Analysis
-
max time kernel
94s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
25/09/2024, 10:53
Static task
static1
Behavioral task
behavioral1
Sample
Akemi-Stealer.jar
Resource
win11-20240802-en
windows11-21h2-x64
17 signatures
150 seconds
General
-
Target
Akemi-Stealer.jar
-
Size
11.5MB
-
MD5
0685bd8a3226e43102507072babd7c8c
-
SHA1
25732dafbacefb99885e7576fa28137da356433e
-
SHA256
28ba6cd4e8c4053023eed8ba837053feaac080e2a349a01d6a97f8631010f542
-
SHA512
d786d735c4e7d4ca5b2c418ffae2614ef3b1c66d741f62d72cdaf142ea4dfa60ba05fc8c789043a8361e1db7e8c81b5b7523b3262ad4b38b30f122777bd193c8
-
SSDEEP
196608:/Dfl4LDNwL4GTesx7kfUSLjnea56vClC5MZN0Njm8gRq5m51:bfl4vNwv/7jSv3kvqC5Mctt81
Score
7/10
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion reg.exe -
Loads dropped DLL 3 IoCs
pid Process 2336 java.exe 2336 java.exe 4260 javaw.EXE -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 1 raw.githubusercontent.com 1 discord.com 3 raw.githubusercontent.com 4 discord.com 7 discord.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com 2 checkip.amazonaws.com -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1248 tasklist.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4692 wmic.exe 3652 wmic.exe -
Kills process with taskkill 14 IoCs
pid Process 2192 taskkill.exe 1416 taskkill.exe 2780 taskkill.exe 4792 taskkill.exe 3020 taskkill.exe 3740 taskkill.exe 2976 taskkill.exe 3076 taskkill.exe 4488 taskkill.exe 4932 taskkill.exe 980 taskkill.exe 788 taskkill.exe 1424 taskkill.exe 2292 taskkill.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4496 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4840 powershell.exe 4840 powershell.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4692 wmic.exe Token: SeSecurityPrivilege 4692 wmic.exe Token: SeTakeOwnershipPrivilege 4692 wmic.exe Token: SeLoadDriverPrivilege 4692 wmic.exe Token: SeSystemProfilePrivilege 4692 wmic.exe Token: SeSystemtimePrivilege 4692 wmic.exe Token: SeProfSingleProcessPrivilege 4692 wmic.exe Token: SeIncBasePriorityPrivilege 4692 wmic.exe Token: SeCreatePagefilePrivilege 4692 wmic.exe Token: SeBackupPrivilege 4692 wmic.exe Token: SeRestorePrivilege 4692 wmic.exe Token: SeShutdownPrivilege 4692 wmic.exe Token: SeDebugPrivilege 4692 wmic.exe Token: SeSystemEnvironmentPrivilege 4692 wmic.exe Token: SeRemoteShutdownPrivilege 4692 wmic.exe Token: SeUndockPrivilege 4692 wmic.exe Token: SeManageVolumePrivilege 4692 wmic.exe Token: 33 4692 wmic.exe Token: 34 4692 wmic.exe Token: 35 4692 wmic.exe Token: 36 4692 wmic.exe Token: SeIncreaseQuotaPrivilege 4692 wmic.exe Token: SeSecurityPrivilege 4692 wmic.exe Token: SeTakeOwnershipPrivilege 4692 wmic.exe Token: SeLoadDriverPrivilege 4692 wmic.exe Token: SeSystemProfilePrivilege 4692 wmic.exe Token: SeSystemtimePrivilege 4692 wmic.exe Token: SeProfSingleProcessPrivilege 4692 wmic.exe Token: SeIncBasePriorityPrivilege 4692 wmic.exe Token: SeCreatePagefilePrivilege 4692 wmic.exe Token: SeBackupPrivilege 4692 wmic.exe Token: SeRestorePrivilege 4692 wmic.exe Token: SeShutdownPrivilege 4692 wmic.exe Token: SeDebugPrivilege 4692 wmic.exe Token: SeSystemEnvironmentPrivilege 4692 wmic.exe Token: SeRemoteShutdownPrivilege 4692 wmic.exe Token: SeUndockPrivilege 4692 wmic.exe Token: SeManageVolumePrivilege 4692 wmic.exe Token: 33 4692 wmic.exe Token: 34 4692 wmic.exe Token: 35 4692 wmic.exe Token: 36 4692 wmic.exe Token: SeIncreaseQuotaPrivilege 1236 wmic.exe Token: SeSecurityPrivilege 1236 wmic.exe Token: SeTakeOwnershipPrivilege 1236 wmic.exe Token: SeLoadDriverPrivilege 1236 wmic.exe Token: SeSystemProfilePrivilege 1236 wmic.exe Token: SeSystemtimePrivilege 1236 wmic.exe Token: SeProfSingleProcessPrivilege 1236 wmic.exe Token: SeIncBasePriorityPrivilege 1236 wmic.exe Token: SeCreatePagefilePrivilege 1236 wmic.exe Token: SeBackupPrivilege 1236 wmic.exe Token: SeRestorePrivilege 1236 wmic.exe Token: SeShutdownPrivilege 1236 wmic.exe Token: SeDebugPrivilege 1236 wmic.exe Token: SeSystemEnvironmentPrivilege 1236 wmic.exe Token: SeRemoteShutdownPrivilege 1236 wmic.exe Token: SeUndockPrivilege 1236 wmic.exe Token: SeManageVolumePrivilege 1236 wmic.exe Token: 33 1236 wmic.exe Token: 34 1236 wmic.exe Token: 35 1236 wmic.exe Token: 36 1236 wmic.exe Token: SeIncreaseQuotaPrivilege 1236 wmic.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe 4276 taskmgr.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2336 java.exe 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE 4260 javaw.EXE -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2892 2336 java.exe 79 PID 2336 wrote to memory of 2892 2336 java.exe 79 PID 2336 wrote to memory of 1984 2336 java.exe 81 PID 2336 wrote to memory of 1984 2336 java.exe 81 PID 2336 wrote to memory of 1744 2336 java.exe 83 PID 2336 wrote to memory of 1744 2336 java.exe 83 PID 2336 wrote to memory of 4692 2336 java.exe 85 PID 2336 wrote to memory of 4692 2336 java.exe 85 PID 2336 wrote to memory of 1236 2336 java.exe 88 PID 2336 wrote to memory of 1236 2336 java.exe 88 PID 2336 wrote to memory of 3228 2336 java.exe 90 PID 2336 wrote to memory of 3228 2336 java.exe 90 PID 2336 wrote to memory of 4712 2336 java.exe 92 PID 2336 wrote to memory of 4712 2336 java.exe 92 PID 2336 wrote to memory of 1216 2336 java.exe 94 PID 2336 wrote to memory of 1216 2336 java.exe 94 PID 2336 wrote to memory of 1248 2336 java.exe 96 PID 2336 wrote to memory of 1248 2336 java.exe 96 PID 2336 wrote to memory of 2192 2336 java.exe 98 PID 2336 wrote to memory of 2192 2336 java.exe 98 PID 2336 wrote to memory of 980 2336 java.exe 100 PID 2336 wrote to memory of 980 2336 java.exe 100 PID 2336 wrote to memory of 1416 2336 java.exe 102 PID 2336 wrote to memory of 1416 2336 java.exe 102 PID 2336 wrote to memory of 3740 2336 java.exe 104 PID 2336 wrote to memory of 3740 2336 java.exe 104 PID 2336 wrote to memory of 2780 2336 java.exe 106 PID 2336 wrote to memory of 2780 2336 java.exe 106 PID 2336 wrote to memory of 2976 2336 java.exe 108 PID 2336 wrote to memory of 2976 2336 java.exe 108 PID 2336 wrote to memory of 788 2336 java.exe 110 PID 2336 wrote to memory of 788 2336 java.exe 110 PID 2336 wrote to memory of 3076 2336 java.exe 112 PID 2336 wrote to memory of 3076 2336 java.exe 112 PID 2336 wrote to memory of 4488 2336 java.exe 114 PID 2336 wrote to memory of 4488 2336 java.exe 114 PID 2336 wrote to memory of 1424 2336 java.exe 116 PID 2336 wrote to memory of 1424 2336 java.exe 116 PID 2336 wrote to memory of 4932 2336 java.exe 118 PID 2336 wrote to memory of 4932 2336 java.exe 118 PID 2336 wrote to memory of 4792 2336 java.exe 120 PID 2336 wrote to memory of 4792 2336 java.exe 120 PID 2336 wrote to memory of 3020 2336 java.exe 122 PID 2336 wrote to memory of 3020 2336 java.exe 122 PID 2336 wrote to memory of 2292 2336 java.exe 124 PID 2336 wrote to memory of 2292 2336 java.exe 124 PID 2336 wrote to memory of 2084 2336 java.exe 126 PID 2336 wrote to memory of 2084 2336 java.exe 126 PID 2336 wrote to memory of 3516 2336 java.exe 128 PID 2336 wrote to memory of 3516 2336 java.exe 128 PID 2336 wrote to memory of 3652 2336 java.exe 130 PID 2336 wrote to memory of 3652 2336 java.exe 130 PID 2336 wrote to memory of 4840 2336 java.exe 132 PID 2336 wrote to memory of 4840 2336 java.exe 132 PID 2336 wrote to memory of 1880 2336 java.exe 134 PID 2336 wrote to memory of 1880 2336 java.exe 134 PID 2336 wrote to memory of 4588 2336 java.exe 136 PID 2336 wrote to memory of 4588 2336 java.exe 136 PID 2336 wrote to memory of 4496 2336 java.exe 138 PID 2336 wrote to memory of 4496 2336 java.exe 138 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Akemi-Stealer.jar1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SYSTEM32\reg.exereg query "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper2⤵PID:2892
-
-
C:\Windows\SYSTEM32\REG.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 22⤵PID:1984
-
-
C:\Windows\SYSTEM32\REG.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 22⤵PID:1744
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:4692
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1236
-
-
C:\Windows\SYSTEM32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion2⤵
- Checks BIOS information in registry
PID:3228
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model2⤵PID:4712
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵PID:1216
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
PID:1248
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM firefox.exe2⤵
- Kills process with taskkill
PID:2192
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM waterfox.exe2⤵
- Kills process with taskkill
PID:980
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM msedge.exe2⤵
- Kills process with taskkill
PID:1416
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM iexplore.exe2⤵
- Kills process with taskkill
PID:3740
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe2⤵
- Kills process with taskkill
PID:2780
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM iridium.exe2⤵
- Kills process with taskkill
PID:2976
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM dragon.exe2⤵
- Kills process with taskkill
PID:788
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM opera.exe2⤵
- Kills process with taskkill
PID:3076
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM brave.exe2⤵
- Kills process with taskkill
PID:4488
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM browser.exe2⤵
- Kills process with taskkill
PID:1424
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM safari.exe2⤵
- Kills process with taskkill
PID:4932
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chromium.exe2⤵
- Kills process with taskkill
PID:4792
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM pale moon.exe2⤵
- Kills process with taskkill
PID:3020
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM avant.exe2⤵
- Kills process with taskkill
PID:2292
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get /format:list2⤵PID:2084
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:3516
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
PID:3652
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4840
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber2⤵PID:1880
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get version2⤵PID:4588
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "WindowsUpdater" /tr "javaw -jar C:\Users\Admin\AppData\Roaming\Microsoft\Windows\driver.jar" /sc minute /mo 1 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4496
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4276
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.EXE"C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.EXE" -jar C:\Users\Admin\AppData\Roaming\Microsoft\Windows\driver.jar1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5e9a449971b9efb0a2e12b9cfdd95c076
SHA1385777659fa84e94a3812eb9a8afad27ae3ceed4
SHA256b8c331c9f915960201da9af9c9dc8309e95e7d533741e71f4a5d13ca007d3e18
SHA512bbcaf66b316cb60c63bb190099bee36a0059f13fa35fdf3a9a3e7e9a5304abe57acd71d644cde554427825249b460d58f0aba79f599f0c6fa40d23ea21aa941d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
248KB
MD5719d6ba1946c25aa61ce82f90d77ffd5
SHA194d2191378cac5719daecc826fc116816284c406
SHA25669c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
SHA512119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
-
C:\Users\Admin\AppData\Local\Temp\sqlite-3.44.1.0-e5810fde-9ccc-4e1e-8881-e8258bec172c-sqlitejdbc.dll
Filesize933KB
MD5e1d69e2d6b6b96891a16068b9e4cf439
SHA1e32f4dc6dbe9e5cd3a33508757feec9f5d4e198a
SHA256393e8faa8231ac4090f4feabecaf2db00c7bff4b2671c685850b36910d694967
SHA5121bd0f6d958086b20f37431f043d35637f7a99d4bef442c0092a15799bba66fc622c9f356791fb0a8b8b15fd6d6863bbb0acf1bc70fea8e1be35e0f325e9363e1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3007475212-2160282277-2943627620-1000\83aa4cc77f591dfc2374580bbd95f6ba_4880fff3-ce96-47a8-956d-b60b04225313
Filesize45B
MD5c8366ae350e7019aefc9d1e6e6a498c6
SHA15731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA25611e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA51233c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
-
Filesize
11.5MB
MD50685bd8a3226e43102507072babd7c8c
SHA125732dafbacefb99885e7576fa28137da356433e
SHA25628ba6cd4e8c4053023eed8ba837053feaac080e2a349a01d6a97f8631010f542
SHA512d786d735c4e7d4ca5b2c418ffae2614ef3b1c66d741f62d72cdaf142ea4dfa60ba05fc8c789043a8361e1db7e8c81b5b7523b3262ad4b38b30f122777bd193c8