File name:

ShiginimaSE_v4400.zip

Full analysis: https://app.any.run/tasks/9b59534d-9b41-4b9b-b4ab-94f7aa764f90
Verdict: Malicious activity
Analysis date: July 27, 2020, 00:39:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

93BE8F75303B0987390E2B59F606CF88

SHA1:

61CB768106E6E449158EBB2608AD1327402D9FEC

SHA256:

A62E5272A29A926BC236EC2FA4F06D28600006751247039EB18F50FE95038A22

SSDEEP:

196608:C+ILEa1EQ+vazOBp5W5pjVtB3NafE/Ir907J3nmNuTOt76AFV3Ng7whe:fIIXQ+vUmp5YVSrqVmftXFVdg7wE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Shiginima Launcher SE v4400.exe (PID: 3680)

    • Loads dropped or rewritten executable

      • javaw.exe (PID: 2548)

  • SUSPICIOUS

    • Creates files in the user directory

      • javaw.exe (PID: 2548)
      • javaw.exe (PID: 2808)

    • Executable content was dropped or overwritten

      • javaw.exe (PID: 2808)

    • Executes JAVA applets

      • javaw.exe (PID: 2808)
      • Shiginima Launcher SE v4400.exe (PID: 3680)

    • Application launched itself

      • javaw.exe (PID: 2808)

  • INFO

    • Manual execution by user

      • Shiginima Launcher SE v4400.exe (PID: 3680)

    • Dropped object may contain Bitcoin addresses

      • javaw.exe (PID: 2808)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2020:01:31 18:08:17
ZipCRC: 0xa15bfea4
ZipCompressedSize: 1626
ZipUncompressedSize: 4188
ZipFileName: Changelog.txt
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs shiginima launcher se v4400.exe no specs javaw.exe javaw.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2548"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -Xmx512M -XX:+UseConcMarkSweepGC -XX:+CMSIncrementalMode -XX:-UseAdaptiveSizePolicy -Xmn128M -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Xss1M -Djava.library.path=C:\Users\admin\AppData\Roaming\.minecraft\versions\1.16.1\1.16.1-natives-131551465943 -Dminecraft.launcher.brand=java-minecraft-launcher "-Dminecraft.launcher.version=Shiginima Launcher v4.400" -cp C:\Users\admin\AppData\Roaming\.minecraft\libraries\com\mojang\patchy\1.1\patchy-1.1.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\oshi-project\oshi-core\1.1\oshi-core-1.1.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\net\java\dev\jna\jna\4.4.0\jna-4.4.0.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\net\java\dev\jna\platform\3.4.0\platform-3.4.0.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\com\ibm\icu\icu4j\66.1\icu4j-66.1.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\com\mojang\javabridge\1.0.22\javabridge-1.0.22.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\net\sf\jopt-simple\jopt-simple\5.0.3\jopt-simple-5.0.3.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-all\4.1.25.Final\netty-all-4.1.25.Final.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\com\google\guava\guava\21.0\guava-21.0.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\org\apache\commons\commons-lang3\3.5\commons-lang3-3.5.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\commons-io\commons-io\2.5\commons-io-2.5.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\commons-codec\commons-codec\1.10\commons-codec-1.10.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\net\java\jinput\jinput\2.0.5\jinput-2.0.5.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\net\java\jutils\jutils\1.0.0\jutils-1.0.0.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\com\mojang\brigadier\1.0.17\brigadier-1.0.17.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\com\mojang\datafixerupper\3.0.25\datafixerupper-3.0.25.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\com\google\code\gson\gson\2.8.0\gson-2.8.0.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\com\mojang\authlib\1.6.25\authlib-1.6.25.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\org\apache\commons\commons-compress\1.8.1\commons-compress-1.8.1.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\org\apache\httpcomponents\httpclient\4.3.3\httpclient-4.3.3.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\commons-logging\commons-logging\1.1.3\commons-logging-1.1.3.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\org\apache\httpcomponents\httpcore\4.3.2\httpcore-4.3.2.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\it\unimi\dsi\fastutil\8.2.1\fastutil-8.2.1.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-api\2.8.1\log4j-api-2.8.1.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-core\2.8.1\log4j-core-2.8.1.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.2.2\lwjgl-3.2.2.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.2.2\lwjgl-jemalloc-3.2.2.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.2.2\lwjgl-openal-3.2.2.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.2.2\lwjgl-opengl-3.2.2.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.2.2\lwjgl-glfw-3.2.2.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.2.2\lwjgl-stb-3.2.2.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.2.2\lwjgl-tinyfd-3.2.2.jar;C:\Users\admin\AppData\Roaming\.minecraft\libraries\com\mojang\text2speech\1.11.3\text2speech-1.11.3.jar;C:\Users\admin\AppData\Roaming\.minecraft\versions\1.16.1\1.16.1.jar net.minecraft.client.main.Main --username monkey --version 1.16.1 --gameDir C:\Users\admin\AppData\Roaming\.minecraft --assetsDir C:\Users\admin\AppData\Roaming\.minecraft\assets --assetIndex 1.16 --uuid d0763edaa9d93d2a9516280e9044d885 --accessToken d0763eda-a9d9-3d2a-9516-280e9044d885 --userType mojang --versionType releaseC:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\javaw.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2808"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -classpath "C:\Users\admin\Desktop\Shiginima Launcher SE v4400.exe" net.mc.main.MainC:\Program Files\Java\jre1.8.0_92\bin\javaw.exe
Shiginima Launcher SE v4400.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\javaw.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2896"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\ShiginimaSE_v4400.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3680"C:\Users\admin\Desktop\Shiginima Launcher SE v4400.exe" C:\Users\admin\Desktop\Shiginima Launcher SE v4400.exe—explorer.exe
User:
admin
Company:
Shiginima
Integrity Level:
MEDIUM
Description:
Shiginima Launcher SE v4.400
Exit code:
0
Version:
4.400
Modules
Images
c:\users\admin\desktop\shiginima launcher se v4400.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
362
Read events
334
Write events
28
Delete events
0

Modification events

(PID) Process:(2896) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2896) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2896) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\132\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2896) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\ShiginimaSE_v4400.zip
(PID) Process:(2896) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2896) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2896) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2896) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2896) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\132\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
(PID) Process:(2896) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
37
Suspicious files
22
Text files
316
Unknown types
2 313

Dropped files

PID
Process
Filename
Type
2896WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2896.27206\windows\Shiginima Launcher SE v4400.exe —
MD5:—
SHA256:—
2808javaw.exeC:\Users\admin\AppData\Local\Temp\imageio8404922793923600196.tmp —
MD5:—
SHA256:—
2808javaw.exeC:\Users\admin\AppData\Local\Temp\imageio2040589127819941667.tmp —
MD5:—
SHA256:—
2808javaw.exeC:\Users\admin\AppData\Local\Temp\imageio1661848046170027544.tmp —
MD5:—
SHA256:—
2808javaw.exeC:\Users\admin\AppData\Local\Temp\imageio898994565063039099.tmp —
MD5:—
SHA256:—
2808javaw.exeC:\Users\admin\AppData\Roaming\.minecraft\versions\1.16.1\1.16.1.jsontext
MD5:—
SHA256:—
2808javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:—
SHA256:—
2808javaw.exeC:\Users\admin\AppData\Roaming\.minecraft\launcher_profiles.jsontext
MD5:—
SHA256:—
2808javaw.exeC:\Users\admin\AppData\Roaming\.minecraft\assets\indexes\1.16.jsontext
MD5:—
SHA256:—
2808javaw.exeC:\Users\admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.2.2\lwjgl-tinyfd-3.2.2.jarjava
MD5:833E274C0DA2EAA37658F775BD5A2553
SHA256:2E084E0FAF7390979E7A19FC9605378B24DABC319BDD62A49DE9DEF331C67693
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2 536
TCP/UDP connections
43
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2808
javaw.exe
GET
200
198.252.102.62:80
http://servers.teamshiginima.com/placeholder.png
US
image
643 b
malicious
2808
javaw.exe
GET
200
143.204.201.30:80
http://resources.download.minecraft.net/90/90d599a1760137a7c4d7a52c77f5c65c02f137d4
US
ogg
129 Kb
shared
2808
javaw.exe
GET
200
143.204.201.30:80
http://resources.download.minecraft.net/bf/bffc19231be5589d395bb9d215d7595864511f92
US
ogg
14.7 Kb
shared
2808
javaw.exe
GET
200
143.204.201.30:80
http://resources.download.minecraft.net/bc/bcc73584d83225383aaa6affce905392c96afe86
US
ogg
10.1 Kb
shared
2808
javaw.exe
GET
200
143.204.201.30:80
http://resources.download.minecraft.net/6a/6a0e71c3d6e23485c1b0254ff0beed270bd4ba34
US
ogg
18.6 Kb
shared
2808
javaw.exe
GET
200
143.204.201.30:80
http://resources.download.minecraft.net/08/081ace8eafec0b668fd5d164f2a91e9ce84b5d41
US
ogg
332 Kb
shared
2808
javaw.exe
GET
200
143.204.201.30:80
http://resources.download.minecraft.net/30/30e920526eb5855065b873e30d17b4d85bfbe570
US
ogg
4.63 Kb
shared
2808
javaw.exe
GET
200
143.204.201.30:80
http://resources.download.minecraft.net/56/5645a0271b59de40793a6e6413bf2e6478702d9c
US
ogg
40.0 Kb
shared
2808
javaw.exe
GET
200
143.204.201.30:80
http://resources.download.minecraft.net/54/5488a01c534a16c2138c2f7072343d4179695477
US
ogg
4.99 Kb
shared
2808
javaw.exe
GET
200
143.204.201.30:80
http://resources.download.minecraft.net/1e/1ec3dff91a5db985385bf08d47749872cecc08d9
US
ogg
33.5 Kb
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2808
javaw.exe
143.204.212.134:443
launcher.mojang.com
—
US
unknown
2808
javaw.exe
99.86.4.83:443
libraries.minecraft.net
AT&T Services, Inc.
US
suspicious
2808
javaw.exe
143.204.201.32:80
resources.download.minecraft.net
—
US
suspicious
2808
javaw.exe
143.204.201.30:80
resources.download.minecraft.net
—
US
suspicious
2808
javaw.exe
198.252.102.62:80
teamshiginima.com
SoftLayer Technologies Inc.
US
suspicious
2808
javaw.exe
99.86.2.139:443
launchermeta.mojang.com
AT&T Services, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
teamshiginima.com
  • 198.252.102.62
whitelisted
servers.teamshiginima.com
  • 198.252.102.62
malicious
news.teamshiginima.com
  • 198.252.102.62
malicious
launchermeta.mojang.com
  • 99.86.2.139
whitelisted
libraries.minecraft.net
  • 99.86.4.83
shared
launcher.mojang.com
  • 143.204.212.134
whitelisted
resources.download.minecraft.net
  • 143.204.201.30
  • 143.204.201.56
  • 143.204.201.32
  • 143.204.201.31
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ShiginimaSE_v4400.zip