d0624773c83872ae005bd3c7d6d134c83b91fedf960cc8a2c8c889a3c5503164

Analysis

max time kernel
149s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/03/2024, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe
Size 6.9MB
Sample240304-d2gp8agf7x
SHA256 d0624773c83872ae005bd3c7d6d134c83b91fedf960cc8a2c8c889a3c5503164
MD5 ec1140a43a104f3e1482599273968490
SHA1 861fe096f0614393e25525432840d01c46a8f76d
SHA512 2f729b2e83ecc0d0fbcc7c5ca45c1bc995a399ed092a5921ca894aca5ced485ec40b99687a6837e0eb574b74a1378e14ef9eea1ec21e9f75d081cbc6ff8fc939
SSDEEP 196608:QlebGcN/2zfjsegfhjXJ9S6sQVyIVACj6m5b9bvMKjWW+5:QlQGpzfjSZZI63V/VGm5biyP+5
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
1028	unpack200.exe
1432	unpack200.exe
2032	unpack200.exe
2732	unpack200.exe
1832	unpack200.exe
568	unpack200.exe
452	unpack200.exe
2076	unpack200.exe
1772	unpack200.exe
1388	unpack200.exe
2828	unpack200.exe
1648	unpack200.exe
3012	windowslauncher.exe

Loads dropped DLL 25 IoCs

pid	Process
2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe
1028	unpack200.exe
2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe
1432	unpack200.exe
2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe
2032	unpack200.exe
2732	unpack200.exe
1832	unpack200.exe
568	unpack200.exe
452	unpack200.exe
2076	unpack200.exe
1772	unpack200.exe
1388	unpack200.exe
2828	unpack200.exe
1648	unpack200.exe
2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe
2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe
2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe
2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe
2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe
2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe
2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe
2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe
2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe
2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe

Modifies system certificate store 2 TTPs 2 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1028	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	28
PID 2012 wrote to memory of 1028	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	28
PID 2012 wrote to memory of 1028	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	28
PID 2012 wrote to memory of 1028	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	28
PID 2012 wrote to memory of 1432	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	29
PID 2012 wrote to memory of 1432	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	29
PID 2012 wrote to memory of 1432	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	29
PID 2012 wrote to memory of 1432	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	29
PID 2012 wrote to memory of 2032	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	31
PID 2012 wrote to memory of 2032	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	31
PID 2012 wrote to memory of 2032	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	31
PID 2012 wrote to memory of 2032	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	31
PID 2012 wrote to memory of 2732	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	32
PID 2012 wrote to memory of 2732	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	32
PID 2012 wrote to memory of 2732	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	32
PID 2012 wrote to memory of 2732	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	32
PID 2012 wrote to memory of 1832	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	33
PID 2012 wrote to memory of 1832	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	33
PID 2012 wrote to memory of 1832	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	33
PID 2012 wrote to memory of 1832	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	33
PID 2012 wrote to memory of 568	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	34
PID 2012 wrote to memory of 568	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	34
PID 2012 wrote to memory of 568	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	34
PID 2012 wrote to memory of 568	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	34
PID 2012 wrote to memory of 452	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	35
PID 2012 wrote to memory of 452	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	35
PID 2012 wrote to memory of 452	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	35
PID 2012 wrote to memory of 452	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	35
PID 2012 wrote to memory of 2076	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	36
PID 2012 wrote to memory of 2076	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	36
PID 2012 wrote to memory of 2076	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	36
PID 2012 wrote to memory of 2076	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	36
PID 2012 wrote to memory of 1772	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	37
PID 2012 wrote to memory of 1772	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	37
PID 2012 wrote to memory of 1772	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	37
PID 2012 wrote to memory of 1772	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	37
PID 2012 wrote to memory of 1388	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	38
PID 2012 wrote to memory of 1388	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	38
PID 2012 wrote to memory of 1388	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	38
PID 2012 wrote to memory of 1388	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	38
PID 2012 wrote to memory of 2828	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	39
PID 2012 wrote to memory of 2828	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	39
PID 2012 wrote to memory of 2828	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	39
PID 2012 wrote to memory of 2828	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	39
PID 2012 wrote to memory of 1648	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	40
PID 2012 wrote to memory of 1648	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	40
PID 2012 wrote to memory of 1648	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	40
PID 2012 wrote to memory of 1648	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	40
PID 2012 wrote to memory of 3012	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	41
PID 2012 wrote to memory of 3012	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	41
PID 2012 wrote to memory of 3012	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	41
PID 2012 wrote to memory of 3012	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	41
PID 2012 wrote to memory of 3012	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	41
PID 2012 wrote to memory of 3012	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	41
PID 2012 wrote to memory of 3012	2012	SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe	41

