Analysis

  • max time kernel
    94s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 02:15

General

  • Target

    mains-main/Java.jar

  • Size

    20.1MB

  • MD5

    35104d7c2b898e95d2376dae16480947

  • SHA1

    63e5393576254cf8f0a2bc98c685a42725ae5816

  • SHA256

    214e9a22cfc442496b56584cc6fc8127a36b647652d532c67c091c1bd546a3a7

  • SHA512

    778222e37dd395850a65d30ffd4e9818b6fd9b381d3dbae0e66585ad2f2785e908938dfadbc3c4ef83652c59d407697a27c9a33fb973ef0e8435aa07c31e1b98

  • SSDEEP

    393216:2ypV3BNHWn22TgCWb+S0wjCeZqz7tCJXh9Qmw73gCcwzadJovsXWeGN+DA:2eFQ2rGSfCtCJXTqzgCcwz2oEXU

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\mains-main\Java.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:212
    • C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:List
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/212-2-0x0000029AC8470000-0x0000029AC86E0000-memory.dmp

    Filesize

    2.4MB

  • memory/212-12-0x0000029AC6C20000-0x0000029AC6C21000-memory.dmp

    Filesize

    4KB

  • memory/212-13-0x0000029AC8470000-0x0000029AC86E0000-memory.dmp

    Filesize

    2.4MB