Overview
overview
5Static
static
3weka-3-9-6...ws.exe
windows11-21h2-x64
4RunWeka.bat
windows11-21h2-x64
5WekaManual.pdf
windows11-21h2-x64
1changelogs...0.html
windows11-21h2-x64
1doc/script...min.js
windows11-21h2-x64
1doc/script...min.js
windows11-21h2-x64
1doc/script.js
windows11-21h2-x64
1doc/search.js
windows11-21h2-x64
1doc/serial...m.html
windows11-21h2-x64
1doc/tag-se...dex.js
windows11-21h2-x64
1doc/type-s...dex.js
windows11-21h2-x64
1doc/weka/R...e.html
windows11-21h2-x64
1doc/weka/Run.html
windows11-21h2-x64
1doc/weka/a...r.html
windows11-21h2-x64
1doc/weka/a...i.html
windows11-21h2-x64
1doc/weka/a...t.html
windows11-21h2-x64
1doc/weka/a...e.html
windows11-21h2-x64
1doc/weka/a...s.html
windows11-21h2-x64
1doc/weka/a...r.html
windows11-21h2-x64
1doc/weka/a...r.html
windows11-21h2-x64
1doc/weka/a...n.html
windows11-21h2-x64
1doc/weka/a...m.html
windows11-21h2-x64
1doc/weka/a...r.html
windows11-21h2-x64
1doc/weka/a...r.html
windows11-21h2-x64
1doc/weka/a...E.html
windows11-21h2-x64
1doc/weka/a...e.html
windows11-21h2-x64
1doc/weka/a...h.html
windows11-21h2-x64
1doc/weka/a...s.html
windows11-21h2-x64
1doc/weka/a...r.html
windows11-21h2-x64
1doc/weka/a...m.html
windows11-21h2-x64
1doc/weka/a...t.html
windows11-21h2-x64
1doc/weka/a...t.html
windows11-21h2-x64
1Analysis
-
max time kernel
123s -
max time network
140s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
22/02/2024, 15:25
Behavioral task
behavioral1
Sample
weka-3-9-6-azul-zulu-windows.exe
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
RunWeka.bat
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
WekaManual.pdf
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
changelogs/CHANGELOG-3-5-0.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
doc/script-dir/jquery-3.5.1.min.js
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
doc/script-dir/jquery-ui.min.js
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
doc/script.js
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
doc/search.js
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
doc/serialized-form.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
doc/tag-search-index.js
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
doc/type-search-index.js
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
doc/weka/Run.SchemeType.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
doc/weka/Run.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
doc/weka/associations/AbstractAssociator.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
doc/weka/associations/Apriori.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
doc/weka/associations/AprioriItemSet.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
doc/weka/associations/AssociationRule.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
doc/weka/associations/AssociationRules.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
doc/weka/associations/AssociationRulesProducer.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
doc/weka/associations/Associator.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
doc/weka/associations/AssociatorEvaluation.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
doc/weka/associations/BinaryItem.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
doc/weka/associations/CARuleMiner.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
doc/weka/associations/CheckAssociator.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
doc/weka/associations/DefaultAssociationRule.METRIC_TYPE.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
doc/weka/associations/DefaultAssociationRule.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
doc/weka/associations/FPGrowth.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
doc/weka/associations/FilteredAssociationRules.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
doc/weka/associations/FilteredAssociator.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
doc/weka/associations/Item.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
doc/weka/associations/ItemSet.html
Resource
win11-20240221-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
doc/weka/associations/LabeledItemSet.html
Resource
win11-20240221-en
windows11-21h2-x64
General
-
Target
weka-3-9-6-azul-zulu-windows.exe
-
Size
126.9MB
-
MD5
6a1b2c1bfb5622c104ac8bd3d6248f3f
-
SHA1
10b213eb1c3a54030eeb9b2cdfa2c4e0b7a6ae4f
-
SHA256
e21d58bd08e5380dbac2aa665c0371f126dab74a4420cc949fa1c1a16e860c92
-
SHA512
518fdb0a4ddca54060d1905e8fb923d3f9cd952855cb55858220f2075e1ac6304882d23d5cecbc1c95a21db792ec3e8c3193be5a6c3d28ab31ddbeedaba145da
-
SSDEEP
3145728:QvWG6EVGRZGAKa+LYlVHQqxY7NFdp8eIPhtcv+JMUI:QMRKjU7mRxB7+WUI
