5c32c8716f3693ca4fbe55d710b5dd849fa78e7b8cc6679e06bf0007f85e90d1

Analysis

max time kernel
150s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Client.1exe.exe
Size 65KB
Sample240612-vjf5easdjb
SHA256 5c32c8716f3693ca4fbe55d710b5dd849fa78e7b8cc6679e06bf0007f85e90d1
MD5 b92426021b5403b54ef9e72dda148068
SHA1 545ae20e142e0a78bbc7cd0422fbe63e2fef18c9
SHA512 6ae1f51598e71d5d95c1ea291363bb8600f48121d93c9981a125d73c04d7305344090a0e69fabda3a06adbb83df22c114f4820c49d006ab5eb7ab6670d63858a
SSDEEP 1536:S+SijBgKoN36t9QviFw12W9nhZlMBnvASfLteF3nLrB9z3n/aF9bRS9vM:S+SijBgKoN36t9QviFCF9nhZaBntfWlY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	New Client.1exe.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Updater Server.exe	Java Updater Server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Updater Server.exe	Java Updater Server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Updater Server.url	Java Updater Server.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\java updater server.url	taskmgr.exe

Executes dropped EXE 1 IoCs

pid	Process
4068	Java Updater Server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Updater Server.exe = "\"C:\\Windows\\Java Updater Server.exe\" .."	Java Updater Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Java Updater Server.exe = "\"C:\\Windows\\Java Updater Server.exe\" .."	Java Updater Server.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Java Updater Server.exe	New Client.1exe.exe
File opened for modification	C:\Windows\Java Updater Server.exe	Java Updater Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 22 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4624	schtasks.exe
3960	schtasks.exe
4264	schtasks.exe
408	schtasks.exe
2600	schtasks.exe
3496	schtasks.exe
1344	schtasks.exe
616	schtasks.exe
1176	schtasks.exe
3608	schtasks.exe
4236	schtasks.exe
3472	schtasks.exe
4876	schtasks.exe
3164	schtasks.exe
4048	schtasks.exe
4008	schtasks.exe
1676	schtasks.exe
1052	schtasks.exe
4064	schtasks.exe
2296	schtasks.exe
508	schtasks.exe
1396	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe
3164	New Client.1exe.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2708	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeDebugPrivilege	3164	New Client.1exe.exe
Token: SeDebugPrivilege	2708	taskmgr.exe
Token: SeSystemProfilePrivilege	2708	taskmgr.exe
Token: SeCreateGlobalPrivilege	2708	taskmgr.exe
Token: SeDebugPrivilege	4068	Java Updater Server.exe
Token: 33	4068	Java Updater Server.exe
Token: SeIncBasePriorityPrivilege	4068	Java Updater Server.exe
Token: 33	4068	Java Updater Server.exe
Token: SeIncBasePriorityPrivilege	4068	Java Updater Server.exe
Token: 33	4068	Java Updater Server.exe
Token: SeIncBasePriorityPrivilege	4068	Java Updater Server.exe
Token: 33	4068	Java Updater Server.exe
Token: SeIncBasePriorityPrivilege	4068	Java Updater Server.exe
Token: 33	4068	Java Updater Server.exe
Token: SeIncBasePriorityPrivilege	4068	Java Updater Server.exe
Token: 33	4068	Java Updater Server.exe
Token: SeIncBasePriorityPrivilege	4068	Java Updater Server.exe
Token: 33	4068	Java Updater Server.exe
Token: SeIncBasePriorityPrivilege	4068	Java Updater Server.exe
Token: 33	4068	Java Updater Server.exe
Token: SeIncBasePriorityPrivilege	4068	Java Updater Server.exe
Token: 33	4068	Java Updater Server.exe
Token: SeIncBasePriorityPrivilege	4068	Java Updater Server.exe
Token: 33	4068	Java Updater Server.exe
Token: SeIncBasePriorityPrivilege	4068	Java Updater Server.exe
Token: 33	4068	Java Updater Server.exe
Token: SeIncBasePriorityPrivilege	4068	Java Updater Server.exe
Token: 33	4068	Java Updater Server.exe
Token: SeIncBasePriorityPrivilege	4068	Java Updater Server.exe
Token: 33	4068	Java Updater Server.exe
Token: SeIncBasePriorityPrivilege	4068	Java Updater Server.exe
Token: 33	4068	Java Updater Server.exe
Token: SeIncBasePriorityPrivilege	4068	Java Updater Server.exe
Token: 33	4068	Java Updater Server.exe
Token: SeIncBasePriorityPrivilege	4068	Java Updater Server.exe
Token: 33	4068	Java Updater Server.exe
Token: SeIncBasePriorityPrivilege	4068	Java Updater Server.exe
Token: 33	4068	Java Updater Server.exe
Token: SeIncBasePriorityPrivilege	4068	Java Updater Server.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe
