Analysis
-
max time kernel
32s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/04/2024, 03:04
Static task
static1
Behavioral task
behavioral1
Sample
nAntiBot-6.1.21.jar
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
nAntiBot-6.1.21.jar
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
nAntiBot-6.1.21.jar
-
Size
1.9MB
-
MD5
8ff52c07f6d0d7539a4c0d2077273de6
-
SHA1
7268b6e6946bd41dc27472db9cc6cb533f56694e
-
SHA256
90d82df839fea88883f0cb3c259b656ea5ebd58d697b106c80ca31b46a35feac
-
SHA512
0f8cbba66a3612f86be42d290b97193c80dd36d6a5efe6450e0b5aedd7b0df83d3423809a66d679f1286064578f38824e85b548e04bd61c0c864b79941db7446
-
SSDEEP
24576:ERcWH/NhLoTiulKvrs8LaoNiAawZ+YFVExIkE3brb+WTbeYVOThrbFHlkq5ki1bw:1WH/NhcnKvlaoNNaw8YPE5ufFOtB9zzw
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2716 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2716 taskmgr.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe -
Suspicious use of SendNotifyMessage 37 IoCs
pid Process 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe 2716 taskmgr.exe
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\nAntiBot-6.1.21.jar1⤵PID:3016
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2716