Analysis
-
max time kernel
27s -
max time network
20s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
29-10-2021 12:58
Static task
static1
Behavioral task
behavioral1
Sample
INV-7776-TCLTD.jar
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
-
Target
INV-7776-TCLTD.jar
-
Size
495KB
-
MD5
dd3331428fe8070e0cd89a20b1c4620f
-
SHA1
68c1c50083d968c5b92937cf8a87bc1c1df69420
-
SHA256
2c452e378b2ad8e0192bc804096eae9abc1e3fa3b9bd9cce4994217acfa239b9
-
SHA512
e0521d421243ab84c2c42d93bd5f09d229c08d9d21c284267225327020bca9aa84019674f9f6b6aaca23ec451a427287c64c4cfea64f913f5c0c5da02edc7666
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
taskmgr.exepid process 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 968 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 968 taskmgr.exe -
Suspicious use of FindShellTrayWindow 47 IoCs
Processes:
taskmgr.exepid process 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe -
Suspicious use of SendNotifyMessage 47 IoCs
Processes:
taskmgr.exepid process 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe 968 taskmgr.exe
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\INV-7776-TCLTD.jar1⤵PID:268
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:968