File name:

Minecraft.exe

Full analysis: https://app.any.run/tasks/11d4cd67-75af-4e99-b53f-105d57a36d4e
Verdict: Malicious activity
Analysis date: November 11, 2024, 01:43:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

9884D456D33451815BB2B096F06AFE60

SHA1:

E63663722B328BD45EEEB4A60B0262E97C1B1785

SHA256:

857B7EC30CF649F7BD1406AF32CDB1C170439ED3B82C901264562B3C2C605E1B

SSDEEP:

24576:tq0ufqgHzVcrgp9z0wkFmurww7c2vRJwMOZkoQMfSJsehK+dT87qTaSVqITmEtyr:tqffqgHzVcrgp9z0wkFmurww7c2vRGMA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts REAGENTC.EXE to disable the Windows Recovery Environment

      • ReAgentc.exe (PID: 5080)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 3824)

    • UAC/LUA settings modification

      • reg.exe (PID: 2224)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Minecraft.exe (PID: 5084)
      • xcopy.exe (PID: 6476)
      • xcopy.exe (PID: 3764)
      • xcopy.exe (PID: 7104)
      • cmd.exe (PID: 3824)
      • xcopy.exe (PID: 6996)
      • xcopy.exe (PID: 7140)

    • Starts CMD.EXE for commands execution

      • Minecraft.exe (PID: 5084)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 3824)

    • Process copies executable file

      • cmd.exe (PID: 3824)

    • The process executes VB scripts

      • cmd.exe (PID: 3824)

    • Executing commands from a ".bat" file

      • Minecraft.exe (PID: 5084)

    • Changes the desktop background image

      • reg.exe (PID: 1452)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 3824)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 3824)

    • Uses RUNDLL32.EXE to load library

      • cmd.exe (PID: 3824)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 3824)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3824)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 2588)
      • Minecraft.exe (PID: 5084)

    • The system shut down or reboot

      • cmd.exe (PID: 3824)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 2912)
      • nfm_startup.exe (PID: 3012)

  • INFO

    • Create files in a temporary directory

      • Minecraft.exe (PID: 5084)

    • Checks supported languages

      • Minecraft.exe (PID: 5084)
      • ShellExperienceHost.exe (PID: 2588)

    • Creates files or folders in the user directory

      • Minecraft.exe (PID: 5084)
      • cmd.exe (PID: 3824)

    • Reads the computer name

      • Minecraft.exe (PID: 5084)
      • ShellExperienceHost.exe (PID: 2588)

    • Reads Microsoft Office registry keys

      • cmd.exe (PID: 3824)

    • Reads security settings of Internet Explorer

      • cmd.exe (PID: 3824)

    • The process uses the downloaded file

      • cmd.exe (PID: 3824)
      • Minecraft.exe (PID: 5084)

    • Process checks computer location settings

      • Minecraft.exe (PID: 5084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (35)
.exe | Win64 Executable (generic) (30.9)
.scr | Windows screen saver (14.6)
.dll | Win32 Dynamic Link Library (generic) (7.3)
.exe | Win32 Executable (generic) (5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:07:30 08:52:50+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 2.5
CodeSize: 68608
InitializedDataSize: 753152
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.1.2600.2007
ProductVersionNumber: 5.1.2600.2007
FileFlagsMask: 0x003f
FileFlags: Debug, Pre-release, Private build
FileOS: Windows 16-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
FileVersion: 5.1.2600.2007
ProductVersion: 5.1.2600.2007
ProductName: Minecraft Launcher
OriginalFileName: MinecraftLauncher.exe
FileDescription: Minecraft Launcher
CompanyName: Mojang
LegalCopyright: Copyright (C) Mojang Specifications
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
260
Monitored processes
33
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start minecraft.exe cmd.exe conhost.exe no specs wscript.exe no specs ping.exe no specs reagentc.exe no specs xcopy.exe no specs xcopy.exe no specs xcopy.exe xcopy.exe no specs xcopy.exe xcopy.exe xcopy.exe no specs xcopy.exe no specs xcopy.exe no specs xcopy.exe no specs xcopy.exe no specs xcopy.exe reg.exe no specs reg.exe no specs reg.exe no specs takeown.exe no specs icacls.exe no specs icacls.exe no specs xcopy.exe rundll32.exe no specs schtasks.exe no specs shellexperiencehost.exe no specs taskkill.exe no specs shutdown.exe no specs plugscheduler.exe no specs nfm_startup.exe no specs minecraft.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
764"C:\Users\admin\AppData\Local\Temp\Minecraft.exe" C:\Users\admin\AppData\Local\Temp\Minecraft.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\minecraft.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
948xcopy Minecraft.ico C:\WINDOWS\NoFreeMinecraft32C:\Windows\System32\xcopy.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Extended Copy Utility
Exit code:
4
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\xcopy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\ifsutil.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
1252RUNDLL32.EXE user32.dll,UpdatePerUserSystemParametersC:\Windows\System32\rundll32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
1452reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\WINDOWS\NoFreeMinecraft32\cursed.bmp /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1700takeown /f UserAccountControlSettings.exeC:\Windows\System32\takeown.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Takes ownership of a file
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\takeown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2224reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2484reg ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2588xcopy cursed.bmp C:\WINDOWS\NoFreeMinecraft32C:\Windows\System32\xcopy.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Extended Copy Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\xcopy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ifsutil.dll
c:\windows\system32\ulib.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
2588"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
2912"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Total events
3 611
Read events
3 537
Write events
14
Delete events
60

Modification events

(PID) Process:(3824) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
Operation:writeName:VBSFile
Value:
(PID) Process:(5080) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(5080) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(5080) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:delete keyName:(default)
Value:
(PID) Process:(5080) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:writeName:Element
Value:
\EFI\Microsoft\Boot\bootmgfw.efi
(PID) Process:(5080) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(5080) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(5080) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\12000002
Operation:delete keyName:(default)
Value:
(PID) Process:(5080) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\12000002
Operation:writeName:Element
Value:
\EFI\Boot\Loader.efi
(PID) Process:(5080) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Description
Operation:delete keyName:(default)
Value:
Executable files
10
Suspicious files
44
Text files
437
Unknown types
3

Dropped files

PID
Process
Filename
Type
5080ReAgentc.exeC:\Windows\System32\Recovery\Winre.wim —
MD5:—
SHA256:—
5084Minecraft.exeC:\Users\admin\AppData\Roaming\nfm_crasher.exeexecutable
MD5:4DF6DD00C296ABAEA59CD59D5F63B2EB
SHA256:2E35DEB7E4CFD1AEF3582C5F67720B5F10BFBAD22E092A0D79A8823AC72E85A9
5084Minecraft.exeC:\Users\admin\AppData\Roaming\UserAccountControlSettings.exeexecutable
MD5:D067CFD0D47FD3DC846C9DB6906D4D9C
SHA256:209566080365FEECC73679E44240084178C2F84130E9148E9925557DB8621D49
5084Minecraft.exeC:\Users\admin\AppData\Roaming\shortcut1.ur_binary
MD5:9D88D80C2A65237E2DF62B3683F3CC09
SHA256:BF363934DCC7ED01DA378C7E51B270709C430013DD42007FB16F8C42F5D7682E
5084Minecraft.exeC:\Users\admin\AppData\Roaming\shortcut2.ur_url
MD5:1449D2233140B8DDF3F3D48253BD3D9A
SHA256:B766A5756DA66A348DE1FCB5BD5F2D7EC59E3B139526A96B28D2404CFB9E28F7
5084Minecraft.exeC:\Users\admin\AppData\Roaming\shortcut4.ur_binary
MD5:C4FB9A78EECDC05DD9302A4045C42BC5
SHA256:BA4E66F656828F8573998495209A7BD5641E2C01E43A3CBAC73242FE32248D1E
5084Minecraft.exeC:\Users\admin\AppData\Roaming\melter.exeexecutable
MD5:E5E06D7CDE72CC9FE49E214475ED532B
SHA256:52E7E96581709DFB8FB97200DDEE6C7E48DDF7AE6617E994AC17B73CAF388D0A
5084Minecraft.exeC:\Users\admin\AppData\Roaming\shortcut5.ur_url
MD5:1D27AFFB9D17270E2E9BD54360D1D869
SHA256:2AEBEB12638816F06D0EA6A98403974F19902F4B8CD49EF65FB0D74AA0E105CF
3824cmd.exeC:\Users\admin\AppData\Roaming\idk.vbstext
MD5:16BD5B54C1ABF87675DB1DA17633E9EA
SHA256:4F3210A24A126CE27D926377E662EC2C516F01A51759BFE71E204CD523A494D4
5084Minecraft.exeC:\Users\admin\AppData\Roaming\shortcut3.ur_binary
MD5:A8F2644E666C7EAC2BA4F3ACBF3DCF97
SHA256:276958238249BCB1303852C496C75225052496FE0EAB8687BA8C07E2A487A282
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
28
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2364
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6944
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4020
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
816
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4360
SearchApp.exe
104.126.37.145:443
www.bing.com
Akamai International B.V.
DE
whitelisted
2364
svchost.exe
20.190.159.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 172.217.18.14
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.139
  • 104.126.37.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.71
  • 40.126.31.71
  • 40.126.31.67
  • 20.190.159.68
  • 20.190.159.0
  • 20.190.159.23
  • 40.126.31.73
  • 20.190.159.4
whitelisted
go.microsoft.com
  • 184.30.17.189
  • 184.28.89.167
whitelisted
self.events.data.microsoft.com
  • 20.189.173.14
whitelisted
officeclient.microsoft.com
  • 52.109.76.240
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Minecraft.exe