2708	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 4068	3164	New Client.1exe.exe	83
PID 3164 wrote to memory of 4068	3164	New Client.1exe.exe	83
PID 3164 wrote to memory of 4068	3164	New Client.1exe.exe	83
PID 3164 wrote to memory of 4132	3164	New Client.1exe.exe	84
PID 3164 wrote to memory of 4132	3164	New Client.1exe.exe	84
PID 3164 wrote to memory of 4132	3164	New Client.1exe.exe	84
PID 4132 wrote to memory of 1320	4132	cmd.exe	86
PID 4132 wrote to memory of 1320	4132	cmd.exe	86
PID 4132 wrote to memory of 1320	4132	cmd.exe	86
PID 4068 wrote to memory of 1372	4068	Java Updater Server.exe	87
PID 4068 wrote to memory of 1372	4068	Java Updater Server.exe	87
PID 4068 wrote to memory of 1372	4068	Java Updater Server.exe	87
PID 4068 wrote to memory of 3608	4068	Java Updater Server.exe	89
PID 4068 wrote to memory of 3608	4068	Java Updater Server.exe	89
PID 4068 wrote to memory of 3608	4068	Java Updater Server.exe	89
PID 4068 wrote to memory of 4632	4068	Java Updater Server.exe	91
PID 4068 wrote to memory of 4632	4068	Java Updater Server.exe	91
PID 4068 wrote to memory of 4632	4068	Java Updater Server.exe	91
PID 4068 wrote to memory of 1052	4068	Java Updater Server.exe	93
PID 4068 wrote to memory of 1052	4068	Java Updater Server.exe	93
PID 4068 wrote to memory of 1052	4068	Java Updater Server.exe	93
PID 4068 wrote to memory of 764	4068	Java Updater Server.exe	95
PID 4068 wrote to memory of 764	4068	Java Updater Server.exe	95
PID 4068 wrote to memory of 764	4068	Java Updater Server.exe	95
PID 4068 wrote to memory of 4264	4068	Java Updater Server.exe	97
PID 4068 wrote to memory of 4264	4068	Java Updater Server.exe	97
PID 4068 wrote to memory of 4264	4068	Java Updater Server.exe	97
PID 4068 wrote to memory of 1528	4068	Java Updater Server.exe	103
PID 4068 wrote to memory of 1528	4068	Java Updater Server.exe	103
PID 4068 wrote to memory of 1528	4068	Java Updater Server.exe	103
PID 4068 wrote to memory of 4064	4068	Java Updater Server.exe	105
PID 4068 wrote to memory of 4064	4068	Java Updater Server.exe	105
PID 4068 wrote to memory of 4064	4068	Java Updater Server.exe	105
PID 4068 wrote to memory of 1332	4068	Java Updater Server.exe	109
PID 4068 wrote to memory of 1332	4068	Java Updater Server.exe	109
PID 4068 wrote to memory of 1332	4068	Java Updater Server.exe	109
PID 4068 wrote to memory of 408	4068	Java Updater Server.exe	111
PID 4068 wrote to memory of 408	4068	Java Updater Server.exe	111
PID 4068 wrote to memory of 408	4068	Java Updater Server.exe	111
PID 4068 wrote to memory of 1224	4068	Java Updater Server.exe	114
PID 4068 wrote to memory of 1224	4068	Java Updater Server.exe	114
PID 4068 wrote to memory of 1224	4068	Java Updater Server.exe	114
PID 4068 wrote to memory of 2600	4068	Java Updater Server.exe	116
PID 4068 wrote to memory of 2600	4068	Java Updater Server.exe	116
PID 4068 wrote to memory of 2600	4068	Java Updater Server.exe	116
PID 4068 wrote to memory of 2924	4068	Java Updater Server.exe	118
PID 4068 wrote to memory of 2924	4068	Java Updater Server.exe	118
PID 4068 wrote to memory of 2924	4068	Java Updater Server.exe	118
PID 4068 wrote to memory of 3496	4068	Java Updater Server.exe	120
PID 4068 wrote to memory of 3496	4068	Java Updater Server.exe	120
PID 4068 wrote to memory of 3496	4068	Java Updater Server.exe	120
PID 4068 wrote to memory of 4416	4068	Java Updater Server.exe	122
PID 4068 wrote to memory of 4416	4068	Java Updater Server.exe	122
PID 4068 wrote to memory of 4416	4068	Java Updater Server.exe	122
PID 4068 wrote to memory of 2296	4068	Java Updater Server.exe	124
PID 4068 wrote to memory of 2296	4068	Java Updater Server.exe	124
PID 4068 wrote to memory of 2296	4068	Java Updater Server.exe	124
PID 4068 wrote to memory of 3492	4068	Java Updater Server.exe	126
PID 4068 wrote to memory of 3492	4068	Java Updater Server.exe	126
PID 4068 wrote to memory of 3492	4068	Java Updater Server.exe	126
PID 4068 wrote to memory of 508	4068	Java Updater Server.exe	128
PID 4068 wrote to memory of 508	4068	Java Updater Server.exe	128
PID 4068 wrote to memory of 508	4068	Java Updater Server.exe	128
PID 4068 wrote to memory of 464	4068	Java Updater Server.exe	130

