Overview
overview
5Static
static
3weka-3-9-6...ws.exe
windows11-21h2-x64
4RunWeka.bat
windows11-21h2-x64
5WekaManual.pdf
windows11-21h2-x64
1changelogs...0.html
windows11-21h2-x64
1doc/script...min.js
windows11-21h2-x64
1doc/script...min.js
windows11-21h2-x64
1doc/script.js
windows11-21h2-x64
1doc/search.js
windows11-21h2-x64
1doc/serial...m.html
windows11-21h2-x64
1doc/tag-se...dex.js
windows11-21h2-x64
1doc/type-s...dex.js
windows11-21h2-x64
1doc/weka/R...e.html
windows11-21h2-x64
1doc/weka/Run.html
windows11-21h2-x64
1doc/weka/a...r.html
windows11-21h2-x64
1doc/weka/a...i.html
windows11-21h2-x64
1doc/weka/a...t.html
windows11-21h2-x64
1doc/weka/a...e.html
windows11-21h2-x64
1doc/weka/a...s.html
windows11-21h2-x64
1doc/weka/a...r.html
windows11-21h2-x64
1doc/weka/a...r.html
windows11-21h2-x64
1doc/weka/a...n.html
windows11-21h2-x64
1doc/weka/a...m.html
windows11-21h2-x64
1doc/weka/a...r.html
windows11-21h2-x64
1doc/weka/a...r.html
windows11-21h2-x64
1doc/weka/a...E.html
windows11-21h2-x64
1doc/weka/a...e.html
windows11-21h2-x64
1doc/weka/a...h.html
windows11-21h2-x64
1doc/weka/a...s.html
windows11-21h2-x64
1doc/weka/a...r.html
windows11-21h2-x64
1doc/weka/a...m.html
windows11-21h2-x64
1doc/weka/a...t.html
windows11-21h2-x64
1doc/weka/a...t.html
windows11-21h2-x64
1Analysis
- max time kernel
123s - max time network
140s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system - submitted
22/02/2024, 15:25
Behavioral task
behavioral1
Sample
weka-3-9-6-azul-zulu-windows.exe
Resource
win11-20240221-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
RunWeka.bat
Resource
win11-20240221-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
WekaManual.pdf
Resource
win11-20240221-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
changelogs/CHANGELOG-3-5-0.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
doc/script-dir/jquery-3.5.1.min.js
Resource
win11-20240221-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
doc/script-dir/jquery-ui.min.js
Resource
win11-20240221-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
doc/script.js
Resource
win11-20240221-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
doc/search.js
Resource
win11-20240221-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
doc/serialized-form.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral10
Sample
doc/tag-search-index.js
Resource
win11-20240221-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
doc/type-search-index.js
Resource
win11-20240221-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
doc/weka/Run.SchemeType.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral13
Sample
doc/weka/Run.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral14
Sample
doc/weka/associations/AbstractAssociator.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral15
Sample
doc/weka/associations/Apriori.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral16
Sample
doc/weka/associations/AprioriItemSet.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral17
Sample
doc/weka/associations/AssociationRule.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral18
Sample
doc/weka/associations/AssociationRules.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral19
Sample
doc/weka/associations/AssociationRulesProducer.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral20
Sample
doc/weka/associations/Associator.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral21
Sample
doc/weka/associations/AssociatorEvaluation.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral22
Sample
doc/weka/associations/BinaryItem.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral23
Sample
doc/weka/associations/CARuleMiner.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral24
Sample
doc/weka/associations/CheckAssociator.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral25
Sample
doc/weka/associations/DefaultAssociationRule.METRIC_TYPE.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral26
Sample
doc/weka/associations/DefaultAssociationRule.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral27
Sample
doc/weka/associations/FPGrowth.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral28
Sample
doc/weka/associations/FilteredAssociationRules.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral29
Sample
doc/weka/associations/FilteredAssociator.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral30
Sample
doc/weka/associations/Item.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral31
Sample
doc/weka/associations/ItemSet.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral32
Sample
doc/weka/associations/LabeledItemSet.html
Resource
win11-20240221-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target weka-3-9-6-azul-zulu-windows.exe
- Size 126.9MB
- Sample240222-stwlqsbf2y
- SHA256 e21d58bd08e5380dbac2aa665c0371f126dab74a4420cc949fa1c1a16e860c92
- MD5 6a1b2c1bfb5622c104ac8bd3d6248f3f
- SHA1 10b213eb1c3a54030eeb9b2cdfa2c4e0b7a6ae4f
- SHA512 518fdb0a4ddca54060d1905e8fb923d3f9cd952855cb55858220f2075e1ac6304882d23d5cecbc1c95a21db792ec3e8c3193be5a6c3d28ab31ddbeedaba145da
- SSDEEP 3145728:QvWG6EVGRZGAKa+LYlVHQqxY7NFdp8eIPhtcv+JMUI:QMRKjU7mRxB7+WUI
- MD5 SHA1 SHA512 SSDEEP
Score
4/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Weka-3-9-6\doc\weka\core\tokenizers\CharacterNGramTokenizer.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\beans\GraphViewerBeanInfo.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\knowledgeflow\steps\FlowByExpression.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\bin\api-ms-win-crt-convert-l1-1-0.dll weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\bin\api-ms-win-crt-time-l1-1-0.dll weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\classifiers\bayes\net\search\ci\package-summary.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\pmml\jaxbbindings\TreeModel.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\classifiers\bayes\net\search\ci\CISearchAlgorithm.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\experiment\xml\XMLExperiment.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\filters\supervised\attribute\package-tree.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\graphvisualizer\BIFParser.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\bin\api-ms-win-core-synch-l1-2-0.dll weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\bin\klist.exe weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\converters\StreamTokenizerUtils.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\pmml\jaxbbindings\DocumentTermMatrix.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\filters\unsupervised\attribute\StringToWordVector.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\scripting\event\package-tree.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\sql\ResultSetHelper.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\associations\AbstractAssociator.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\neighboursearch\balltrees\MedianDistanceFromArbitraryPoint.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\EnvironmentField.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\knowledgeflow\steps\ImageSaver.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\knowledgeflow\steps\Loader.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\knowledgeflow\JobEnvironment.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\experiment\ExperimenterDefaults.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\attributeSelection\ReliefFAttributeEval.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\classifiers\bayes\BayesNet.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\pmml\jaxbbindings\CityBlock.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\pmml\jaxbbindings\FieldValue.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\beans\ClustererBeanInfo.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\beans\NoteCustomizer.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\beans\ImageEvent.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\simplecli\Script.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\AlgVector.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\pmml\jaxbbindings\TextDocument.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\pmml\jaxbbindings\package-summary.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\experiment\PropertyNode.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\legal\jdk.security.jgss\ADDITIONAL_LICENSE_INFO weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\MultiInstanceCapabilitiesHandler.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\expressionlanguage\weka\package-tree.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\associations\package-summary.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\InheritanceUtils.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\sql\QueryPanel.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\bin\api-ms-win-core-timezone-l1-1-0.dll weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\changelogs\CHANGELOG-3-7-9 weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\classifiers\Sourcable.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\beans\Loader.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\beans\MetaBean.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\knowledgeflow\steps\ModelPerformanceChartStepEditorDialog.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\legal\javafx.web\libxslt.md weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\data\diabetes.arff weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\gui\visualize\VisualizePanelListener.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\legal\java.naming\ASSEMBLY_EXCEPTION weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\legal\java.net.http\ASSEMBLY_EXCEPTION weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\legal\jdk.management.agent\ASSEMBLY_EXCEPTION weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\changelogs\CHANGELOG_PACKAGES-3-7-2 weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\classifiers\trees\lmt\SimpleLinearRegression.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\pmml\jaxbbindings\XCoordinates.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\experiment\TaskStatusInfo.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\filters\unsupervised\attribute\RemoveType.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\filters\unsupervised\attribute\TimeSeriesTranslate.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\converters\MatlabLoader.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\core\pmml\jaxbbindings\TimeAnchor.html weka-3-9-6-azul-zulu-windows.exe File created C:\Program Files\Weka-3-9-6\doc\weka\datagenerators\DataGenerator.html weka-3-9-6-azul-zulu-windows.exe - Loads dropped DLL 3 IoCs
pid Process 2588 weka-3-9-6-azul-zulu-windows.exe 2588 weka-3-9-6-azul-zulu-windows.exe 2588 weka-3-9-6-azul-zulu-windows.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 41 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFMLFlowFile\shell weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ARFFDataFile\ = "ARFF Data File" weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ARFFDataFile\DefaultIcon weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XRFFDataFile\DefaultIcon\ = "C:\\Program Files\\Weka-3-9-6\\weka.ico" weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XRFFDataFile\shell\open\command weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KFFlowFile\DefaultIcon\ = "C:\\Program Files\\Weka-3-9-6\\weka.ico" weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KFFlowFile\shell\open\command\ = "\"C:\\Program Files\\Weka-3-9-6\\jre\\zulu17.32.13-ca-fx-jre17.0.2-win_x64\\bin\\javaw.exe\" \"-classpath\" \"C:\\Program Files\\Weka-3-9-6\" \"RunWeka\" \"-i\" \"C:\\Program Files\\Weka-3-9-6\\RunWeka.ini\" \"-w\" \"C:\\Program Files\\Weka-3-9-6\\weka.jar\" \"-c\" \"knowledgeFlow\" \"-jre-path\" \"C:\\Program Files\\Weka-3-9-6\\jre\\zulu17.32.13-ca-fx-jre17.0.2-win_x64\" \"%1\"" weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.kfml\ = "KFMLFlowFile" weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\USER\S-1-5-21-160263616-143223877-1356318919-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ARFFDataFile\shell\open\command\ = "\"C:\\Program Files\\Weka-3-9-6\\jre\\zulu17.32.13-ca-fx-jre17.0.2-win_x64\\bin\\javaw.exe\" \"-classpath\" \"C:\\Program Files\\Weka-3-9-6\" \"RunWeka\" \"-i\" \"C:\\Program Files\\Weka-3-9-6\\RunWeka.ini\" \"-w\" \"C:\\Program Files\\Weka-3-9-6\\weka.jar\" \"-c\" \"explorer\" \"-jre-path\" \"C:\\Program Files\\Weka-3-9-6\\jre\\zulu17.32.13-ca-fx-jre17.0.2-win_x64\" \"%1\"" weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xrff\ = "XRFFDataFile" weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XRFFDataFile\ = "XRFF Data File" weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XRFFDataFile\shell\open\command\ = "\"C:\\Program Files\\Weka-3-9-6\\jre\\zulu17.32.13-ca-fx-jre17.0.2-win_x64\\bin\\javaw.exe\" \"-classpath\" \"C:\\Program Files\\Weka-3-9-6\" \"RunWeka\" \"-i\" \"C:\\Program Files\\Weka-3-9-6\\RunWeka.ini\" \"-w\" \"C:\\Program Files\\Weka-3-9-6\\weka.jar\" \"-c\" \"explorer\" \"-jre-path\" \"C:\\Program Files\\Weka-3-9-6\\jre\\zulu17.32.13-ca-fx-jre17.0.2-win_x64\" \"%1\"" weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ARFFDataFile\shell\open weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XRFFDataFile weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.kf weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFFlowFile\shell\open\command weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFFlowFile\shell weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFFlowFile\shell\open weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFMLFlowFile\DefaultIcon weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KFFlowFile\ = "KF Flow File" weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KFMLFlowFile\ = "KFML Flow File" weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KFMLFlowFile\shell\open\command\ = "\"C:\\Program Files\\Weka-3-9-6\\jre\\zulu17.32.13-ca-fx-jre17.0.2-win_x64\\bin\\javaw.exe\" \"-classpath\" \"C:\\Program Files\\Weka-3-9-6\" \"RunWeka\" \"-i\" \"C:\\Program Files\\Weka-3-9-6\\RunWeka.ini\" \"-w\" \"C:\\Program Files\\Weka-3-9-6\\weka.jar\" \"-c\" \"knowledgeFlow\" \"-jre-path\" \"C:\\Program Files\\Weka-3-9-6\\jre\\zulu17.32.13-ca-fx-jre17.0.2-win_x64\" \"%1\"" weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.arff\ = "ARFFDataFile" weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xrff weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XRFFDataFile\shell weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XRFFDataFile\shell\open weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFFlowFile weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFMLFlowFile weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KFMLFlowFile\DefaultIcon\ = "C:\\Program Files\\Weka-3-9-6\\weka.ico" weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.arff weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ARFFDataFile weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ARFFDataFile\DefaultIcon\ = "C:\\Program Files\\Weka-3-9-6\\weka.ico" weka-3-9-6-azul-zulu-windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.kf\ = "KFFlowFile" weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFMLFlowFile\shell\open\command weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XRFFDataFile\DefaultIcon weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ARFFDataFile\shell\open\command weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ARFFDataFile\shell weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFFlowFile\DefaultIcon weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.kfml weka-3-9-6-azul-zulu-windows.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KFMLFlowFile\shell\open weka-3-9-6-azul-zulu-windows.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2588 weka-3-9-6-azul-zulu-windows.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 708 MiniSearchHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\weka-3-9-6-azul-zulu-windows.exe"C:\Users\Admin\AppData\Local\Temp\weka-3-9-6-azul-zulu-windows.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2588
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4736
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Weka-3-9-6\Weka 3.9.6.lnk
- Size 2KB
- SHA256 a1020d183a038fdb538d483f27aceec343942622df69a311131148b05b741e16
- MD5 e9248ba5f6ef9b25bad614058047e8a4
- SHA1 cbf049d65ad37e92f1026ce3ad74131632936683
- SHA512 3a250dbaaba0af0154674f23afdbd58d05a6701d9cec676c7d37f1dcbae4b20cb57f7f0d2f86380d4042ae72445189daaee2bceecd257f7b6cb67a31096577c2
- MD5 SHA1 SHA512
- Path C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\legal\java.logging\ADDITIONAL_LICENSE_INFO
