Resubmissions
25-08-2023 07:04
230825-hvyglsbd5x 1Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
25-08-2023 07:04
Static task
static1
Behavioral task
behavioral1
Sample
SchnurriTVs Sexmod-1.5.1.jar
Resource
win7-20230712-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
SchnurriTVs Sexmod-1.5.1.jar
Resource
win10v2004-20230703-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
SchnurriTVs Sexmod-1.5.1.jar
-
Size
56.6MB
-
MD5
b443b222cc1f63e85624210a95ad35d2
-
SHA1
6dc5378119928bb88643513e7a8aaa9aff3fbc79
-
SHA256
412f3d1e0bfa8e5f08eebd45398579921c2f030f1173732df8e47b819d5794bc
-
SHA512
a5bcc79a83b409c83a6b1b6289bfa1af3c7963c1761e964690366b01244cc70eae53aef994a0185f5e3bd0d05785a4da85d3f9540c7c2b8246f4301991e8c776
-
SSDEEP
786432:tzu1twlURpnfcEdUWRtx9FQ+8+V6RFFGoa4mUAo45yO+BfOvTY1sV7PiLnnod4V6:svxbn0mLFss6RFFlG5yOoD1sqLnoWGL
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2064 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2748 taskmgr.exe Token: SeDebugPrivilege 2064 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2748 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe 2064 taskmgr.exe
Processes
-
C:\Windows\system32\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\SchnurriTVs Sexmod-1.5.1.jar"1⤵PID:2892
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2748
-
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" SYSTEM1⤵PID:1896
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵PID:2312
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2064