30a0ca3adae2a904fa533369a5157a9e9bf93678794f405b981f15fd2676c6a0

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 16:06

Target

Quest Adventure Installer/JRE/bin/jarsigner.exe
Size

20KB
MD5

086dbefacc6e82342ac377bdb1032c48
SHA1

727b4168f162798415c44989972b887b22ee228c
SHA256

fffe29ca53fe8abe68570fa0bed05011fbd4f37bd829206e04630bbc5b24823e
SHA512

3ac35a785c3aa6d48c5b508d843ab25bcd08c1da4f1c2341d347b838fc7001a054b1afc0c667154b1d3cffa13f5bff38440fb9e7f95c1b3f5678558a0de13d21
SSDEEP

384:44cgPl1oqcGBKFfWUteA5AIIYieTFhO0GzahC8w:dSqGFPeA5qYiUFGzahS

Score

1^/10

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

jarsigner.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	jarsigner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	jarsigner.exe

C:\Users\Admin\AppData\Local\Temp\Quest Adventure Installer\JRE\bin\jarsigner.exe
"C:\Users\Admin\AppData\Local\Temp\Quest Adventure Installer\JRE\bin\jarsigner.exe"
1⤵
- Checks processor information in registry
PID:4780

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4780-6-0x0000029524660000-0x00000295248D0000-memory.dmp

Filesize
2.4MB

Download
memory/4780-16-0x000002952C120000-0x000002952C390000-memory.dmp

Filesize
2.4MB

Download
memory/4780-15-0x0000029524BF0000-0x0000029524E60000-memory.dmp

Filesize
2.4MB

Download
memory/4780-19-0x0000029524660000-0x00000295248D0000-memory.dmp

Filesize
2.4MB

Download
memory/4780-20-0x0000029524BF0000-0x0000029524E60000-memory.dmp

Filesize
2.4MB

Download
memory/4780-21-0x000002952C120000-0x000002952C390000-memory.dmp

Filesize
2.4MB

Download