30a0ca3adae2a904fa533369a5157a9e9bf93678794f405b981f15fd2676c6a0

Analysis

max time kernel
131s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 16:06

Target

Quest Adventure Installer/JRE/bin/jcmd.exe
Size

20KB
MD5

ec1a9abf879d7f1c2301cb8c5e0f2bdb
SHA1

ce4c9679998dc60eb868334b9d0cba0de2c6c5ff
SHA256

9400a404471d167cc86b721b4c6e61de8166bf5292cc09f62cc799bb84d1647a
SHA512

db57ac5b250da1e3f990d06e080850c09c2a59cc522b63ff4ec364af6e10846af816c8c0b7413ad7a5500480a0d7875db9a1076791fc89a7ef7e99e83276168d
SSDEEP

384:V4Mgvl1oquxaBKFyu+mA5AsTIYieTFhO0wzshlUB:MSqGFOmA5FcYiUFwzshq

Score

1^/10

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

jcmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	jcmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	jcmd.exe

C:\Users\Admin\AppData\Local\Temp\Quest Adventure Installer\JRE\bin\jcmd.exe
"C:\Users\Admin\AppData\Local\Temp\Quest Adventure Installer\JRE\bin\jcmd.exe"
1⤵
- Checks processor information in registry
PID:2196

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2196-5-0x0000021328460000-0x00000213286D0000-memory.dmp

Filesize
2.4MB

Download
memory/2196-15-0x00000213289F0000-0x0000021328C60000-memory.dmp

Filesize
2.4MB

Download
memory/2196-18-0x000002132FF20000-0x0000021330190000-memory.dmp

Filesize
2.4MB

Download
memory/2196-19-0x0000021328460000-0x00000213286D0000-memory.dmp

Filesize
2.4MB

Download
memory/2196-21-0x000002132FF20000-0x0000021330190000-memory.dmp

Filesize
2.4MB

Download
memory/2196-20-0x00000213289F0000-0x0000021328C60000-memory.dmp

Filesize
2.4MB

Download