Analysis
- max time kernel
28s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
25/04/2026, 07:47
General
- Target Toolscreen.jar
- Size 7.7MB
- Sample260425-jmx2jsbt9v
- SHA256 d99e5982c335acb1e894444fe60f501618ab2b4c0d0f5f26b43de08600361b06
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Toolscreen.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState2⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"2⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /reg:642⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /reg:322⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { (Get-MpPreference).ExclusionPath | ForEach-Object { $_ } } catch { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"2⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /reg:642⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /reg:322⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { (Get-MpPreference).ExclusionPath | ForEach-Object { $_ } } catch { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_05afo3gh.epy.ps1
memory/3240-11-0x00000207E53E0000-0x00000207E53E1000-memory.dmp
memory/3240-170-0x0000020780CA0000-0x000002078144E000-memory.dmp
memory/3240-169-0x00000207E6C70000-0x00000207E6EE0000-memory.dmp
memory/3240-116-0x00000207E53E0000-0x00000207E53E1000-memory.dmp
memory/3240-109-0x00000207E53E0000-0x00000207E53E1000-memory.dmp
memory/3240-2-0x00000207E6C70000-0x00000207E6EE0000-memory.dmp
memory/3240-85-0x00000207E53E0000-0x00000207E53E1000-memory.dmp
memory/3240-84-0x00000207E53E0000-0x00000207E53E1000-memory.dmp
memory/3240-65-0x00000207E53E0000-0x00000207E53E1000-memory.dmp
memory/3916-30-0x00000270AA060000-0x00000270AA113000-memory.dmp
memory/3916-32-0x00000270AA3A0000-0x00000270AA3BC000-memory.dmp
memory/3916-38-0x00000270AA3D0000-0x00000270AA3DA000-memory.dmp
memory/3916-42-0x00000270912F0000-0x0000027091302000-memory.dmp
memory/3916-41-0x00000270A9460000-0x00000270A9C0E000-memory.dmp
memory/3916-36-0x00000270AA390000-0x00000270AA398000-memory.dmp
memory/3916-35-0x00000270AA3E0000-0x00000270AA3FA000-memory.dmp
memory/3916-14-0x00000270912E0000-0x00000270912F0000-memory.dmp
memory/3916-15-0x00000270912E0000-0x00000270912F0000-memory.dmp
memory/3916-34-0x00000270AA380000-0x00000270AA38A000-memory.dmp
memory/3916-37-0x00000270AA3C0000-0x00000270AA3C6000-memory.dmp
memory/3916-31-0x00000270AA030000-0x00000270AA03A000-memory.dmp
memory/3916-29-0x00000270AA040000-0x00000270AA05C000-memory.dmp
memory/3916-16-0x00000270A9DB0000-0x00000270A9DD2000-memory.dmp
memory/4604-59-0x000002B4CDD00000-0x000002B4CE4AE000-memory.dmp
memory/4604-60-0x000002B4B5BB0000-0x000002B4B5BC2000-memory.dmp