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen19.3578.27120.27939.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe
  "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\crs-agent.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\crs-agent.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1028
- C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe
  "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\charsets.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\charsets.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1432
- C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe
  "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\jsse.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\jsse.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2032
- C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe
  "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\jaccess.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\jaccess.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2732
- C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe
  "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\sunpkcs11.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\sunpkcs11.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1832
- C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe
  "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\access-bridge.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\access-bridge.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:568
- C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe
  "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\access-bridge-32.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\access-bridge-32.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:452
- C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe
  "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\openjsse.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\openjsse.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2076
- C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe
  "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\legacy8ujsse.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\legacy8ujsse.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1772
- C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe
  "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\cldrdata.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\cldrdata.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1388
- C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe
  "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\sunmscapi.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\sunmscapi.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2828
- C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe
  "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\rt.jar.p2" "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\rt.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1648
- C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\windowslauncher.exe
  "C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\windowslauncher.exe" "-Xshare:dump"
  2⤵
  - Executes dropped EXE
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JWrapper-Windows32JRE-version[1].txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OORQXHVT\JWrapper-Windows32JRE-version[1].txt
Size 11B
SHA256 b482d2aace7286c78a565879c3ac49b772e9bd9d003bed856542c2cee1049b22
MD5 271563b96fbbff5dc3e04656f3f18923
SHA1 7f6800a9d6112bf5c360d56f3b0c5c616260fee8
SHA512 fc211920ee469a34e10444d65e9a909c934cfa1c6d332700d33c2aff9aa2201434dbb810ff03188904c9500638444435cbecc25e2b7598356236c8475b02763c
MD5 SHA1 SHA512

Submit Download

JreNameOverride.afos_complete

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWApps\JreNameOverride.afos_complete
Size 13B
SHA256 cfccf59f10da9d264a641125c710a6d57e457a1081f23e899bfa3d06e3be2d41
MD5 8fb5138ee86360cde03895fbcd12494d
SHA1 182872da6ad9990fbfdee722097047764f4a596c
SHA512 f315c3ea8519b935daf10a526303731aefd95de0535f871ef0927e92b86cdf5a1d967647e2af7fe54afd014e670db3f4d183ac00e0b81a4f757b703066030049
MD5 SHA1 SHA512

Submit Download

nativesplash.png

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapper-JWrapper-00097526671-complete\nativesplash.png
Size 8KB
SHA256 ea9e67690cf2f5ebacf0c701aef9d2b59e6b112c891885ce09dbdcabec201f45
MD5 979e74f082c8b1893704fe43abed69f5
SHA1 763ac4e6ef5099b1c180345301233ece696ec2bc
SHA512 20dc6849c9e95ebe77e063654091f7e800d5e0a0d300c5176946f9d95f9322b9402016dc025d9485738c37c541fb965db2613c7cd17482f34e9597d5616024b1
SSDEEP 192:/PX1OclPeJTmZXJQcOWxvhtv/vYMgGYByl:XX1OfaZXJQcLv/vqByl
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSVCR100.dll

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\MSVCR100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

charsets.jar

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\charsets.jar
Size 448KB
SHA256 d7b32181f1e43dd0aa9455ff6c0ab62e3a5b32d5fd090c48f7bc684ffedf6a18
MD5 2266886e68262e33d89bea742d13aa7c
SHA1 3b165a56a82f05785e7239870fc3364dfff082bf
SHA512 9c2c39d5309d3719d2b0d69d73ccad68df2ee4a6eba058c93e9f76f6910a212125437f7aec08f7e325d7d6a67f88a42272978409d9d6f0ef0350f62201c80d5b
SSDEEP 6144:JhKs48oRJcTRd/arOsiSkaFvn3LhxDKooSbpdR7OpImMPKctbfn:J4N8oRMC6siSkaFvn1xWooSbJwZ7ctbv
MD5 SHA1 SHA512 SSDEEP

Submit Download

charsets.jar.p2

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\charsets.jar.p2
Size 448KB
SHA256 a65dd6bc42cb9710553f50cf95736d37a5beb4fe911c8d3e5f3ae0a6366e2b31
MD5 2e8b0f7ef97b12aeaa3555a26250b2e0
SHA1 2f6d1d9fd070d7d924d069e5639f5aa30a52c756
SHA512 86802333b4997f5068bc1050e755f6a3ad65234c736cde49c5d969f70aad986df5e8c00b9b896148d6777973a77e503e43a05754bdf950a58e72d311c766c001
SSDEEP 6144:SKjMlMfzonGX+RLK1r8m0XyhAY7MHZbri:S+BXim0XyhTM4
MD5 SHA1 SHA512 SSDEEP

Submit Download

crs-agent.jar

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\crs-agent.jar
Size 145KB
SHA256 2ee219b2825d2174e5a03ff15a7bc3fa2a72d6322672abb2bc3be2ba7153f550
MD5 d1f7a7fb0a46eda64b92d27bf48ff07c
SHA1 e26e4f4b326e4e1e3a47a27b10f4f7335efecaf3
SHA512 6034451481dcf2d4483e5edaae6c60197cb3a7f6c0ec726c7b0f8209632523d24ed7e4548df2942ed18e93c2cdd08a8d4be483d5329dd400aa97543de2b865e0
SSDEEP 3072:T4pT1xcQRJrf1B/dSjNlyx9igbJJQZeOIlfVXWXKQxJM:MpcQRRdB/cC/igZFRVmPxW
MD5 SHA1 SHA512 SSDEEP

Submit Download

crs-agent.jar.p2

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\crs-agent.jar.p2
Size 83KB
SHA256 75e2fcd8e5db747c4f2619c67e9a6898b083318dbab0b4276052593a9ed22825
MD5 7618098477e433a3297beec060e38554
SHA1 e57585e7f78f8290a534bae6bbe85e89bf59b671
SHA512 fc46a67c3c7e3bcb0f3e8e2611a749692fe4c2cdf1ac89b9e5013ddc6f58bbab4d012e58cd85901f0d171c8ff5e9e5ca3c08811abac38d89776f67dd1b72b56e
SSDEEP 1536:7mUlPrLpiahcdI7gSiCRnMxzXWr2j8+Gyp+dkeLLWM7Hj36yu68D5p646bd2yqVO:LlPrLpisBM1xx8Ip+vf36yu68DX646bN
MD5 SHA1 SHA512 SSDEEP

Submit Download

access-bridge-32.jar

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\access-bridge-32.jar
Size 191KB
SHA256 33d0959c1d4f31a23b62c6c406f04acca9626b3f72963c88a6d407820cb58ad5
MD5 f2e03d50317928d981b77d1b01ad2f6e
SHA1 3f82255ba557b64664e3dbf9d8f2b6e4d611e9b2
SHA512 6de0e03130f1ed9d236f300b932e2a5d83d58a0841fe5cd7fd6e569384a2034ae37150ddb0d41a2af3b3b8c9432ef5d5427c5f36cd854ddd9df987a89f96276c
SSDEEP 3072:GS6k44yC1hyzAF5fSXXZe4ioflXor8xL7iQby10wc:wL+fy1w4iId6mL7iQbyFc
MD5 SHA1 SHA512 SSDEEP

Submit Download

access-bridge-32.jar.p2

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\access-bridge-32.jar.p2
Size 68KB
SHA256 6707457e8d1aa16b08a77e6e44a69984ef5c784dbc8b65796d5df80ab0c4182c
MD5 65ff11c770d16063ae896517d60ea900
SHA1 c759cff5e6a08ae5c232b79ff95c58fce545f24e
SHA512 d40cb1b633916aff909255293d1b567ee353ffbbda3517bd80d723b7fba1225f660b20599963c83bf28036b853280a9246ed1ca23633b805357651ec64046982
SSDEEP 1536:qLpNk0QYQvWCdznpQ8Q/JIEzNbyaRUcAgNBm6OjjYIKKuSWdddddKfaW3ttapII6:Z7cIWz2PNp
MD5 SHA1 SHA512 SSDEEP

Submit Download

access-bridge.jar

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\access-bridge.jar
Size 191KB
SHA256 2868caaffcf13ae3d6d22831668e19d4200593190a1b88b714b62b3e47ac537d
MD5 f31be727c15312bb50baa9a60003594b
SHA1 1dc4bcbe28572e8d72d1afed9731d32a7985ae99
SHA512 387b314f64f5ba5c72be7f1e834a62b8b72a984a36ee9dd53aa538fc26e2c343cba6e2485d15f517bd403e285455108d303b88d2db1d246f5990422a461fa1b0
SSDEEP 3072:GS6k44yC1hyzAF5fSXXZe4ioflXor8xL7iQbyi0w5:wL+fy1w4iId6mL7iQbyg5
MD5 SHA1 SHA512 SSDEEP

Submit Download

access-bridge.jar.p2

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\access-bridge.jar.p2
Size 68KB
SHA256 352f6c64c4742c49194ea23e75867c97dd445ca0ed3c29747a1b3149e05b8238
MD5 085cab8b3c0d6ae59b3fdc2b09ca7b2c
SHA1 c9d1aa28415e4fc44c8935e2af8dac6b950f7c23
SHA512 158f06e74faec63406fc8a968a0cf23a34013877c2f44c94ab1fb2bf0f9e928741cafeea658a104bd87d4cf68bac2b812486f8d73e163d4469b4bb6099d69125
SSDEEP 1536:m/ppu0QYQvWCdznpQ8Q/JIEVNbyaRUcAgNBm6OjjYIKKuSWdddddKfaW3ttapII6:j7cIMz2TNp
MD5 SHA1 SHA512 SSDEEP

Submit Download

cldrdata.jar

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\cldrdata.jar
Size 3.7MB
SHA256 70dda4e2247e7a7d8e78501679ac89ca3214d8a98ec8f332b9fbbd043fe88857
MD5 464e8a959d39d16b0e62f177f77eb7a3
SHA1 cc8fedb29aa80ea30f144ec6f1fd5594fac83622
SHA512 515872addf16a1ea2facf5c7ab70b987669d8cfa102705149528084375064ba9ca272b0d48eb7ae3774581524cca4c517c6be092ce1912bade9a36355662e05d
SSDEEP 98304:+oRNd6cE1yq8004FdirZIz8D0BwvzaA6qCP2LSAl5N:5Nd6IxD0B4+qVOC
MD5 SHA1 SHA512 SSDEEP

Submit Download

cldrdata.jar.p2

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\cldrdata.jar.p2
Size 3.9MB
SHA256 d316bc002fa5a15622c5d4076f74a8f97fec63d4efbb9446e9cea101c66c051f
MD5 fb3b52a77cd7d5c06ab18417b880cf85
SHA1 16b32390dd4b20f215e9bd4652451ae110408dbc
SHA512 6a1adb2b9d6969840277588c93f299c22ad167ac9cb3d4c4ae2b94d49a2e3301502ea54e2eb62b74b97d0324028e9bb6455ec078824d1ec9b5d6c02b3e2d9ca9
SSDEEP 49152:RkSov8bdfSAY3YQMhHBUmrMYHt+e1et++e:2Ebd6AY+BzrJH4e1qC
MD5 SHA1 SHA512 SSDEEP

Submit Download

jaccess.jar

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\jaccess.jar
Size 42KB
SHA256 cef2ccb8962a6d995e98df38c0370b0685a20dba56d492789535f075837664fe
MD5 78e7e96c457dacd63ff8b91b18a18d94
SHA1 7deeb6b1bb9cd5dd8e88e89b104036fb11a3a6e7
SHA512 49278b823990c58a66513f09a2dcad30ba512a48f7529eedee1147e4cfbd9961908063f08c8b1cd51871f5d6d22d1450a32df1d762ca99895fb879aa2e1089e5
SSDEEP 768:/+hKBewens5WLrCjBaYLAr/PRRzCBxAIjlJsHhj2smrQ:/sweCXLADRRWBxA4J98
MD5 SHA1 SHA512 SSDEEP

Submit Download

jaccess.jar.p2

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\jaccess.jar.p2
Size 35KB
SHA256 6e6e99bd2d0f532f3c297ecc2e14cc5379e4f86de78bdf8cc6615ec63992ccb2
MD5 266b3cd165141350c4e97f70de125b8f
SHA1 38fb1ca72f034b4bdad5aff7d8f4a100fb4c6924
SHA512 e1cc802757ff4d3a3deb64992188f60ff5841bed1d5351dbf39833a686b218b9be93f73d3c656601150ebdd60337eba84c2f98ced46a8190f1c62b4b7678a080
SSDEEP 384:L+eNocIxRNMNo8CDYhYUZ1d3Vh6yDZvi7dmXypppppppppppppppppYppppppppc:VN3IxRGND1hZ1d3Oamdm9hKaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

legacy8ujsse.jar

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\legacy8ujsse.jar
Size 418KB
SHA256 f17139ecb92b94a2a3909a5a2f2c8a5feee9afaf25e8cd2b5a8ab0fd3dd73c9e
MD5 80558729bb2edfc3b03b8dee73d527b4
SHA1 521d59e97a3e254ecd9dd06b213ac0fda4c2983a
SHA512 80e5785beb2de61ea8cc9882e94e3abf99917556467ebf935297a9e0f7376b313850cdb0ffea2d98ada9db8c6b3a6104572399667e8cfde0cd537775e445b0ad
SSDEEP 12288:X1H8fn8lnoHhvwUPfveUFn6GxiPdAIl7o:XF8nWE4keu26Iu
MD5 SHA1 SHA512 SSDEEP

Submit Download

legacy8ujsse.jar.p2

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\legacy8ujsse.jar.p2
Size 271KB
SHA256 40799e64da3944f75ddb8e9a378c7d37fe8c94183f173717b2f08dad865cf89d
MD5 3b997068ed80236ba82703b7c8275621
SHA1 63d2bbca29231220d5beb285c9cf263b4c93acb9
SHA512 c67ca18a538ea12e0032728e575f25b11da6b847ec3eccceb59c53d18eddbc4d711d4684e8f60ed0da6e7149ab31a9f8c04ef45f5c5792ceb749c3f7e5b7ddb4
SSDEEP 6144:wkRW6Sp+RI7HP7YJXv50+ACy1av07m2WtozTItNBW:Jc887s5vf0auJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

openjsse.jar

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\openjsse.jar
Size 1.3MB
SHA256 47545a341a3e7b99164150d000607e10b7b3a16caf3320090fc1e5c6128c13e1
MD5 a2dd6baced76fe17ef8db6d6a6dca1ec
SHA1 26e46d9fb59464f895da1474ed0c545831311bd0
SHA512 a9472630786ca3369c3e1d9303b5430eb744c962d7287b95d75caaf00d15ef735c985e5093cc2d36dabfccaab2782210f71eec1be3cd1cc05886eaa969ddc947
SSDEEP 24576:kZuNn4pYhFTDB+qCmTIyhehSwZhj+LZYmlf8xq54qD8Cc:1N0YHBPibRZgtaCVYv
MD5 SHA1 SHA512 SSDEEP

Submit Download

openjsse.jar.p2

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\openjsse.jar.p2
Size 580KB
SHA256 ec51166a6f4796de2283de2a59e9143d953fe37bf9abbc71873a3978dbec85db
MD5 558a800e89bc6c647e2909a0c91dd9f8
SHA1 8fcfec1b4e704661ff0c7599e0ee2ec60c69088c
SHA512 19e585b8d1c13ab511ee66615442fb2bce3bb529225b623271a8f27a58d76d541434ac02b619d55bbca03f1f9adae94745bc1f2504eadc7f00220b49ba6c13bf
SSDEEP 6144:x7M0OZX224seLcjlbvXd8I6+DwJlZ3yrwgNc7GuffND7votTItNUT:xAhXksdll84MlZiOQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

sunmscapi.jar

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\sunmscapi.jar
Size 42KB
SHA256 c5a5dced73b692eaa10278c1798ab5703871d4813781239f3ab6155783d947e2
MD5 e862f2417b9e605077b14bd40870f81b
SHA1 b1af847865894e4aca999cf15254950a3adbc66a
SHA512 0164cfa331d7b0c469a9cc0876ae9722380dd63f19e08f12a1bb8e1c9c989e704d76c12a226cb4a90d09a57b0ab7c6bdb3f7cf4549f99a5f8df6ef104e490864
SSDEEP 768:4YGNjBvF8N2fivAZ76Lzl174BXGUEbIffFrNYgZwj5T0HpkFiiyy8Je/8g49vr0n:4YGNjxmN2kAZ76LzlqBXziInFrNY6QVl
MD5 SHA1 SHA512 SSDEEP

Submit Download

sunmscapi.jar.p2

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\sunmscapi.jar.p2
Size 21KB
SHA256 9d37087d57531c4c8438c3fa64a506b08f71b5cb5462bff59d653d06d1170b22
MD5 ee900003bb298d82c1c1ab65bf0d1038
SHA1 ce744e382e9327f49527e4753bd9a316668bb836
SHA512 845968c8192de9ca2a78c9da05041138eac5f80252b3cb1680b3ce2f0fdca99f68fab65f7fbefe71b8f0f953dc3bec4ad23708b1dde8e387525911dfaa16b5b3
SSDEEP 384:2nW+lH/HBPpyuH75nreZzZixpfieL68CqEgjpdcnGGx5Lc:0p/HBPpHH75nreZzZip6025LI
MD5 SHA1 SHA512 SSDEEP

Submit Download

sunpkcs11.jar

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\sunpkcs11.jar
Size 263KB
SHA256 0370bfd5c5b93a86d4ab384bd1954833b663037f922dffdd145b0c4708848f15
MD5 3b484d613b13097df94fc02830625fe3
SHA1 2ae78e428005a2aa4c1c186e13b015ed8f626d98
SHA512 2696a1673c62b9e0b87f417b441babbae55dcfa36f631fee0907e8ab61e4d004a0a273668fe15474a7adb0d48a7009b58783e8173eb8bd73481f75f5b1293a1a
SSDEEP 6144:B4U71wLBndmc1vO3w3A2Km9mS8GvlTDe00kt5m:OUJwVnMcPgmMS8mlH1nm
MD5 SHA1 SHA512 SSDEEP

Submit Download

sunpkcs11.jar.p2

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\ext\sunpkcs11.jar.p2
Size 164KB
SHA256 dab578370c83bb0f88da5446c17c45ca2f173483ae7849cf1e1078651c5b3ae8
MD5 f70f2e791c4bc4f97e0cfd293efdfb00
SHA1 a5f9f5590777cfc7de8b7808f88fda67dcb3808a
SHA512 e501635bb7b1a1cb9f61241a14f3ef0e7aaef20c93cea91167b1c7dca2d872fbb0d03990976598d06dc4f7bee9fc1dace90a404ca5bcaece92e99e6b7f7a0cf4
SSDEEP 1536:a+/ZoB/6tYyDMjoE0gtsxYZ4tn5NB/5WGob44j44L4EnkQ4444xvqhfCM/G7vpsT:asViDpsxCehZC8EmYbykjuyWvO8V9P
MD5 SHA1 SHA512 SSDEEP

Submit Download

jsse.jar

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\jsse.jar
Size 1.8MB
SHA256 452bed925863a3686bc9ec5caedf73668bb3b6347f13c6c5c48a93b33c76e6e2
MD5 aba762047180d748d13038c79a297273
SHA1 2149fdcac374a7571fe5f838decd9f78159a8b8e
SHA512 8cc67b7bfdd045c040e560b3a0d07c9d8e5510cf18a9aaf59bd468614004e16389cbe06e4d5ddd689cf26aa4fe6939bd474cecd6ec7f630e109185c3b6b89770
SSDEEP 12288:XeP3N5Yk/oPN6BUZGxu002wAZuEOTsikQoYpwmrrTR7Z:XS3I9Gxndu5kQV7p7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

jsse.jar.p2

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\jsse.jar.p2
Size 365KB
SHA256 f98ddeff204be7f6ff1b302476c0cb2d798ae6dff177cf3785f7a783671e184e
MD5 d0b67b9950cc7c430f718b97d1fa5e9e
SHA1 570611a0cdcfeb970154f06efc39900b09a25e5d
SHA512 154d86ba9963b64b298e544a836f9266637c04dcd9da947404aa3ba5b47d50fe6031709173f16afafcd909644865b0711018e8facb428a68608294d3d92ad74d
SSDEEP 3072:eW31G1XEPjwafKNYge+i0mca9KZfH9D0GCCCCbNuamI+o3Uz3U5am8zEXECb1kb2:z3EhafeYg3cceKZfHTuf55rkA8
MD5 SHA1 SHA512 SSDEEP

Submit Download

rt.jar

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\rt.jar
Size 30.7MB
SHA256 f8572a4a5da6729d9461f5dbf63cec59dc4fdbd1290be2caf85049d4dda718c6
MD5 f3d76a37c126b2c9361a751d5ecbc426
SHA1 717cf9d6f1adaa255964eb2b08bccffcbdd2f423
SHA512 c217b63445afbe39736b8497347d2240b463b654c7e2c2c69027db0dbb4c871565c87db0a664fae520882af2a40c9772b644f155cb7ab5e768abae4b0a6739b1
SSDEEP 98304:P/YQ+7mYkJ4kojQLDVKPmCPA0AVOas0wliMMf+RSxDK4LbIkrLI0ZWdAEnPE/P54:VoNPmCPA0AMas0wlZSxjLbI6ZWdZcc/
MD5 SHA1 SHA512 SSDEEP

Submit Download

rt.jar.p2

Path C:\Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\lib\rt.jar.p2
Size 15.7MB
SHA256 a7138824d761e3f2586f05226630c13fb538d405d095e5167c62b21390546daa
MD5 a7ddd38de7a6d515978bd3786db5f475
SHA1 ae8b0b7204fc02113dc5b40cb2d6ee7dc7554ab8
SHA512 46cae11274e4aea0ac75b069e4e9325386a3f82fd5aa00efd3e719ac4054c984f7b35760c99e7dc1b7b4ba09abcbf13e049c3b37fc51372fdf89faa2cc70a600
SSDEEP 196608:htEt6KSgAA4DAVQPZbnevjz0V8NtaJTTFmFkoll/o:jlKPAA4DAVQPZbnevjIAkollg
MD5 SHA1 SHA512 SSDEEP

Submit Download

jwutils_win32.dll

Path \Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapper-JWrapper-00097526671-complete\jwutils_win32.dll
Size 215KB
SHA256 15efd7fbc433648e95450ece65ea27b2eb0c9142a8aab011660e0287eab366b2
MD5 6c81694e80a30afdcb1fd52abe69c17a
SHA1 bc5b890a25aaf397b386091ed38591386f5a7730
SHA512 2e8c095c2cd338057fef8b693e10f93eaf669111e67bd9a235b0903f25b016a9a2ce966a5f5086c415964d7b1eb3d35f1e45da592111c9722b1b6c2b0f5a3033
SSDEEP 3072:bOX2K6Wqy7w6rRjKGvpU40ywcV1ASmv+c2Tj2qPNFgFzFLFKuF5F8:qXJxKGvpXxOcjLNKVF1v+
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvm.dll

