Overview
overview
10Static
static
10jre/bin/jaas_nt.dll
windows10-2004-x64
8jre/bin/jabswitch.exe
windows10-2004-x64
3jre/bin/java-rmi.exe
windows10-2004-x64
3jre/bin/java.dll
windows10-2004-x64
3jre/bin/java.exe
windows10-2004-x64
3jre/bin/ja...mo.dll
windows10-2004-x64
3jre/bin/javacpl.dll
windows10-2004-x64
3jre/bin/javacpl.exe
windows10-2004-x64
3jre/bin/ja...nt.dll
windows10-2004-x64
3jre/bin/ja...2k.dll
windows10-2004-x64
3jre/bin/ja...io.dll
windows10-2004-x64
3jre/bin/javaw.exe
windows10-2004-x64
3jre/bin/javaws.exe
windows10-2004-x64
3jre/bin/jawt.dll
windows10-2004-x64
3jre/bin/jdwp.dll
windows10-2004-x64
3jre/bin/jfr.dll
windows10-2004-x64
3jre/bin/jfxmedia.dll
windows10-2004-x64
3jre/bin/jfxwebkit.dll
windows10-2004-x64
3jre/bin/jjs.exe
windows10-2004-x64
3jre/bin/jli.dll
windows10-2004-x64
3jre/bin/jp2iexp.dll
windows10-2004-x64
3jre/bin/jp...er.exe
windows10-2004-x64
3jre/bin/jp2native.dll
windows10-2004-x64
3jre/bin/jp2ssv.dll
windows10-2004-x64
3jre/bin/jpeg.dll
windows10-2004-x64
3jre/bin/jsdt.dll
windows10-2004-x64
3jre/bin/jsound.dll
windows10-2004-x64
3jre/bin/jsoundds.dll
windows10-2004-x64
3jre/bin/kcms.dll
windows10-2004-x64
3jre/bin/keytool.exe
windows10-2004-x64
3jre/bin/kinit.exe
windows10-2004-x64
3jre/bin/klist.exe
windows10-2004-x64
3Analysis
-
max time kernel
595s -
max time network
448s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-01-2025 21:21
Behavioral task
behavioral1
Sample
jre/bin/jaas_nt.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
jre/bin/jabswitch.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
jre/bin/java-rmi.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
jre/bin/java.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
jre/bin/java.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
jre/bin/java_crw_demo.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
jre/bin/javacpl.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
jre/bin/javacpl.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
jre/bin/javafx_font.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
jre/bin/javafx_font_t2k.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
jre/bin/javafx_iio.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
jre/bin/javaw.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
jre/bin/javaws.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
jre/bin/jawt.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
jre/bin/jdwp.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
jre/bin/jfr.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
jre/bin/jfxmedia.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
jre/bin/jfxwebkit.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
jre/bin/jjs.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
jre/bin/jli.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
jre/bin/jp2iexp.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
jre/bin/jp2launcher.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
jre/bin/jp2native.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
jre/bin/jp2ssv.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
jre/bin/jpeg.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
jre/bin/jsdt.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
jre/bin/jsound.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
jre/bin/jsoundds.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
jre/bin/kcms.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
jre/bin/keytool.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
jre/bin/kinit.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral32
Sample
jre/bin/klist.exe
Resource
win10v2004-20241007-en
General
-
Target
jre/bin/javacpl.exe
-
Size
68KB
-
MD5
c2a59c7343d370bc57765896490331e5
-
SHA1
a50af979e08a65eb370763a7f70cdb0e179d705d
-
SHA256
40614fe8b91e01ad3562102e440bdbf5fac5d9f7292c6b16a58f723bfffe6066
-
SHA512
ca266f1b2e51f66d119e2d71e3377c229a3d583853ffb606c101afeb41689ace7d1f1594781091da67f9be9d09f3019bf048c0f819777e8f1827a56beec252c4
-
SSDEEP
768:jFVfr2k521ZnrawwMmqPXt+rP3b/9/YMCxx0OpPOrEE14EVHLAuDeGJiqrmehiV9:PxioMmqF+2x0MORLVq7qjh3rmKPNpwGg
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javacpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3232 javaw.exe 3232 javaw.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4664 wrote to memory of 3232 4664 javacpl.exe 81 PID 4664 wrote to memory of 3232 4664 javacpl.exe 81 PID 4664 wrote to memory of 3232 4664 javacpl.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\jre\bin\javacpl.exe"C:\Users\Admin\AppData\Local\Temp\jre\bin\javacpl.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\jre\bin\javaw.exe"C:\Users\Admin\AppData\Local\Temp\jre\bin\javaw.exe" -Xbootclasspath/a:"C:\Users\Admin\AppData\Local\Temp\jre\bin\..\lib\deploy.jar" -Djava.locale.providers=HOST,JRE,SPI -Duser.home="C:\Users\Admin" com.sun.deploy.panel.ControlPanel2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3232
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c3b1e448a317ab31d21e9b4ee72672d9
SHA1855010382bbcfef4d0540bf4850fd451ececc0f2
SHA256c2e91bce5191882dd3689dc3546bb821c506af1deec3ba76abbf117d82e68665
SHA512032fc22d9738a85db9875af31366e74ceeff6ca2d847d35aaed9ebce2822f3a5eeab09eca82566c455b41697508e81c5869cfab0540f41fb849562e08094d05e
-
Filesize
1KB
MD5cc773d992710064462bd3734feb43d0c
SHA12cda05c664d444262b3d5f5cbaa046a879c5734b
SHA256f3e9d64edcc961b77849aa134d836b44aa1d274a334879ead7bfeb85e472ce83
SHA512e2020746ae035fa06d31bcaa783c934dd00d981767b625ba736dfd35702908404355ffaec3c770208dadc87371a184d22ed9855de0c913dec58f56530f3aaef8
-
Filesize
12KB
MD5a66e19c05f3e0b24ac077a37c2b7589e
SHA18b9ad1517985c48c0bd11670fabd3648bac9d1ff
SHA2569771364d53fa9b1bd14cef7e48be1f5df23b11aac9f5cb6763a4934b3190e126
SHA5120876a0072ac19f03818a2e5d77cec638470a09e40cd3794d901f1625c3f701f7b37a5cc6e23057a53e62d6e936f5c90bdd4a2c811c64dcfaa20dca5fdf63565f