30a0ca3adae2a904fa533369a5157a9e9bf93678794f405b981f15fd2676c6a0

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 16:06

Target

Quest Adventure Installer/JRE/bin/jar.exe
Size

20KB
MD5

dcd7052f62acee03f755fbed49937df6
SHA1

922444b30bf4cfd2a04752ced48b03711798d227
SHA256

3dfe37237ed3c50385f390d239ab7501af81be09ca154ce6f671fc955eb67620
SHA512

b3d7af1cef9bc29634fe8f94253bb90120fc9dfbec2b2697789b46659be4fc4facb9f3e079e8c8d167f3cfe50e117c6e094c25e9efaf63eaf37b1d43cef1b8fa
SSDEEP

384:u4Mgvl1oqagXaBKFyJxsA5AAIYieTFhO0mzt/hk:jSqHZFGsA5uYiUFmzt/hk

Score

1^/10

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

jar.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	jar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	jar.exe

C:\Users\Admin\AppData\Local\Temp\Quest Adventure Installer\JRE\bin\jar.exe
"C:\Users\Admin\AppData\Local\Temp\Quest Adventure Installer\JRE\bin\jar.exe"
1⤵
- Checks processor information in registry
PID:856

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/856-5-0x0000019957B40000-0x0000019957DB0000-memory.dmp

Filesize
2.4MB

Download
memory/856-16-0x00000199580D0000-0x0000019958340000-memory.dmp

Filesize
2.4MB

Download
memory/856-18-0x000001995F600000-0x000001995F870000-memory.dmp

Filesize
2.4MB

Download
memory/856-19-0x0000019957B40000-0x0000019957DB0000-memory.dmp

Filesize
2.4MB

Download
memory/856-21-0x000001995F600000-0x000001995F870000-memory.dmp

Filesize
2.4MB

Download
memory/856-20-0x00000199580D0000-0x0000019958340000-memory.dmp

Filesize
2.4MB

Download