description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Run\27f117c2cdae0c702f1095bb7c6fe40d7efb18e4ac14d3eca5570ce1d24bac2c = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\27f117c2cdae0c702f1095bb7c6fe40d7efb18e4ac14d3eca5570ce1d24bac2c.jar\""	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\27f117c2cdae0c702f1095bb7c6fe40d7efb18e4ac14d3eca5570ce1d24bac2c = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\27f117c2cdae0c702f1095bb7c6fe40d7efb18e4ac14d3eca5570ce1d24bac2c.jar\""	java.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	96	WMIC.exe
Token: SeSecurityPrivilege	96	WMIC.exe
Token: SeTakeOwnershipPrivilege	96	WMIC.exe
Token: SeLoadDriverPrivilege	96	WMIC.exe
Token: SeSystemProfilePrivilege	96	WMIC.exe
Token: SeSystemtimePrivilege	96	WMIC.exe
Token: SeProfSingleProcessPrivilege	96	WMIC.exe
Token: SeIncBasePriorityPrivilege	96	WMIC.exe
Token: SeCreatePagefilePrivilege	96	WMIC.exe
Token: SeBackupPrivilege	96	WMIC.exe
Token: SeRestorePrivilege	96	WMIC.exe
Token: SeShutdownPrivilege	96	WMIC.exe
Token: SeDebugPrivilege	96	WMIC.exe
Token: SeSystemEnvironmentPrivilege	96	WMIC.exe
Token: SeRemoteShutdownPrivilege	96	WMIC.exe
Token: SeUndockPrivilege	96	WMIC.exe
Token: SeManageVolumePrivilege	96	WMIC.exe
Token: 33	96	WMIC.exe
Token: 34	96	WMIC.exe
Token: 35	96	WMIC.exe
Token: 36	96	WMIC.exe
Token: SeIncreaseQuotaPrivilege	96	WMIC.exe
Token: SeSecurityPrivilege	96	WMIC.exe
Token: SeTakeOwnershipPrivilege	96	WMIC.exe
Token: SeLoadDriverPrivilege	96	WMIC.exe
Token: SeSystemProfilePrivilege	96	WMIC.exe
Token: SeSystemtimePrivilege	96	WMIC.exe
Token: SeProfSingleProcessPrivilege	96	WMIC.exe
Token: SeIncBasePriorityPrivilege	96	WMIC.exe
Token: SeCreatePagefilePrivilege	96	WMIC.exe
Token: SeBackupPrivilege	96	WMIC.exe
Token: SeRestorePrivilege	96	WMIC.exe
Token: SeShutdownPrivilege	96	WMIC.exe
Token: SeDebugPrivilege	96	WMIC.exe
Token: SeSystemEnvironmentPrivilege	96	WMIC.exe
Token: SeRemoteShutdownPrivilege	96	WMIC.exe
Token: SeUndockPrivilege	96	WMIC.exe
Token: SeManageVolumePrivilege	96	WMIC.exe
Token: 33	96	WMIC.exe
Token: 34	96	WMIC.exe
Token: 35	96	WMIC.exe
Token: 36	96	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1276	WMIC.exe
Token: SeSecurityPrivilege	1276	WMIC.exe
Token: SeTakeOwnershipPrivilege	1276	WMIC.exe
Token: SeLoadDriverPrivilege	1276	WMIC.exe
Token: SeSystemProfilePrivilege	1276	WMIC.exe
Token: SeSystemtimePrivilege	1276	WMIC.exe
Token: SeProfSingleProcessPrivilege	1276	WMIC.exe
Token: SeIncBasePriorityPrivilege	1276	WMIC.exe
Token: SeCreatePagefilePrivilege	1276	WMIC.exe
Token: SeBackupPrivilege	1276	WMIC.exe
Token: SeRestorePrivilege	1276	WMIC.exe
Token: SeShutdownPrivilege	1276	WMIC.exe
Token: SeDebugPrivilege	1276	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1276	WMIC.exe
Token: SeRemoteShutdownPrivilege	1276	WMIC.exe
Token: SeUndockPrivilege	1276	WMIC.exe
Token: SeManageVolumePrivilege	1276	WMIC.exe
Token: 33	1276	WMIC.exe
Token: 34	1276	WMIC.exe
Token: 35	1276	WMIC.exe
Token: 36	1276	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1276	WMIC.exe

description	pid	Process	procid_target
PID 2772 wrote to memory of 168	2772	java.exe	73
PID 2772 wrote to memory of 168	2772	java.exe	73
PID 2772 wrote to memory of 1304	2772	java.exe	75
PID 2772 wrote to memory of 1304	2772	java.exe	75
PID 1304 wrote to memory of 1064	1304	java.exe	77
PID 1304 wrote to memory of 1064	1304	java.exe	77
PID 1304 wrote to memory of 3356	1304	java.exe	78
PID 1304 wrote to memory of 3356	1304	java.exe	78
PID 1064 wrote to memory of 4932	1064	cmd.exe	81
PID 1064 wrote to memory of 4932	1064	cmd.exe	81
PID 3356 wrote to memory of 2508	3356	java.exe	82
PID 3356 wrote to memory of 2508	3356	java.exe	82
PID 2508 wrote to memory of 96	2508	cmd.exe	84
PID 2508 wrote to memory of 96	2508	cmd.exe	84
PID 3356 wrote to memory of 4880	3356	java.exe	86
PID 3356 wrote to memory of 4880	3356	java.exe	86
PID 4880 wrote to memory of 1276	4880	cmd.exe	88
PID 4880 wrote to memory of 1276	4880	cmd.exe	88
PID 3356 wrote to memory of 3392	3356	java.exe	89
PID 3356 wrote to memory of 3392	3356	java.exe	89
PID 3392 wrote to memory of 4228	3392	cmd.exe	91
PID 3392 wrote to memory of 4228	3392	cmd.exe	91
PID 3356 wrote to memory of 1016	3356	java.exe	92
PID 3356 wrote to memory of 1016	3356	java.exe	92
PID 1016 wrote to memory of 596	1016	cmd.exe	94
PID 1016 wrote to memory of 596	1016	cmd.exe	94

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads