a0e822e1b1303ce0570ce3c015e4236c8a80c946bf374e9c81eca8d604d95ded

Analysis

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 13:11

Target
Jenny-mod-1.21.1-main/build_errors.txt
Size 9KB
Sample260606-qe7pcafs21
SHA256 a0e822e1b1303ce0570ce3c015e4236c8a80c946bf374e9c81eca8d604d95ded
MD5 7e654f776c08e06b51b6a768c3a878a5
SHA1 c8d812264cd591c1ab78073e2e99f9c98f63fe01
SHA512 e2048a01c9f4c2c6a259669799a2959f900250dc7178136d09c5d2e0f267c7e523ccafff51a5279e6b8af5c6a922698df178b2292fdc8e471a8c908d156c9870
SSDEEP 96:DozHBRkYPxSnoJ+DkYwxSnXJgm1FJY11/0+ykY8VXLJN5TKtLqtta1/Toc1+eLZX:EzHBB5QQ5et+tUiNWiqFP
TLSH
T164128C5267FA4248F3F75B596DFB50644E3BBC926879D64C018D540E0BB3E908DA0BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 992	3084	cmd.exe	82

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Jenny-mod-1.21.1-main\build_errors.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Jenny-mod-1.21.1-main\build_errors.txt
  2⤵
  PID:992

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact