Overview
overview
5Static
static
5Start For Window.cmd
windows10-2004-x64
5Start For Window.cmd
windows11-21h2-x64
1Start MacOS ARM.sh
windows10-2004-x64
3Start MacOS ARM.sh
windows11-21h2-x64
3files/Launcher.jar
windows10-2004-x64
1files/Launcher.jar
windows11-21h2-x64
1files/Libraries.jar
windows10-2004-x64
1files/Libraries.jar
windows11-21h2-x64
1files/Standalone.jar
windows10-2004-x64
1files/Standalone.jar
windows11-21h2-x64
1files/depe....dylib
macos-10.15-amd64
1files/depe....dylib
macos-10.15-amd64
1files/depe....dylib
macos-10.15-amd64
1files/depe...in/jar
macos-10.15-amd64
1files/depe...signer
macos-10.15-amd64
1files/depe...n/java
macos-10.15-amd64
1files/depe.../javac
macos-10.15-amd64
1files/depe...avadoc
macos-10.15-amd64
1files/depe.../javap
macos-10.15-amd64
1files/depe...n/jcmd
macos-10.15-amd64
1files/depe...onsole
macos-10.15-amd64
1files/depe...in/jdb
macos-10.15-amd64
1files/depe...prscan
macos-10.15-amd64
1files/depe.../jdeps
macos-10.15-amd64
1files/depe...in/jfr
macos-10.15-amd64
1files/depe.../jhsdb
macos-10.15-amd64
1files/depe...jimage
macos-10.15-amd64
1files/depe.../jinfo
macos-10.15-amd64
1files/depe.../jlink
macos-10.15-amd64
1files/depe...n/jmap
macos-10.15-amd64
1files/depe...n/jmod
macos-10.15-amd64
1files/depe...ackage
macos-10.15-amd64
1Analysis
- max time kernel
149s - max time network
169s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/05/2026, 17:17
Static task
static1
Behavioral task
behavioral1
Sample
Start For Window.cmd
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Start For Window.cmd
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
Start MacOS ARM.sh
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Start MacOS ARM.sh
Resource
win11-20250619-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
files/Launcher.jar
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
files/Launcher.jar
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
files/Libraries.jar
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
files/Libraries.jar
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
files/Standalone.jar
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
files/Standalone.jar
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
files/dependants/macos_arm/1.8.9-natives-mac/libjinput-osx.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral12
Sample
files/dependants/macos_arm/1.8.9-natives-mac/liblwjgl.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral13
Sample
files/dependants/macos_arm/1.8.9-natives-mac/openal.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral14
Sample
files/dependants/macos_arm/jdk-22/Contents/Home/bin/jar
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral15
Sample
files/dependants/macos_arm/jdk-22/Contents/Home/bin/jarsigner
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral16
Sample
files/dependants/macos_arm/jdk-22/Contents/Home/bin/java
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral17
Sample
files/dependants/macos_arm/jdk-22/Contents/Home/bin/javac
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral18
Sample
files/dependants/macos_arm/jdk-22/Contents/Home/bin/javadoc
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral19
Sample
files/dependants/macos_arm/jdk-22/Contents/Home/bin/javap
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral20
Sample
files/dependants/macos_arm/jdk-22/Contents/Home/bin/jcmd
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral21
Sample
files/dependants/macos_arm/jdk-22/Contents/Home/bin/jconsole
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral22
Sample
files/dependants/macos_arm/jdk-22/Contents/Home/bin/jdb
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral23
Sample
files/dependants/macos_arm/jdk-22/Contents/Home/bin/jdeprscan
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral24
Sample
files/dependants/macos_arm/jdk-22/Contents/Home/bin/jdeps
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral25
Sample
files/dependants/macos_arm/jdk-22/Contents/Home/bin/jfr
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral26
Sample
files/dependants/macos_arm/jdk-22/Contents/Home/bin/jhsdb
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral27
Sample
files/dependants/macos_arm/jdk-22/Contents/Home/bin/jimage
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral28
Sample
files/dependants/macos_arm/jdk-22/Contents/Home/bin/jinfo
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral29
Sample
files/dependants/macos_arm/jdk-22/Contents/Home/bin/jlink
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral30
Sample
files/dependants/macos_arm/jdk-22/Contents/Home/bin/jmap
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral31
Sample
files/dependants/macos_arm/jdk-22/Contents/Home/bin/jmod
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral32
Sample
files/dependants/macos_arm/jdk-22/Contents/Home/bin/jpackage
Resource
macos-20250619-en
macos-10.15-amd64
General
- Target Start For Window.cmd
- Size 346B
- Sample260508-vtrnwsbs91
- SHA256 b74bf321ec1061e969b297f86cfbc58a39f99fc39b23cc9326e7397c87bacc15
- MD5 1935cf410a4aebc6928fcb207057054c
- SHA1 18f0f563ef246af154da24b23fc67002a04cece2
- SHA512 df30cc474086dc3123a471a3c316e3a5bdcc08edf7a155c522932307b928a9b82fecf431a3c66beed561372b698fc4cbf97c89fb1e0d570c582e70cb2add0507
- TLSH T1ADE026087E11827CD0A5B8C9A67EE7F852CA251D4092532956CB9304700FE5F8381E71
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM32\symbols\dll\vcruntime140_1.amd64.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\UMPDC.pdb java.exe File opened for modification C:\Windows\SYSTEM32\Kernel.Appcore.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\Kernel.Appcore.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dbghelp.pdb java.exe File opened for modification C:\Windows\SYSTEM32\DLL\kernel32.pdb java.exe File opened for modification C:\Windows\SYSTEM32\vcruntime140.amd64.pdb java.exe File opened for modification C:\Windows\SYSTEM32\advapi32.pdb java.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\gdi32.pdb java.exe File opened for modification C:\Windows\SYSTEM32\powrprof.pdb java.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\winmm.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dbgcore.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\msvcrt.pdb java.exe File opened for modification C:\Windows\SYSTEM32\symbols\DLL\kernel32.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\user32.pdb java.exe File opened for modification C:\Windows\SYSTEM32\DLL\imm32.pdb java.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\powrprof.pdb java.exe File opened for modification C:\Windows\SYSTEM32\DLL\dbgcore.pdb java.exe File opened for modification C:\Windows\SYSTEM32\kernelbase.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\rpcrt4.pdb java.exe File opened for modification C:\Windows\SYSTEM32\winmm.pdb java.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\jimage.dll.pdb java.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\advapi32.pdb java.exe File opened for modification C:\Windows\SYSTEM32\msvcp_win.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\vcruntime140_1.amd64.pdb java.exe File opened for modification C:\Windows\SYSTEM32\msvcp140.amd64.pdb java.exe File opened for modification C:\Windows\SYSTEM32\ws2_32.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\ws2_32.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\jimage.dll.pdb java.exe File opened for modification C:\Windows\SYSTEM32\DLL\dbghelp.pdb java.exe File opened for modification C:\Windows\SYSTEM32\exe\java.exe.pdb java.