Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04/08/2023, 11:25
Static task
static1
Behavioral task
behavioral1
Sample
Jenny-Mod-Forge-1.12.2-v1.7.5.jar
Resource
win7-20230712-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Jenny-Mod-Forge-1.12.2-v1.7.5.jar
Resource
win10v2004-20230703-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
Jenny-Mod-Forge-1.12.2-v1.7.5.jar
-
Size
42.1MB
-
MD5
0a12643f832adb4fcd0ebefc61d9a91c
-
SHA1
efb352802a70ec9090d174f5ec4ad45ee9c67609
-
SHA256
fb68801e43b7537294c9d77b0459cfb2413c5128a554875178f769545e693d7b
-
SHA512
9b4671b96660f7844e2b5296d7513781f20ca3a86b3e453d5081ce2bf7810d31232fb863925a454a326714a5e484273408a700ab6e63caaf64e57ba8e4b05ad1
-
SSDEEP
786432:V+L97lHfurN3Fg4r22t5Zs82tnjpXPeglyRHdWLDCNT/CxZDRa9xDtM31G:qtgN3Lv3sRpmcg9WLDC9CyOG
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2856 taskmgr.exe Token: SeSystemProfilePrivilege 2856 taskmgr.exe Token: SeCreateGlobalPrivilege 2856 taskmgr.exe Token: 33 2856 taskmgr.exe Token: SeIncBasePriorityPrivilege 2856 taskmgr.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe -
Suspicious use of SendNotifyMessage 51 IoCs
pid Process 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Jenny-Mod-Forge-1.12.2-v1.7.5.jar1⤵PID:4692
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2856