Path \Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapper-Windows32JRE-00084000053-complete\bin\client\jvm.dll
Size 3.8MB
SHA256 1bb778575301d60089b78705c59a895f4cbcde5f325445d40b2e14b9fb070d8b
MD5 ad097eba9b877fef2770f0d7c6aa8b66
SHA1 7649970441014f1c7359e6602ce1c702eb6729a8
SHA512 722a8d16d87642f4d3d7cd955d9a55ea0eb2dd4225f3b194acf2ac37eba3580fc1cb2b51a8fc1f493d75d6d4805b2722662cdcfa1a04d871da46cdf7a0626b64
SSDEEP 98304:lxF62xf6qzZ0CQ1tdNdujDQeZetuuTcv/G1y:lxF62xxZ0CQvdujDQeE5cv/Gc
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.dll

Path \Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapper-Windows32JRE-00084000053-complete\bin\java.dll
Size 124KB
SHA256 20c9eed8ab86613bd6285756a7c20071ab0443ff62e4561c02527473e0dad658
MD5 62460b9fb42e5a5bb36cbfc8eed6935c
SHA1 fd9c9d7c9c808f341bdf5a65df6160d6e8ba7cce
SHA512 c94ab9fd0a600e37661c420b3108f37a0210996f09a1685f0f7bedebeb43c9e52340c850d681dd6444e640d22d4ec63d0cc82f53337d31cb112e087c6be4ca6c
SSDEEP 3072:jKCLZixAqTjW6LNau0fNgHcq+1RnInN3HNxG9AA21:/ZiA6LNaPLpMnc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

net.dll

Path \Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapper-Windows32JRE-00084000053-complete\bin\net.dll
Size 80KB
SHA256 f892bd41cec077229c2b4a34fce9cc0c130dff2427f86f64cc4defb2a91a621f
MD5 ef1722dc5c18d6416a3c45a39a473f6f
SHA1 74c59c536a80e0430c5fdfd7424224fe08a4c5f0
SHA512 52cc61b7fb7b6b21f2fd784bf4dec54d17e90cc098bbdbd4a7064e6c2feea61c9ece0ca3ce3b3b8d5b6ef3e55e6b1ea74e147c68347585795bea9078e96e6c3e
SSDEEP 1536:IEdjBCBoHPZOLbG8k7acGWH+UtQFaVEbh:Jkov8fGtxEbh
MD5 SHA1 SHA512 SSDEEP

Submit Download

nio.dll

Path \Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapper-Windows32JRE-00084000053-complete\bin\nio.dll
Size 50KB
SHA256 2c2a6fb722055d3385e481237399c6af1cc93abc77d9485276e8158d1715f168
MD5 823b2c4761bec0121adf70f8ab5ce638
SHA1 220610227a74e22050c1326fb2148bc4f953306b
SHA512 842a0515ed1e4a81c3536032b7e3f1b0bb77922dd25eba8c38c70ccb2d8973424fa7cc001dffee03acf2681ef5fc3b7ec04dae3e6271a2a2d03c1dabe5a27771
SSDEEP 768:v90JGX3KF8OyYs7Jlt8hpIDWzrSRyWVr0j1yxf7jC8YUwQ+pt//WpH8qwbPxDG8y:v9+GXUyIo8+RHAj1yxC8Yd/Gcqwbkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

sunec.dll

Path \Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapper-Windows32JRE-00084000053-complete\bin\sunec.dll
Size 122KB
SHA256 de5b4639ba67add1550cc99e64606af312845a33a87f49a2e2ee8916e9659f11
MD5 77e16e84b3c8b9b2f132867d136c1d93
SHA1 3e7685d27547e839da4b8d0ee98df52de1d819e9
SHA512 c4b2806d7d9113b32ff8e9417ab9133e72464ec6f1912fbed13a33ca9caf79ddda596416334b6ed9c10f6902bfc1dde4ce5653fba5a1e38e2660433501ddca7b
SSDEEP 1536:k4xTwQP4fbh3HqdWdsqbo680PXScilgKptxG0ULtt1vHWLWLWw3WDizqgPz:t0fbhNM688jiPe5v2CCwGDizqgPz
MD5 SHA1 SHA512 SSDEEP

Submit Download

sunmscapi.dll

Path \Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapper-Windows32JRE-00084000053-complete\bin\sunmscapi.dll
Size 30KB
SHA256 cd1c47fe7332aab9a821c9a64aff75f173abbc55c6d01f65f93c9c9e65ddef93
MD5 feeaaa8dfb4e2c9531d09a98f077fd48
SHA1 77b2fa341337ef6c2d853988c9bf513afcbabe6f
SHA512 57645e1e750bf19b4c07f9c7080172817de3eb42f5ecfde21c16335dbb79284672070506e74f6a03358e19ab8df09c75e2dc77fd682052ea17296394193f04f0
SSDEEP 768:sPaBpbIbssxOkoXJjBBslmuB8d6Hf3DGThZ:syTeoZjBBslmEvM
MD5 SHA1 SHA512 SSDEEP

Submit Download

verify.dll

Path \Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapper-Windows32JRE-00084000053-complete\bin\verify.dll
Size 39KB
SHA256 7290333fb8deaa13e4c90bc3b4ae3b7c40cc03f18dcc107ad0aa44d704f52858
MD5 ed82ef325e016d1102a64f681010fff6
SHA1 85a6e150fcc33f21989ce7b755b3365ddfc22148
SHA512 56a08c8e404309fae4de809baf95b35a45ff383b716519aa353cf4ad71623697ef5f1e6f54156c03a6f496f3721908395ba63dc661672b28937ebcfb532c0a38
SSDEEP 768:ObhEn4lZoQ7LEMz8mgc9vR65o00rD4WJ1Z3sxEndJPqDGArcBhK:Obhi4LnEu5EW7Z2EfPKA2
MD5 SHA1 SHA512 SSDEEP

Submit Download

zip.dll

Path \Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapper-Windows32JRE-00084000053-complete\bin\zip.dll
Size 69KB
SHA256 5bfcb6a7bed3ac63a5ad0d9ee5e350e618a78e90cc4220e0028708604671c001
MD5 a17752b09e0f94eedcc79697bd469d26
SHA1 ee0ec9fa38eccd85e3aa9b89a955af4cfbc23ed3
SHA512 a88c17dd6ac9194db650df7a41475a1d01df3917a1bace3655f7abeb18d109ce1131fbadbcb4d58e73a5aab049f2db82116eb99715b08b95ffc5d78558f12a2e
SSDEEP 1536:JURpg7oQBzRaJScPaVpXoIOwIOqonToIfWYj+9a:d7oQBl6QXumqMTBfWq+9a
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr100.dll

Path \Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\msvcr100.dll
Size 640KB
SHA256 bc22c36bded898bf9c0eae646ed8f6c2eb0c14c83acfea054846fe915644eea6
MD5 e465b64cd48af5fb398d1e8ca7551d0c
SHA1 8b3dd2c93265e6aa272b230adfd13772dfae59ac
SHA512 7016f170757909e17c678dcf9250e4db966f9e801a3676c78a5fd5214c7a2517e20d2330b84d4a19d87c3154bc0503b49ac7b1b21acaa1a10c2db1a72d4c4cab
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6Y:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

unpack200.exe

Path \Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\unpack200.exe
Size 156KB
SHA256 ed4f04090a5d543627d49ff3693e6ab1ea7ef163d34acbaf46b6ee4b76ad12e8
MD5 14a39388617fc5b75646ec85fc9ff9fd
SHA1 ff215fe0b48b7ff5a43b02f25521788328a64a7f
SHA512 48eac09ca862c3dd35436c837fa2db9d31394323e8540b1678315e9fd54b45583ae3d4180d353d3903ff1305750548b5fbac5e7276ed0e0112b0ea2d2d1f2b4e
SSDEEP 3072:455PvV+HrSDZaoOp460AwJrmJ1VTBfveag9zQHvlICB:5HrwZy+6dYrmdTBneag9zQHvp
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowslauncher.exe

Path \Users\Admin\AppData\Roaming\JWrapper-Remote Support\JWrapperTemp-1709523010-0-app\bin\windowslauncher.exe
Size 148KB
SHA256 14f684600450cdbcdba40a554da7f96e7756b5733b4854f5b30b9a35d26cba4b
MD5 d56527919a78d6ac6cef8a9cb3d0b922
SHA1 d4ea8c6ff865334fa56d19e435e58cca8cff7e36
SHA512 cd3bd8e33df78fde76827cee0ca9eab921c4bbce31aaf7b38d41d6a8d473a30ee5f50f3620741f57fd54a86a75ad11cee6f9a67c4c4b30e9987e1445af37f2b4
SSDEEP 1536:7kldyU0rumJ08aie23ucacX5O6YnIb6DQeTQwYF5tAR2pNqM8vKXNt5ZnG/jAS6V:4fyUcumJ08/QEp6DKwYjtALuVG/jNkNx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2012-317-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-332-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-333-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-335-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-334-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/2012-336-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-346-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-349-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/2012-331-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-351-0x0000000002570000-0x0000000002598000-memory.dmp

Download

memory/2012-326-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-365-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/2012-366-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/2012-316-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-372-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/2012-376-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-379-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/2012-380-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-405-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-408-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-411-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-315-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-420-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-421-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-422-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-423-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-304-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-425-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-430-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-433-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-435-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-439-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-444-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-291-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-446-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-449-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-451-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-452-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

memory/2012-459-0x00000000056D0000-0x00000000076D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads