description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\5595c1dc3d2e51a9aa52283e601b92abfd878a6ca694d548f0bda140d60d48cc = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\5595c1dc3d2e51a9aa52283e601b92abfd878a6ca694d548f0bda140d60d48cc.jar\""	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5595c1dc3d2e51a9aa52283e601b92abfd878a6ca694d548f0bda140d60d48cc = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\5595c1dc3d2e51a9aa52283e601b92abfd878a6ca694d548f0bda140d60d48cc.jar\""	java.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	360	WMIC.exe
Token: SeSecurityPrivilege	360	WMIC.exe
Token: SeTakeOwnershipPrivilege	360	WMIC.exe
Token: SeLoadDriverPrivilege	360	WMIC.exe
Token: SeSystemProfilePrivilege	360	WMIC.exe
Token: SeSystemtimePrivilege	360	WMIC.exe
Token: SeProfSingleProcessPrivilege	360	WMIC.exe
Token: SeIncBasePriorityPrivilege	360	WMIC.exe
Token: SeCreatePagefilePrivilege	360	WMIC.exe
Token: SeBackupPrivilege	360	WMIC.exe
Token: SeRestorePrivilege	360	WMIC.exe
Token: SeShutdownPrivilege	360	WMIC.exe
Token: SeDebugPrivilege	360	WMIC.exe
Token: SeSystemEnvironmentPrivilege	360	WMIC.exe
Token: SeRemoteShutdownPrivilege	360	WMIC.exe
Token: SeUndockPrivilege	360	WMIC.exe
Token: SeManageVolumePrivilege	360	WMIC.exe
Token: 33	360	WMIC.exe
Token: 34	360	WMIC.exe
Token: 35	360	WMIC.exe
Token: 36	360	WMIC.exe
Token: SeIncreaseQuotaPrivilege	360	WMIC.exe
Token: SeSecurityPrivilege	360	WMIC.exe
Token: SeTakeOwnershipPrivilege	360	WMIC.exe
Token: SeLoadDriverPrivilege	360	WMIC.exe
Token: SeSystemProfilePrivilege	360	WMIC.exe
Token: SeSystemtimePrivilege	360	WMIC.exe
Token: SeProfSingleProcessPrivilege	360	WMIC.exe
Token: SeIncBasePriorityPrivilege	360	WMIC.exe
Token: SeCreatePagefilePrivilege	360	WMIC.exe
Token: SeBackupPrivilege	360	WMIC.exe
Token: SeRestorePrivilege	360	WMIC.exe
Token: SeShutdownPrivilege	360	WMIC.exe
Token: SeDebugPrivilege	360	WMIC.exe
Token: SeSystemEnvironmentPrivilege	360	WMIC.exe
Token: SeRemoteShutdownPrivilege	360	WMIC.exe
Token: SeUndockPrivilege	360	WMIC.exe
Token: SeManageVolumePrivilege	360	WMIC.exe
Token: 33	360	WMIC.exe
Token: 34	360	WMIC.exe
Token: 35	360	WMIC.exe
Token: 36	360	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5116	WMIC.exe
Token: SeSecurityPrivilege	5116	WMIC.exe
Token: SeTakeOwnershipPrivilege	5116	WMIC.exe
Token: SeLoadDriverPrivilege	5116	WMIC.exe
Token: SeSystemProfilePrivilege	5116	WMIC.exe
Token: SeSystemtimePrivilege	5116	WMIC.exe
Token: SeProfSingleProcessPrivilege	5116	WMIC.exe
Token: SeIncBasePriorityPrivilege	5116	WMIC.exe
Token: SeCreatePagefilePrivilege	5116	WMIC.exe
Token: SeBackupPrivilege	5116	WMIC.exe
Token: SeRestorePrivilege	5116	WMIC.exe
Token: SeShutdownPrivilege	5116	WMIC.exe
Token: SeDebugPrivilege	5116	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5116	WMIC.exe
Token: SeRemoteShutdownPrivilege	5116	WMIC.exe
Token: SeUndockPrivilege	5116	WMIC.exe
Token: SeManageVolumePrivilege	5116	WMIC.exe
Token: 33	5116	WMIC.exe
Token: 34	5116	WMIC.exe
Token: 35	5116	WMIC.exe
Token: 36	5116	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5116	WMIC.exe

description	pid	Process	procid_target
PID 2924 wrote to memory of 1380	2924	java.exe	74
PID 2924 wrote to memory of 1380	2924	java.exe	74
PID 2924 wrote to memory of 996	2924	java.exe	76
PID 2924 wrote to memory of 996	2924	java.exe	76
PID 996 wrote to memory of 1760	996	java.exe	78
PID 996 wrote to memory of 1760	996	java.exe	78
PID 996 wrote to memory of 2496	996	java.exe	79
PID 996 wrote to memory of 2496	996	java.exe	79
PID 1760 wrote to memory of 3064	1760	cmd.exe	82
PID 1760 wrote to memory of 3064	1760	cmd.exe	82
PID 2496 wrote to memory of 2696	2496	java.exe	83
PID 2496 wrote to memory of 2696	2496	java.exe	83
PID 2696 wrote to memory of 360	2696	cmd.exe	85
PID 2696 wrote to memory of 360	2696	cmd.exe	85
PID 2496 wrote to memory of 4308	2496	java.exe	87
PID 2496 wrote to memory of 4308	2496	java.exe	87
PID 4308 wrote to memory of 5116	4308	cmd.exe	89
PID 4308 wrote to memory of 5116	4308	cmd.exe	89
PID 2496 wrote to memory of 3900	2496	java.exe	90
PID 2496 wrote to memory of 3900	2496	java.exe	90
PID 3900 wrote to memory of 3896	3900	cmd.exe	92
PID 3900 wrote to memory of 3896	3900	cmd.exe	92
PID 2496 wrote to memory of 1436	2496	java.exe	93
PID 2496 wrote to memory of 1436	2496	java.exe	93
PID 1436 wrote to memory of 4228	1436	cmd.exe	95
PID 1436 wrote to memory of 4228	1436	cmd.exe	95

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads