URL:

https://www.minecraft.net/en-us/download

Full analysis: https://app.any.run/tasks/2ad0733f-d3cd-4eb1-8b08-6a2ed4e5f2ef
Verdict: Malicious activity
Analysis date: May 16, 2023, 13:39:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

A7F56903A5D6B07D351552EE0B4C516D

SHA1:

F3E2283A5C4AA77EB74F6D720389962B45B21D2E

SHA256:

3CA624430FC285396A3E100917D1475BEA3BE5E2A4FA22C108BE3977327CE298

SSDEEP:

3:N8DSLdE10Qd4z:2OLGKQdM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads settings of System Certificates

      • msiexec.exe (PID: 616)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 616)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1228)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 616)
      • msiexec.exe (PID: 2544)

  • INFO

    • Create files in a temporary directory

      • iexplore.exe (PID: 3956)

    • The process checks LSA protection

      • msiexec.exe (PID: 616)
      • msiexec.exe (PID: 2544)
      • msiexec.exe (PID: 3764)
      • VSSVC.exe (PID: 1228)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3956)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3956)
      • iexplore.exe (PID: 1924)

    • Application launched itself

      • iexplore.exe (PID: 3956)
      • msiexec.exe (PID: 2544)

    • Checks supported languages

      • msiexec.exe (PID: 2544)
      • msiexec.exe (PID: 3764)

    • Reads the computer name

      • msiexec.exe (PID: 2544)
      • msiexec.exe (PID: 3764)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 2544)
      • msiexec.exe (PID: 3764)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs msiexec.exe no specs msiexec.exe no specs minecraftlauncher.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
616"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\MinecraftInstaller.msi" C:\Windows\System32\msiexec.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
1228C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1328C:\Windows\system32\MsiExec.exe -Embedding B20EA7BA1581B224B112241851FCF186 E Global\MSI0000C:\Windows\System32\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
1924"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3956 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2544C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3072"C:\Program Files\Minecraft Launcher\MinecraftLauncher.exe" C:\Program Files\Minecraft Launcher\MinecraftLauncher.exe—msiexec.exe
User:
admin
Company:
Mojang
Integrity Level:
MEDIUM
Description:
Minecraft Launcher
Exit code:
0
Version:
1.0.1.0
3164C:\Windows\system32\MsiExec.exe -Embedding A0E1F4AD49D04D132F8C242EC2D0054EC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3764C:\Windows\system32\MsiExec.exe -Embedding CF5C4738525F56C97A1522A42776C143 CC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3956"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.minecraft.net/en-us/download"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\version.dll
Total events
21 035
Read events
20 888
Write events
143
Delete events
4

Modification events

(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3956) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
11
Suspicious files
35
Text files
72
Unknown types
0

Dropped files

PID
Process
Filename
Type
1924iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\MUB1463U.txttext
MD5:2F9E6D6711A60FDBCB381C29A184C451
SHA256:92856F3DA8A56376280ED9897DDEFCADF805AC452091A8C9188018F75AAAF6FD
1924iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\7LX7KLY1.txttext
MD5:72DBD0EE493C56880006ED84EB0A36BF
SHA256:2741D931289DC61A7A58FEB58B3507CD2066400E6BA5F58C43338A5727CE0D2A
1924iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\footerclientLibNew.4298254c2f521026839606298de36594[1].csstext
MD5:4298254C2F521026839606298DE36594
SHA256:6C5CBFA62813B1710244BADE0E58DFFF2DF0F4517A8415012B2199DA2A197C1B
1924iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECEbinary
MD5:462CE8E9A1C194AB4E8AF231860847DF
SHA256:22BC2A970E7C4AA80370CB43733802704C3393330B39C9908DF72DA9AC564278
1924iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:651DEDAECC42691C81E56A2F90E9F3B7
SHA256:18D10D439B3BF540844F4C5497ACC2E5C44FC70764068476F09DFD781D02531E
1924iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
1924iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECEbinary
MD5:BB91FE4CE312CBCBACDF25906C651C2C
SHA256:DD65DCE648FD1BF3D1EC1486B60E88D8B7F4E046C9ADF1674F3F9F88EFFDCBAB
1924iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\download[1].htmhtml
MD5:0EDAFCA4F27ADC6FA3C21FE52010BC16
SHA256:63CC1D60DA012866379228EAA3D04006C617DE1D5A798758DB8DC583F7A1161C
1924iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\dependencies.b6b906e8287b7e514c31dce6d060321f[1].csstext
MD5:B6B906E8287B7E514C31DCE6D060321F
SHA256:247F219B9497EDB5C995844BD311CA60271C0FF626A1793F153BB12988160F8D
1924iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\components.fd32652655e83ceeb3c5aacb684a2964[1].csstext
MD5:FD32652655E83CEEB3C5AACB684A2964
SHA256:AECA2E42E5C54FDC2A87DE94705DEBB7D2A69D04FFEBDF63EAF5DD8AE4C11064
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
61
DNS requests
31
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1924
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
binary
471 b
whitelisted
3956
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
3956
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
binary
1.47 Kb
whitelisted
1924
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?38e2b677295c939d
US
compressed
4.70 Kb
whitelisted
1924
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e8d425d6aa679175
US
compressed
4.70 Kb
whitelisted
1924
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
US
binary
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3400
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1924
iexplore.exe
2.16.241.18:443
www.minecraft.net
Akamai International B.V.
DE
suspicious
3956
iexplore.exe
2.23.209.130:443
www.bing.com
Akamai International B.V.
GB
malicious
1924
iexplore.exe
2.16.241.13:443
www.minecraft.net
Akamai International B.V.
DE
suspicious
1924
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
1924
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1924
iexplore.exe
13.107.238.45:443
wcpstatic.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1924
iexplore.exe
2.23.196.132:443
s.go-mpulse.net
CW Vodafone Group PLC
GB
unknown
1924
iexplore.exe
23.215.21.253:443
c.go-mpulse.net
Akamai International B.V.
US
unknown
1924
iexplore.exe
23.32.184.226:443
assets.adobedtm.com
AKAMAI-AS
BR
suspicious

DNS requests

Domain
IP
Reputation
www.minecraft.net
  • 2.16.241.18
  • 2.16.241.13
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 2.23.209.130
  • 2.23.209.161
  • 2.23.209.179
  • 2.23.209.148
  • 2.23.209.182
  • 2.23.209.140
  • 2.23.209.133
  • 2.23.209.185
  • 2.23.209.149
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
target.microsoft.com
  • 54.228.15.58
  • 34.242.67.87
  • 52.209.226.252
  • 52.48.197.14
  • 52.48.71.111
  • 52.17.38.186
  • 54.77.106.194
  • 52.49.153.147
whitelisted
microsoftmscompoc.tt.omtrdc.net
  • 52.49.153.147
  • 54.77.106.194
  • 52.17.38.186
  • 52.48.71.111
  • 52.48.197.14
  • 52.209.226.252
  • 34.242.67.87
  • 54.228.15.58
whitelisted
assets.adobedtm.com
  • 23.32.184.226
whitelisted
wcpstatic.microsoft.com
  • 13.107.238.45
  • 13.107.237.45
whitelisted
s.go-mpulse.net
  • 2.23.196.132
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.minecraft.net/en-us/download