C:\Users\Admin\AppData\Local\Temp\New Client.1exe.exe
"C:\Users\Admin\AppData\Local\Temp\New Client.1exe.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\Java Updater Server.exe
  "C:\Windows\Java Updater Server.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:1372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:3608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:4632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:1052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:4264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:1528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:4064
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:1332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:1224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:2600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:3496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:4416
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:2296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:3492
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:3164
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:4132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:4048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:4436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:4236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:1344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:5028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:3472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:1464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:4008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:3580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:4328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:1396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:2272
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:4876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:1660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:4624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:4124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:3960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:1316
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:1676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Java Updater Server" /f
    3⤵
    PID:1508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Java Updater Server" /tr C:\Windows\Java Updater Server.exe
    3⤵
    - Creates scheduled task(s)
    PID:1176
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\New Client.1exe.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\SysWOW64\choice.exe
    choice /C Y /N /D Y /T 5
    3⤵
    PID:1320

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Java Updater Server.url

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Updater Server.url
Size 190B
SHA256 0840f47410ae49e2dc6482522f0e89b855763b4289eb9aa71e4814eeaedb1af6
MD5 6e9126d34d02f52e648d43286e54503c
SHA1 66eeb3cb24e756d534fea36c769d31fdc2f12993
SHA512 4da8a381108f586e9fcf389faa6a55d74d5af762f7373bc92ddbc4cdef64bc200e6c87963f098e740a8ae2ce299a29ce092d8f680a432f77fa9b48820529936c
MD5 SHA1 SHA512

Submit Download

Java Updater Server.exe

Path C:\Windows\Java Updater Server.exe
Size 65KB
SHA256 5c32c8716f3693ca4fbe55d710b5dd849fa78e7b8cc6679e06bf0007f85e90d1
MD5 b92426021b5403b54ef9e72dda148068
SHA1 545ae20e142e0a78bbc7cd0422fbe63e2fef18c9
SHA512 6ae1f51598e71d5d95c1ea291363bb8600f48121d93c9981a125d73c04d7305344090a0e69fabda3a06adbb83df22c114f4820c49d006ab5eb7ab6670d63858a
SSDEEP 1536:S+SijBgKoN36t9QviFw12W9nhZlMBnvASfLteF3nLrB9z3n/aF9bRS9vM:S+SijBgKoN36t9QviFCF9nhZaBntfWlY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2708-16-0x0000026C38460000-0x0000026C38461000-memory.dmp

Download

memory/2708-15-0x0000026C38460000-0x0000026C38461000-memory.dmp

Download

memory/2708-5-0x0000026C38460000-0x0000026C38461000-memory.dmp

Download

memory/2708-6-0x0000026C38460000-0x0000026C38461000-memory.dmp

Download

memory/2708-11-0x0000026C38460000-0x0000026C38461000-memory.dmp

Download

memory/2708-17-0x0000026C38460000-0x0000026C38461000-memory.dmp

Download

memory/2708-12-0x0000026C38460000-0x0000026C38461000-memory.dmp

Download

memory/2708-7-0x0000026C38460000-0x0000026C38461000-memory.dmp

Download

memory/2708-14-0x0000026C38460000-0x0000026C38461000-memory.dmp

Download

memory/2708-13-0x0000026C38460000-0x0000026C38461000-memory.dmp

Download

memory/3164-0-0x0000000074F82000-0x0000000074F83000-memory.dmp

Download

memory/3164-2-0x0000000074F80000-0x0000000075531000-memory.dmp

Download

memory/3164-27-0x0000000074F80000-0x0000000075531000-memory.dmp

Download

memory/3164-1-0x0000000074F80000-0x0000000075531000-memory.dmp

Download