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\vcruntime140.amd64.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\advapi32.pdb java.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\sechost.pdb java.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\user32.pdb java.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\jvm.dll.pdb java.exe File opened for modification C:\Windows\SYSTEM32\symbols\DLL\dbgcore.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\ntdll.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\vcruntime140.amd64.pdb java.exe File opened for modification C:\Windows\SYSTEM32\msvcrt.pdb java.exe File opened for modification C:\Windows\SYSTEM32\gdi32.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\gdi32full.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\powrprof.pdb java.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\bcryptprimitives.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\sechost.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\win32u.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\comctl32.pdb java.exe File opened for modification C:\Windows\SYSTEM32\jvm.dll.pdb java.exe File opened for modification C:\Windows\SYSTEM32\jimage.dll.pdb java.exe File opened for modification C:\Windows\SYSTEM32\ntdll.pdb java.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\gdi32.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\jvm.dll.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\kernelbase.pdb java.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\kernelbase.pdb java.exe File opened for modification C:\Windows\SYSTEM32\imm32.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\msvcp140.amd64.pdb java.exe File opened for modification C:\Windows\SYSTEM32\symbols\DLL\dbghelp.pdb java.exe File opened for modification C:\Windows\SYSTEM32\dll\jli.dll.pdb java.exe File opened for modification C:\Windows\SYSTEM32\win32u.pdb java.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\comctl32.pdb java.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\gdi32full.pdb java.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\ws2_32.pdb java.exe File opened for modification C:\Windows\SYSTEM32\jli.dll.pdb java.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\comctl32.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\gdi32.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\winmm.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\UMPDC.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\jimage.dll.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\ucrtbase.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\ucrtbase.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\jli.dll.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\msvcp140.amd64.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\DLL\dbgcore.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\DLL\dbgcore.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\rpcrt4.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\rpcrt4.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\gdi32.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\msvcp_win.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\version.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\jvm.dll.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\gdi32full.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\imm32.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\jvm.dll.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\ws2_32.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\jli.dll.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\win32u.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\win32u.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\msvcp140.amd64.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dbghelp.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\vcruntime140.amd64.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\user32.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\ws2_32.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\jimage.dll.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\java.exe.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\kernel32.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\ucrtbase.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\sechost.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\msvcp140.amd64.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\powrprof.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\Kernel.Appcore.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\DLL\kernel32.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\kernelbase.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\sechost.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\win32u.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\gdi32.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\DLL\dbghelp.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\vcruntime140.amd64.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\advapi32.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\powrprof.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\powrprof.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\Kernel.Appcore.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\bcryptprimitives.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\exe\java.exe.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\kernelbase.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\vcruntime140.amd64.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\ntdll.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\msvcrt.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\rpcrt4.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\user32.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\user32.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\bcryptprimitives.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\gdi32full.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\vcruntime140_1.amd64.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\vcruntime140_1.amd64.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\winmm.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\UMPDC.pdb java.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dbgcore.pdb java.exe - Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString java.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 java.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision java.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 java.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision java.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4596 wrote to memory of 4280 4596 cmd.exe 84 PID 4596 wrote to memory of 4560 4596 cmd.exe 86
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Start For Window.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\files\dependants\windows\jdk-22\bin\java.exedependants\windows\jdk-22\bin\java.exe -jar Launcher.jar2⤵
- Checks processor information in registry
PID:4280
-
-
C:\Users\Admin\AppData\Local\Temp\files\dependants\windows\jdk-22\bin\java.exe..\files\dependants\windows\jdk-22\bin\java.exe -noverify -Xms4096m -XX:+DisableAttachMechanism -Xmx4g -Djava.library.path=..\files\dependants\windows\1.8.9-natives -cp "..\files\Standalone.jar;..\files\Libraries.jar;lwjgl.jar;lwjgl_util.jar" Start2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
PID:4560
-