ac6bd2a094d908276dfcbc917b3d372d489cd4b9b7e38d364e74b0f8ebd9aec3

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
07/02/2025, 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac6bd2a094d908276dfcbc917b3d372d489cd4b9b7e38d364e74b0f8ebd9aec3.jar
Size

198KB
MD5

75ea1986c379d1a59b644553c595c149
SHA1

7ab180367e2c9e0ed58f9f3dd98c82873e6f4096
SHA256

ac6bd2a094d908276dfcbc917b3d372d489cd4b9b7e38d364e74b0f8ebd9aec3
SHA512

424d2f449875eec6f18632023e4f2e29faaa6610f5505a206ef2eb0a8cabb23cf3f6750e00c1b22f41381615ba27fd0e9180b25a337967e30318f12d4ea4027e
SSDEEP

3072:3EythV88HXV0aq4fKjV/36niZUuAVPQSBfQWynGwV6lsG1da+ZXJCUkXA1:3EEhV88lrKMiuu6BlyGGss4dvXMfXA1

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ac6bd2a094d908276dfcbc917b3d372d489cd4b9b7e38d364e74b0f8ebd9aec3.jar	java.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ac6bd2a094d908276dfcbc917b3d372d489cd4b9b7e38d364e74b0f8ebd9aec3 = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\ac6bd2a094d908276dfcbc917b3d372d489cd4b9b7e38d364e74b0f8ebd9aec3.jar\""	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ac6bd2a094d908276dfcbc917b3d372d489cd4b9b7e38d364e74b0f8ebd9aec3 = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\ac6bd2a094d908276dfcbc917b3d372d489cd4b9b7e38d364e74b0f8ebd9aec3.jar\""	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 4972	4560	java.exe	88
PID 4560 wrote to memory of 4972	4560	java.exe	88

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\ac6bd2a094d908276dfcbc917b3d372d489cd4b9b7e38d364e74b0f8ebd9aec3.jar
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Program Files\Java\jre-1.8\bin\java.exe
  "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\ac6bd2a094d908276dfcbc917b3d372d489cd4b9b7e38d364e74b0f8ebd9aec3.jar"
  2⤵
  PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ac6bd2a094d908276dfcbc917b3d372d489cd4b9b7e38d364e74b0f8ebd9aec3.jar

Filesize
198KB

MD5
75ea1986c379d1a59b644553c595c149

SHA1
7ab180367e2c9e0ed58f9f3dd98c82873e6f4096

SHA256
ac6bd2a094d908276dfcbc917b3d372d489cd4b9b7e38d364e74b0f8ebd9aec3

SHA512
424d2f449875eec6f18632023e4f2e29faaa6610f5505a206ef2eb0a8cabb23cf3f6750e00c1b22f41381615ba27fd0e9180b25a337967e30318f12d4ea4027e

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
d04093bad08de5d37a3a83ab1a832920

SHA1
ca71caa72199fbc1e3c4b9253f15eb9668095f71

SHA256
9049ea7b8fe6edc06dadbbd0e94fbdfad736e79da306a8691f8a4df3dd329495

SHA512
24210c785f6026c05ee6dd3557236f05bd55ab84a5dbc790a9a73857e032b04d0428267cabf5f919a7d2ee0469b760dab68d81a8751d304921efbc0c37ac6c98

Download Submit
memory/4560-38-0x000002D189B20000-0x000002D189B30000-memory.dmp

Filesize
64KB

Download
memory/4560-15-0x000002D189B20000-0x000002D189B30000-memory.dmp

Filesize
64KB

Download
memory/4560-17-0x000002D189B30000-0x000002D189B40000-memory.dmp

Filesize
64KB

Download
memory/4560-21-0x000002D189B50000-0x000002D189B60000-memory.dmp

Filesize
64KB

Download
memory/4560-20-0x000002D189B40000-0x000002D189B50000-memory.dmp

Filesize
64KB

Download
memory/4560-24-0x000002D189B60000-0x000002D189B70000-memory.dmp

Filesize
64KB

Download
memory/4560-25-0x000002D189B70000-0x000002D189B80000-memory.dmp

Filesize
64KB

Download
memory/4560-27-0x000002D189B80000-0x000002D189B90000-memory.dmp

Filesize
64KB

Download
memory/4560-13-0x000002D189B10000-0x000002D189B20000-memory.dmp

Filesize
64KB

Download
memory/4560-34-0x000002D188030000-0x000002D188031000-memory.dmp

Filesize
4KB

Download
memory/4560-36-0x000002D1898A0000-0x000002D189B10000-memory.dmp

Filesize
2.4MB

Download
memory/4560-43-0x000002D189B70000-0x000002D189B80000-memory.dmp

Filesize
64KB

Download
memory/4560-44-0x000002D189B80000-0x000002D189B90000-memory.dmp

Filesize
64KB

Download
memory/4560-42-0x000002D189B60000-0x000002D189B70000-memory.dmp

Filesize
64KB

Download
memory/4560-11-0x000002D188030000-0x000002D188031000-memory.dmp

Filesize
4KB

Download
memory/4560-41-0x000002D189B50000-0x000002D189B60000-memory.dmp

Filesize
64KB

Download
memory/4560-40-0x000002D189B40000-0x000002D189B50000-memory.dmp

Filesize
64KB

Download
memory/4560-39-0x000002D189B30000-0x000002D189B40000-memory.dmp

Filesize
64KB

Download
memory/4560-2-0x000002D1898A0000-0x000002D189B10000-memory.dmp

Filesize
2.4MB

Download
memory/4560-37-0x000002D189B10000-0x000002D189B20000-memory.dmp

Filesize
64KB

Download
memory/4972-59-0x000002506F800000-0x000002506F810000-memory.dmp

Filesize
64KB

Download
memory/4972-79-0x000002506F800000-0x000002506F810000-memory.dmp

Filesize
64KB

Download
memory/4972-48-0x000002506F590000-0x000002506F800000-memory.dmp

Filesize
2.4MB

Download
memory/4972-63-0x000002506F820000-0x000002506F830000-memory.dmp

Filesize
64KB

Download
memory/4972-67-0x000002506F840000-0x000002506F850000-memory.dmp

Filesize
64KB

Download
memory/4972-66-0x000002506F830000-0x000002506F840000-memory.dmp

Filesize
64KB

Download
memory/4972-71-0x000002506F860000-0x000002506F870000-memory.dmp

Filesize
64KB

Download
memory/4972-70-0x000002506F850000-0x000002506F860000-memory.dmp

Filesize
64KB

Download
memory/4972-74-0x000002506F870000-0x000002506F880000-memory.dmp

Filesize
64KB

Download
memory/4972-77-0x000002506DCC0000-0x000002506DCC1000-memory.dmp

Filesize
4KB

Download
memory/4972-78-0x000002506F590000-0x000002506F800000-memory.dmp

Filesize
2.4MB

Download
memory/4972-61-0x000002506F810000-0x000002506F820000-memory.dmp

Filesize
64KB

Download
memory/4972-81-0x000002506F810000-0x000002506F820000-memory.dmp

Filesize
64KB

Download
memory/4972-82-0x000002506F820000-0x000002506F830000-memory.dmp

Filesize
64KB

Download
memory/4972-83-0x000002506F830000-0x000002506F840000-memory.dmp

Filesize
64KB

Download
memory/4972-84-0x000002506F840000-0x000002506F850000-memory.dmp

Filesize
64KB

Download
memory/4972-85-0x000002506F850000-0x000002506F860000-memory.dmp

Filesize
64KB

Download
memory/4972-86-0x000002506F860000-0x000002506F870000-memory.dmp

Filesize
64KB

Download
memory/4972-87-0x000002506F870000-0x000002506F880000-memory.dmp

Filesize
64KB

Download
memory/4972-89-0x000002506F880000-0x000002506F890000-memory.dmp

Filesize
64KB

Download
memory/4972-91-0x000002506F890000-0x000002506F8A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads