Analysis
- max time kernel
136s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-es - resource tags
- submitted
22/06/2026, 14:33
General
- Target INSTALLER.jar
- Size 110KB
- Sample260622-rw3bmac14m
- SHA256 8397eec8d487a0df6d93489da5f2caab859dc68463545863ede3a8d35ba0de3e
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 2 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Kills process with taskkill 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 7 IoCs
- Modifies registry class 6 IoCs
- Modifies registry key 1 TTPs 2 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\INSTALLER.jar1⤵
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\vault_locked_icon.ico"2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "reg add HKCU\Software\Classes\.LOCKED /ve /d VaultBuilderLockedFile /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add HKCU\Software\Classes\.LOCKED /ve /d VaultBuilderLockedFile /f3⤵
- Modifies registry class
- Modifies registry key
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "reg add HKCU\Software\Classes\VaultBuilderLockedFile\DefaultIcon /ve /d "C:\Users\Admin\AppData\Local\Temp\vault_locked_icon.ico" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add HKCU\Software\Classes\VaultBuilderLockedFile\DefaultIcon /ve /d "C:\Users\Admin\AppData\Local\Temp\vault_locked_icon.ico" /f3⤵
- Modifies registry class
- Modifies registry key
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "ie4uinit.exe -show"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ie4uinit.exeie4uinit.exe -show3⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies Internet Explorer settings
- Modifies registry class
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c start /b "" "C:\Users\Admin\AppData\Local\Temp\melt_cleaner.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\melt_cleaner.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM javaw.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM java.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 24⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
melt_cleaner.bat
vault_locked_icon.ico
memory/6052-2-0x0000026506D00000-0x0000026506F70000-memory.dmp
memory/6052-14-0x0000026505430000-0x0000026505431000-memory.dmp
memory/6052-16-0x0000026506F70000-0x0000026506F80000-memory.dmp
memory/6052-18-0x0000026506F80000-0x0000026506F90000-memory.dmp
memory/6052-20-0x0000026506F90000-0x0000026506FA0000-memory.dmp
memory/6052-22-0x0000026506FA0000-0x0000026506FB0000-memory.dmp
memory/6052-26-0x0000026506FB0000-0x0000026506FC0000-memory.dmp
memory/6052-29-0x0000026506FC0000-0x0000026506FD0000-memory.dmp
memory/6052-42-0x0000026506FD0000-0x0000026506FE0000-memory.dmp
memory/6052-44-0x0000026506FE0000-0x0000026506FF0000-memory.dmp
memory/6052-49-0x0000026507000000-0x0000026507010000-memory.dmp
memory/6052-48-0x0000026506FF0000-0x0000026507000000-memory.dmp
memory/6052-52-0x0000026507010000-0x0000026507020000-memory.dmp
memory/6052-51-0x0000026506F70000-0x0000026506F80000-memory.dmp
memory/6052-47-0x0000026506D00000-0x0000026506F70000-memory.dmp
memory/6052-55-0x0000026507020000-0x0000026507030000-memory.dmp
memory/6052-54-0x0000026506F80000-0x0000026506F90000-memory.dmp
memory/6052-61-0x0000026506FA0000-0x0000026506FB0000-memory.dmp
memory/6052-60-0x0000026507040000-0x0000026507050000-memory.dmp
memory/6052-59-0x0000026507030000-0x0000026507040000-memory.dmp
memory/6052-58-0x0000026506F90000-0x0000026506FA0000-memory.dmp
memory/6052-64-0x0000026507050000-0x0000026507060000-memory.dmp
memory/6052-63-0x0000026506FB0000-0x0000026506FC0000-memory.dmp
memory/6052-66-0x0000026506FC0000-0x0000026506FD0000-memory.dmp
memory/6052-67-0x0000026507060000-0x0000026507070000-memory.dmp
memory/6052-69-0x0000026505430000-0x0000026505431000-memory.dmp
memory/6052-71-0x0000026506FD0000-0x0000026506FE0000-memory.dmp
memory/6052-72-0x0000026507070000-0x0000026507080000-memory.dmp
memory/6052-76-0x0000026507080000-0x0000026507090000-memory.dmp
memory/6052-75-0x0000026506FE0000-0x0000026506FF0000-memory.dmp
memory/6052-79-0x0000026507090000-0x00000265070A0000-memory.dmp
memory/6052-78-0x0000026506FF0000-0x0000026507000000-memory.dmp
memory/6052-82-0x00000265070A0000-0x00000265070B0000-memory.dmp
memory/6052-81-0x0000026507000000-0x0000026507010000-memory.dmp
memory/6052-86-0x00000265070B0000-0x00000265070C0000-memory.dmp
memory/6052-85-0x0000026507010000-0x0000026507020000-memory.dmp
memory/6052-88-0x00000265070C0000-0x00000265070D0000-memory.dmp
memory/6052-87-0x0000026507020000-0x0000026507030000-memory.dmp
memory/6052-90-0x0000026507030000-0x0000026507040000-memory.dmp
memory/6052-92-0x00000265070D0000-0x00000265070E0000-memory.dmp
memory/6052-91-0x0000026507040000-0x0000026507050000-memory.dmp
memory/6052-95-0x0000026505430000-0x0000026505431000-memory.dmp
memory/6052-103-0x0000026507060000-0x0000026507070000-memory.dmp
memory/6052-102-0x00000265070F0000-0x0000026507100000-memory.dmp
memory/6052-100-0x0000026507050000-0x0000026507060000-memory.dmp
memory/6052-101-0x00000265070E0000-0x00000265070F0000-memory.dmp
memory/6052-105-0x0000026507070000-0x0000026507080000-memory.dmp
memory/6052-107-0x0000026507100000-0x0000026507110000-memory.dmp
memory/6052-111-0x0000026505430000-0x0000026505431000-memory.dmp
memory/6052-114-0x0000026505430000-0x0000026505431000-memory.dmp
memory/6052-119-0x0000026506FA0000-0x0000026506FB0000-memory.dmp
memory/6052-124-0x0000026506FF0000-0x0000026507000000-memory.dmp
memory/6052-123-0x0000026506FE0000-0x0000026506FF0000-memory.dmp
memory/6052-122-0x0000026506FD0000-0x0000026506FE0000-memory.dmp
memory/6052-121-0x0000026506FC0000-0x0000026506FD0000-memory.dmp
memory/6052-120-0x0000026506FB0000-0x0000026506FC0000-memory.dmp
memory/6052-118-0x0000026506F90000-0x0000026506FA0000-memory.dmp
memory/6052-117-0x0000026506F80000-0x0000026506F90000-memory.dmp
memory/6052-116-0x0000026506F70000-0x0000026506F80000-memory.dmp
memory/6052-115-0x0000026507000000-0x0000026507010000-memory.dmp
memory/6052-129-0x0000026507040000-0x0000026507050000-memory.dmp
memory/6052-140-0x0000026507100000-0x0000026507110000-memory.dmp
memory/6052-139-0x00000265070F0000-0x0000026507100000-memory.dmp
memory/6052-138-0x00000265070E0000-0x00000265070F0000-memory.dmp
memory/6052-137-0x00000265070D0000-0x00000265070E0000-memory.dmp
memory/6052-136-0x00000265070C0000-0x00000265070D0000-memory.dmp
memory/6052-135-0x00000265070B0000-0x00000265070C0000-memory.dmp
memory/6052-134-0x00000265070A0000-0x00000265070B0000-memory.dmp
memory/6052-133-0x0000026507090000-0x00000265070A0000-memory.dmp
memory/6052-132-0x0000026507080000-0x0000026507090000-memory.dmp
memory/6052-131-0x0000026507070000-0x0000026507080000-memory.dmp
memory/6052-130-0x0000026507050000-0x0000026507060000-memory.dmp
memory/6052-128-0x0000026507030000-0x0000026507040000-memory.dmp
memory/6052-127-0x0000026507020000-0x0000026507030000-memory.dmp
memory/6052-126-0x0000026506D00000-0x0000026506F70000-memory.dmp