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Weka-3-9-6\doc\weka\core\tokenizers\CharacterNGramTokenizer.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\beans\GraphViewerBeanInfo.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\knowledgeflow\steps\FlowByExpression.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\bin\api-ms-win-crt-convert-l1-1-0.dll weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\bin\api-ms-win-crt-time-l1-1-0.dll weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\classifiers\bayes\net\search\ci\package-summary.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\pmml\jaxbbindings\TreeModel.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\classifiers\bayes\net\search\ci\CISearchAlgorithm.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\experiment\xml\XMLExperiment.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\filters\supervised\attribute\package-tree.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\graphvisualizer\BIFParser.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\bin\api-ms-win-core-synch-l1-2-0.dll weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\bin\klist.exe weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\converters\StreamTokenizerUtils.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\pmml\jaxbbindings\DocumentTermMatrix.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\filters\unsupervised\attribute\StringToWordVector.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\scripting\event\package-tree.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\sql\ResultSetHelper.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\associations\AbstractAssociator.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\neighboursearch\balltrees\MedianDistanceFromArbitraryPoint.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\EnvironmentField.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\knowledgeflow\steps\ImageSaver.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\knowledgeflow\steps\Loader.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\knowledgeflow\JobEnvironment.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\experiment\ExperimenterDefaults.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\attributeSelection\ReliefFAttributeEval.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\classifiers\bayes\BayesNet.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\pmml\jaxbbindings\CityBlock.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\pmml\jaxbbindings\FieldValue.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\beans\ClustererBeanInfo.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\beans\NoteCustomizer.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\beans\ImageEvent.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\simplecli\Script.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\AlgVector.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\pmml\jaxbbindings\TextDocument.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\pmml\jaxbbindings\package-summary.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\experiment\PropertyNode.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\legal\jdk.security.jgss\ADDITIONAL_LICENSE_INFO weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\MultiInstanceCapabilitiesHandler.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\expressionlanguage\weka\package-tree.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\associations\package-summary.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\InheritanceUtils.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\sql\QueryPanel.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\bin\api-ms-win-core-timezone-l1-1-0.dll weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\changelogs\CHANGELOG-3-7-9 weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\classifiers\Sourcable.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\beans\Loader.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\beans\MetaBean.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\knowledgeflow\steps\ModelPerformanceChartStepEditorDialog.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\legal\javafx.web\libxslt.md weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\data\diabetes.arff weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\visualize\VisualizePanelListener.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\legal\java.naming\ASSEMBLY_EXCEPTION weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\legal\java.net.http\ASSEMBLY_EXCEPTION weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\legal\jdk.management.agent\ASSEMBLY_EXCEPTION weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\changelogs\CHANGELOG_PACKAGES-3-7-2 weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\classifiers\trees\lmt\SimpleLinearRegression.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\pmml\jaxbbindings\XCoordinates.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\experiment\TaskStatusInfo.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\filters\unsupervised\attribute\RemoveType.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\filters\unsupervised\attribute\TimeSeriesTranslate.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\converters\MatlabLoader.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\pmml\jaxbbindings\TimeAnchor.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\datagenerators\DataGenerator.html weka-3-9-6-azul-zulu-windows.exe -
Loads dropped DLL 3 IoCs
pid Process 2588 weka-3-9-6-azul-zulu-windows.exe 2588 weka-3-9-6-azul-zulu-windows.exe 2588 weka-3-9-6-azul-zulu-windows.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 41 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFMLFlowFile\shell weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ARFFDataFile\ = "ARFF Data File" weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ARFFDataFile\DefaultIcon weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XRFFDataFile\DefaultIcon\ = "C:\\Program Files\\Weka-3-9-6\\weka.ico" weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XRFFDataFile\shell\open\command weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KFFlowFile\DefaultIcon\ = "C:\\Program Files\\Weka-3-9-6\\weka.ico" weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KFFlowFile\shell\open\command\ = "\"C:\\Program Files\\Weka-3-9-6\\jre\\zulu17.32.13-ca-fx-jre17.0.2-win_x64\\bin\\javaw.exe\" \"-classpath\" \"C:\\Program Files\\Weka-3-9-6\" \"RunWeka\" \"-i\" \"C:\\Program Files\\Weka-3-9-6\\RunWeka.ini\" \"-w\" \"C:\\Program Files\\Weka-3-9-6\\weka.jar\" \"-c\" \"knowledgeFlow\" \"-jre-path\" \"C:\\Program Files\\Weka-3-9-6\\jre\\zulu17.32.13-ca-fx-jre17.0.2-win_x64\" \"%1\"" weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.kfml\ = "KFMLFlowFile" weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\USER\S-1-5-21-160263616-143223877-1356318919-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ARFFDataFile\shell\open\command\ = "\"C:\\Program Files\\Weka-3-9-6\\jre\\zulu17.32.13-ca-fx-jre17.0.2-win_x64\\bin\\javaw.exe\" \"-classpath\" \"C:\\Program Files\\Weka-3-9-6\" \"RunWeka\" \"-i\" \"C:\\Program Files\\Weka-3-9-6\\RunWeka.ini\" \"-w\" \"C:\\Program Files\\Weka-3-9-6\\weka.jar\" \"-c\" \"explorer\" \"-jre-path\" \"C:\\Program Files\\Weka-3-9-6\\jre\\zulu17.32.13-ca-fx-jre17.0.2-win_x64\" \"%1\"" weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xrff\ = "XRFFDataFile" weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XRFFDataFile\ = "XRFF Data File" weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XRFFDataFile\shell\open\command\ = "\"C:\\Program Files\\Weka-3-9-6\\jre\\zulu17.32.13-ca-fx-jre17.0.2-win_x64\\bin\\javaw.exe\" \"-classpath\" \"C:\\Program Files\\Weka-3-9-6\" \"RunWeka\" \"-i\" \"C:\\Program Files\\Weka-3-9-6\\RunWeka.ini\" \"-w\" \"C:\\Program Files\\Weka-3-9-6\\weka.jar\" \"-c\" \"explorer\" \"-jre-path\" \"C:\\Program Files\\Weka-3-9-6\\jre\\zulu17.32.13-ca-fx-jre17.0.2-win_x64\" \"%1\"" weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ARFFDataFile\shell\open weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XRFFDataFile weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.kf weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFFlowFile\shell\open\command weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFFlowFile\shell weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFFlowFile\shell\open weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFMLFlowFile\DefaultIcon weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KFFlowFile\ = "KF Flow File" weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KFMLFlowFile\ = "KFML Flow File" weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KFMLFlowFile\shell\open\command\ = "\"C:\\Program Files\\Weka-3-9-6\\jre\\zulu17.32.13-ca-fx-jre17.0.2-win_x64\\bin\\javaw.exe\" \"-classpath\" \"C:\\Program Files\\Weka-3-9-6\" \"RunWeka\" \"-i\" \"C:\\Program Files\\Weka-3-9-6\\RunWeka.ini\" \"-w\" \"C:\\Program Files\\Weka-3-9-6\\weka.jar\" \"-c\" \"knowledgeFlow\" \"-jre-path\" \"C:\\Program Files\\Weka-3-9-6\\jre\\zulu17.32.13-ca-fx-jre17.0.2-win_x64\" \"%1\"" weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.arff\ = "ARFFDataFile" weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xrff weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XRFFDataFile\shell weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XRFFDataFile\shell\open weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFFlowFile weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFMLFlowFile weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KFMLFlowFile\DefaultIcon\ = "C:\\Program Files\\Weka-3-9-6\\weka.ico" weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.arff weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ARFFDataFile weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ARFFDataFile\DefaultIcon\ = "C:\\Program Files\\Weka-3-9-6\\weka.ico" weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.kf\ = "KFFlowFile" weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFMLFlowFile\shell\open\command weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XRFFDataFile\DefaultIcon weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ARFFDataFile\shell\open\command weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ARFFDataFile\shell weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFFlowFile\DefaultIcon weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.kfml weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFMLFlowFile\shell\open weka-3-9-6-azul-zulu-windows.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2588 weka-3-9-6-azul-zulu-windows.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 708 MiniSearchHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\weka-3-9-6-azul-zulu-windows.exe"C:\Users\Admin\AppData\Local\Temp\weka-3-9-6-azul-zulu-windows.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2588
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4736
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5e9248ba5f6ef9b25bad614058047e8a4
SHA1cbf049d65ad37e92f1026ce3ad74131632936683
SHA256a1020d183a038fdb538d483f27aceec343942622df69a311131148b05b741e16
SHA5123a250dbaaba0af0154674f23afdbd58d05a6701d9cec676c7d37f1dcbae4b20cb57f7f0d2f86380d4042ae72445189daaee2bceecd257f7b6cb67a31096577c2
-
C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\legal\java.logging\ADDITIONAL_LICENSE_INFO
Filesize49B
MD519c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA12db86ab706d9b73feeb51a904be03b63bee92baf
SHA256ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
SHA5127ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
-
C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\legal\java.logging\ASSEMBLY_EXCEPTION
Filesize44B
MD57caf4cdbb99569deb047c20f1aad47c4
SHA124e7497426d27fe3c17774242883ccbed8f54b4d
SHA256b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
SHA512a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
-
Filesize
33B
MD516989bab922811e28b64ac30449a5d05
SHA151ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA25686e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
SHA51286571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
-
Filesize
2KB
MD5d7309ca21ce2165b420f2aa62cf9fc8d
SHA13c905b0618b4b733a4856dd3e6845d5f2fff12cf
SHA25682cc307a9cdfa7fe043eb40e0cbfd4f3e5d735bd86256a2facf80f3e0bc401d3
SHA5123068cbb75da0ded7eec5af5e862ac5be70c520f1530dea917d99a8f0a2a40ec8464f1431e23db28b53370e7754fd8c7fd6e14d7df63bfc41d778d9564dfca624
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize11KB
MD5dca1ccce8f08c937ebced15be33e8427
SHA15ce02d5ed988aa6d5730f3272b9f72acd4b8f296
SHA2567e206ec193b1873baed8ac4a9cd7409b85784f9df3c3cfb6de6470befcc6ada0
SHA512c05c8e8a26955c51565b8a6c46403d174709cd2e7eb33a0cd4f60dd650eb41d7721a356a35a12ea7d956f0f7c3e45fa77e0f8b2d8e5adf9daf45411944cf9783
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize11KB
MD58b9452f58585cfebf47d229ac440f983
SHA1270f86f49ecbdf9a55a33ebfb3fcd0b8edf9b3db
SHA2561775c4816124370f34ba147e681e79c1d3b406e4c01fde065a0f4bc670adf170
SHA512f642c5d1f5b3004f485d00795f08fbde3774cd8987ed3e4397d23764f64276a785ddae1f5f955f15adbdffd06b663537e7d7aafe43fe3a8cd5c95f2eb42498ae
-
Filesize
14KB
MD55f35212d7e90ee622b10be39b09bd270
SHA1c4bc9593902adf6daaef37e456dc6100d50d0925
SHA25631944b93e44301974d9c6f810d2da792e34a53dcacd619a08cb0385ac59e513d
SHA5127514810367f56d994c6d5703b56ac16124fab5dfdcfbe337d4413274c1ff9037a2ee623e49ab2fb6227412ab29fcc49a3ada1391910d44c2b5de0adeb3e7c2f0
-
Filesize
7KB
MD526836307758e048d1ce0afe754d6a972
SHA123a8f45cf5e2ad78add3c4dd3b3cf15fffced2cc
SHA256a6919f5f3b53a9c8c015413babe7a9872491a2583e49bb3c261e60785c3c3534
SHA512aaf7cfbb9c6951b65bd377db401617812f1d47960a01ae99164183c642fbd8f1ce08720bc92d26b642da5433b80720dfcd96280a162decf678139966be132746
-
Filesize
11KB
MD5fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
-
Filesize
682B
MD57a2da161ad93c50ffc64ecfeb38a8db4
SHA167bfa80aedf6db75e1c1c8a9a771348f053d47b7
SHA25660d0de99dab041f28eab5bdb5935a219c4db0789053e00b620aaee693eb0b4ca
SHA512f7b908975ca6c7492c804f90db8dd8e1201021828c06970f1c7130a4ab6cacdc8b8ea2302e48f6cf7b9f1865922513d83c84539e11c72ebb26616dede092cdda
-
Filesize
533B
MD55763b60335d5ce136abfe1bbdbccef9f
SHA18e42c20c78c0e58edbc797cf5e44ce5bcc24173e
SHA256ff881b8ef7657162c83fce2ce50eecf9f4d296ce17c1e74389a13dd490885bbf
SHA512cc36298289b8882cbdd7af4a2d1621ca7b04552a104f1755ad57acc1d6c0f75989b6d5cab628b083bc1b8f887ac16516c86c002d682f06b98a0a519a4b5d3164