- Size 49B
- SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
- MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
- SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
- SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
- MD5 SHA1 SHA512
- Path C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\legal\java.logging\ASSEMBLY_EXCEPTION
- Size 44B
- SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
- MD5 7caf4cdbb99569deb047c20f1aad47c4
- SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
- SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
- MD5 SHA1 SHA512
- Path C:\Program Files\Weka-3-9-6\jre\zulu17.32.13-ca-fx-jre17.0.2-win_x64\legal\java.logging\LICENSE
- Size 33B
- SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
- MD5 16989bab922811e28b64ac30449a5d05
- SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
- SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
- MD5 SHA1 SHA512
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Weka 3.9.6\Weka 3.9.6 (with console).lnk
- Size 2KB
- SHA256 82cc307a9cdfa7fe043eb40e0cbfd4f3e5d735bd86256a2facf80f3e0bc401d3
- MD5 d7309ca21ce2165b420f2aa62cf9fc8d
- SHA1 3c905b0618b4b733a4856dd3e6845d5f2fff12cf
- SHA512 3068cbb75da0ded7eec5af5e862ac5be70c520f1530dea917d99a8f0a2a40ec8464f1431e23db28b53370e7754fd8c7fd6e14d7df63bfc41d778d9564dfca624
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
- Size 11KB
- SHA256 7e206ec193b1873baed8ac4a9cd7409b85784f9df3c3cfb6de6470befcc6ada0
- MD5 dca1ccce8f08c937ebced15be33e8427
- SHA1 5ce02d5ed988aa6d5730f3272b9f72acd4b8f296
- SHA512 c05c8e8a26955c51565b8a6c46403d174709cd2e7eb33a0cd4f60dd650eb41d7721a356a35a12ea7d956f0f7c3e45fa77e0f8b2d8e5adf9daf45411944cf9783
- SSDEEP 192:9JY49siyi7vi12YJrWkp1NDu3Aksz2ZUhmkDSRRPQRe1xjBOVjYijQ8RJo1wuJN7:9J7q12krWuJNpmvlBOVjYijQ8RJoEiF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
- Size 11KB
- SHA256 1775c4816124370f34ba147e681e79c1d3b406e4c01fde065a0f4bc670adf170
- MD5 8b9452f58585cfebf47d229ac440f983
- SHA1 270f86f49ecbdf9a55a33ebfb3fcd0b8edf9b3db
- SHA512 f642c5d1f5b3004f485d00795f08fbde3774cd8987ed3e4397d23764f64276a785ddae1f5f955f15adbdffd06b663537e7d7aafe43fe3a8cd5c95f2eb42498ae
- SSDEEP 192:TJY49siyi7vi12YJrWkp1NDu3Aksz2ZUhmkDSRRPQRe1xjBOVjYijQ8RJo16uJN7:TJ7q12krWuJNpmvlBOVjYijQ8RJoeiF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nswB065.tmp\InstallOptions.dll
- Size 14KB
- SHA256 31944b93e44301974d9c6f810d2da792e34a53dcacd619a08cb0385ac59e513d
- MD5 5f35212d7e90ee622b10be39b09bd270
- SHA1 c4bc9593902adf6daaef37e456dc6100d50d0925
- SHA512 7514810367f56d994c6d5703b56ac16124fab5dfdcfbe337d4413274c1ff9037a2ee623e49ab2fb6227412ab29fcc49a3ada1391910d44c2b5de0adeb3e7c2f0
- SSDEEP 192:E4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjaK72dwF7dBOne:tn3T5KdHCMRD/R1cOnrja+BO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nswB065.tmp\StartMenu.dll
- Size 7KB
- SHA256 a6919f5f3b53a9c8c015413babe7a9872491a2583e49bb3c261e60785c3c3534
- MD5 26836307758e048d1ce0afe754d6a972
- SHA1 23a8f45cf5e2ad78add3c4dd3b3cf15fffced2cc
- SHA512 aaf7cfbb9c6951b65bd377db401617812f1d47960a01ae99164183c642fbd8f1ce08720bc92d26b642da5433b80720dfcd96280a162decf678139966be132746
- SSDEEP 96:IgiqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1tk3hhEl7y:IgiqVPgK8K9eIdE9B/t8hg7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nswB065.tmp\System.dll
- Size 11KB
- SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- MD5 fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nswB065.tmp\ioSpecial.ini
- Size 682B
- SHA256 60d0de99dab041f28eab5bdb5935a219c4db0789053e00b620aaee693eb0b4ca
- MD5 7a2da161ad93c50ffc64ecfeb38a8db4
- SHA1 67bfa80aedf6db75e1c1c8a9a771348f053d47b7
- SHA512 f7b908975ca6c7492c804f90db8dd8e1201021828c06970f1c7130a4ab6cacdc8b8ea2302e48f6cf7b9f1865922513d83c84539e11c72ebb26616dede092cdda
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nswB065.tmp\ioSpecial.ini
- Size 533B
- SHA256 ff881b8ef7657162c83fce2ce50eecf9f4d296ce17c1e74389a13dd490885bbf
- MD5 5763b60335d5ce136abfe1bbdbccef9f
- SHA1 8e42c20c78c0e58edbc797cf5e44ce5bcc24173e
- SHA512 cc36298289b8882cbdd7af4a2d1621ca7b04552a104f1755ad57acc1d6c0f75989b6d5cab628b083bc1b8f887ac16516c86c002d682f06b98a0a519a4b5d3164
- MD5 SHA1 SHA512