Analysis
-
max time kernel
389s -
max time network
302s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08-06-2024 23:52
Static task
static1
Behavioral task
behavioral1
Sample
DeluxeMenus-1.13.7-Release (3).jar
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
DeluxeMenus-1.13.7-Release (3).jar
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
DeluxeMenus-1.13.7-Release (3).jar
-
Size
3.6MB
-
MD5
9b03ad308bf3aa52cffbd77a32ec0417
-
SHA1
680cd9ca9ae5b6a478a356928a83bb7d98f67c52
-
SHA256
1fbd4d1b1acf8583385565d0dfc45a9f9e0e1ff3d4c9cc711dd5f8d8f986657e
-
SHA512
ead281d5b634d98a32630f87360994db02cb8d41115ff4b1abdd98694ab9929e304c74f6f45738be8ccebd492cd203233578be7cb394a5374f176a495fde445c
-
SSDEEP
49152:asUdpiuGKzpptFkxGTqGgq028Qqx00VWB9hbrM0rM2AuJWhtLfMmhIkkMbTl5zS6:mdpm6bFgq0hQq00VihM0Nn+tLkSWkeJo
Score
7/10
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 3844 icacls.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2340 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2340 taskmgr.exe Token: SeSystemProfilePrivilege 2340 taskmgr.exe Token: SeCreateGlobalPrivilege 2340 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe 2340 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1652 wrote to memory of 3844 1652 java.exe 85 PID 1652 wrote to memory of 3844 1652 java.exe 85
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\DeluxeMenus-1.13.7-Release (3).jar"1⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:3844
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD54552d366811e31b5c1bc856fffd0d12c
SHA1d6e716a9fbe306365087681c989ad8f1dbd2f656
SHA256eec6d98353ab4865cdf4f4ad07bcf262fa13e22b9df6468fa5312c3fd973f5a9
SHA51217e40b59199860111a5689482451eeb14535f9164a177d76082e96b895fc02bcbeba328ccf616bfbdfa79920f4ef89d7867bd672268ad0f86ac3b1ca16a4b353