Analysis
-
max time kernel
86s -
max time network
78s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2024, 10:07
Static task
static1
Behavioral task
behavioral1
Sample
MavenBuilder.jar
Resource
win7-20240704-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
MavenBuilder.jar
Resource
win10v2004-20240802-en
2 signatures
150 seconds
General
-
Target
MavenBuilder.jar
-
Size
2.1MB
-
MD5
376394c56d388e58e9f7829fc7f322e4
-
SHA1
7b86c4ad2b608c8b9f96151de343c7a81f94a607
-
SHA256
5d7976bf99be502e7be886efc49e856c18a1044f8f07f04e126a1ca6c4d859db
-
SHA512
408f0c1df8ed54c957b017bff7ffb6be2ad85908558587bab2e368d09e30f157e88c465c98b5f41e6e3aaccfaf46dba0d09f5ceeec64d309bcde582cef1ac54e
-
SSDEEP
24576:X75bTEtGYmz21748pVEpHiaSvITYU+D8fgOxh/lC44TXnUpOmIZUrm1vIGIZU1y4:X75VxKnoHiF5U/fL3wX7msUrm1v23yoA
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 58 discord.com 59 discord.com 60 discord.com 62 discord.com -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1888 java.exe 1888 java.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\MavenBuilder.jar1⤵
- Suspicious use of SetWindowsHookEx
PID:1888
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4128,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:81⤵PID:3168