEAE20D95D5643888EE2198C4EBF1145B1D60D30FF
1924iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\logo-minecraft[1].svgimage
MD5:E31A1564996C886A1945C9E1F294CDE9
SHA256:C510DB5A9D5FC52A2F507F6A5971CEDBDAE00DCCFB42B4993C919606FB5FE20F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
61
DNS requests
31
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3956
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
binary
1.47 Kb
whitelisted
1924
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?38e2b677295c939d
US
compressed
4.70 Kb
whitelisted
1924
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
US
binary
471 b
whitelisted
1924
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
binary
471 b
whitelisted
3956
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
1924
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e8d425d6aa679175
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1924
iexplore.exe
95.101.54.106:443
trial-eum-clienttons-s.akamaihd.net
Akamai International B.V.
DE
suspicious
1924
iexplore.exe
23.195.174.99:443
aka.ms
AKAMAI-AS
BR
unknown
3400
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1076
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1924
iexplore.exe
2.16.241.18:443
www.minecraft.net
Akamai International B.V.
DE
suspicious
1924
iexplore.exe
2.16.241.13:443
www.minecraft.net
Akamai International B.V.
DE
suspicious
1924
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3956
iexplore.exe
2.23.209.130:443
www.bing.com
Akamai International B.V.
GB
malicious

DNS requests

Domain
IP
Reputation
www.minecraft.net
  • 2.16.241.18
  • 2.16.241.13
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 2.23.209.130
  • 2.23.209.161
  • 2.23.209.179
  • 2.23.209.148
  • 2.23.209.182
  • 2.23.209.140
  • 2.23.209.133
  • 2.23.209.185
  • 2.23.209.149
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
target.microsoft.com
  • 54.228.15.58
  • 34.242.67.87
  • 52.209.226.252
  • 52.48.197.14
  • 52.48.71.111
  • 52.17.38.186
  • 54.77.106.194
  • 52.49.153.147
whitelisted
microsoftmscompoc.tt.omtrdc.net
  • 52.49.153.147
  • 54.77.106.194
  • 52.17.38.186
  • 52.48.71.111
  • 52.48.197.14
  • 52.209.226.252
  • 34.242.67.87
  • 54.228.15.58
whitelisted
assets.adobedtm.com
  • 23.32.184.226
whitelisted
wcpstatic.microsoft.com
  • 13.107.238.45
  • 13.107.237.45
whitelisted
s.go-mpulse.net
  • 2.23.196.132
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.minecraft.net/en-us/download