Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
22/06/2026, 14:36
General
- Target INSTALLER.jar
- Size 110KB
- Sample260622-ryznhsds2m
- SHA256 8397eec8d487a0df6d93489da5f2caab859dc68463545863ede3a8d35ba0de3e
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 4 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Kills process with taskkill 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 8 IoCs
- Modifies registry class 44 IoCs
- Modifies registry key 1 TTPs 2 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 52 IoCs
- Suspicious use of FindShellTrayWindow 53 IoCs
- Suspicious use of SendNotifyMessage 39 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\INSTALLER.jar1⤵
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\vault_locked_icon.ico"2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "reg add HKCU\Software\Classes\.LOCKED /ve /d VaultBuilderLockedFile /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add HKCU\Software\Classes\.LOCKED /ve /d VaultBuilderLockedFile /f3⤵
- Modifies registry class
- Modifies registry key
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "reg add HKCU\Software\Classes\VaultBuilderLockedFile\DefaultIcon /ve /d "C:\Users\Admin\AppData\Local\Temp\vault_locked_icon.ico" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add HKCU\Software\Classes\VaultBuilderLockedFile\DefaultIcon /ve /d "C:\Users\Admin\AppData\Local\Temp\vault_locked_icon.ico" /f3⤵
- Modifies registry class
- Modifies registry key
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "ie4uinit.exe -show"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ie4uinit.exeie4uinit.exe -show3⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies Internet Explorer settings
- Modifies registry class
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c start /b "" "C:\Users\Admin\AppData\Local\Temp\melt_cleaner.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\melt_cleaner.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM javaw.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM java.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 24⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
melt_cleaner.bat
vault_locked_icon.ico
desktop.ini
memory/2704-2-0x00000131928A0000-0x0000013192B10000-memory.dmp
memory/2704-11-0x00000131927F0000-0x00000131927F1000-memory.dmp
memory/2704-16-0x0000013192B10000-0x0000013192B20000-memory.dmp
memory/2704-18-0x0000013192B20000-0x0000013192B30000-memory.dmp
memory/2704-20-0x0000013192B30000-0x0000013192B40000-memory.dmp
memory/2704-23-0x0000013192B40000-0x0000013192B50000-memory.dmp
memory/2704-24-0x0000013192B50000-0x0000013192B60000-memory.dmp
memory/2704-28-0x0000013192B60000-0x0000013192B70000-memory.dmp
memory/2704-34-0x00000131927F0000-0x00000131927F1000-memory.dmp
memory/2704-39-0x0000013192B70000-0x0000013192B80000-memory.dmp
memory/2704-44-0x0000013192B80000-0x0000013192B90000-memory.dmp
memory/2704-49-0x0000013192BA0000-0x0000013192BB0000-memory.dmp
memory/2704-52-0x0000013192BB0000-0x0000013192BC0000-memory.dmp
memory/2704-48-0x0000013192B90000-0x0000013192BA0000-memory.dmp
memory/2704-51-0x0000013192B10000-0x0000013192B20000-memory.dmp
memory/2704-47-0x00000131928A0000-0x0000013192B10000-memory.dmp
memory/2704-54-0x0000013192B20000-0x0000013192B30000-memory.dmp
memory/2704-55-0x0000013192BC0000-0x0000013192BD0000-memory.dmp
memory/2704-63-0x0000013192B40000-0x0000013192B50000-memory.dmp
memory/2704-62-0x0000013192BF0000-0x0000013192C00000-memory.dmp
memory/2704-61-0x0000013192BE0000-0x0000013192BF0000-memory.dmp
memory/2704-60-0x0000013192BD0000-0x0000013192BE0000-memory.dmp
memory/2704-59-0x0000013192B30000-0x0000013192B40000-memory.dmp
memory/2704-65-0x0000013192B50000-0x0000013192B60000-memory.dmp
memory/2704-66-0x0000013192C00000-0x0000013192C10000-memory.dmp
memory/2704-68-0x0000013192B60000-0x0000013192B70000-memory.dmp
memory/2704-69-0x0000013192C10000-0x0000013192C20000-memory.dmp
memory/2704-70-0x00000131927F0000-0x00000131927F1000-memory.dmp
memory/2704-73-0x0000013192B70000-0x0000013192B80000-memory.dmp
memory/2704-74-0x0000013192C20000-0x0000013192C30000-memory.dmp
memory/2704-78-0x0000013192C30000-0x0000013192C40000-memory.dmp
memory/2704-77-0x0000013192B80000-0x0000013192B90000-memory.dmp
memory/2704-80-0x0000013192B90000-0x0000013192BA0000-memory.dmp
memory/2704-81-0x0000013192C40000-0x0000013192C50000-memory.dmp
memory/2704-83-0x0000013192BA0000-0x0000013192BB0000-memory.dmp
memory/2704-84-0x0000013192C50000-0x0000013192C60000-memory.dmp
memory/2704-88-0x0000013192C60000-0x0000013192C70000-memory.dmp
memory/2704-90-0x0000013192C70000-0x0000013192C80000-memory.dmp
memory/2704-89-0x0000013192BC0000-0x0000013192BD0000-memory.dmp
memory/2704-87-0x0000013192BB0000-0x0000013192BC0000-memory.dmp
memory/2704-93-0x0000013192BE0000-0x0000013192BF0000-memory.dmp
memory/2704-92-0x0000013192BD0000-0x0000013192BE0000-memory.dmp
memory/2704-95-0x0000013192C80000-0x0000013192C90000-memory.dmp
memory/2704-94-0x0000013192BF0000-0x0000013192C00000-memory.dmp
memory/2704-97-0x00000131927F0000-0x00000131927F1000-memory.dmp
memory/2704-100-0x00000131927F0000-0x00000131927F1000-memory.dmp
memory/2704-103-0x0000013192C90000-0x0000013192CA0000-memory.dmp
memory/2704-102-0x0000013192C00000-0x0000013192C10000-memory.dmp
memory/2704-105-0x0000013192CA0000-0x0000013192CB0000-memory.dmp
memory/2704-107-0x0000013192C10000-0x0000013192C20000-memory.dmp
memory/2704-108-0x0000013192C20000-0x0000013192C30000-memory.dmp
memory/2704-109-0x0000013192C30000-0x0000013192C40000-memory.dmp
memory/2704-110-0x0000013192C40000-0x0000013192C50000-memory.dmp
memory/2704-111-0x0000013192C50000-0x0000013192C60000-memory.dmp
memory/2704-112-0x0000013192C60000-0x0000013192C70000-memory.dmp
memory/2704-113-0x0000013192C70000-0x0000013192C80000-memory.dmp
memory/2704-114-0x0000013192C80000-0x0000013192C90000-memory.dmp
memory/2704-115-0x0000013192C90000-0x0000013192CA0000-memory.dmp
memory/2704-120-0x00000131927F0000-0x00000131927F1000-memory.dmp
memory/2704-141-0x0000013192CA0000-0x0000013192CB0000-memory.dmp
memory/2704-140-0x0000013192C90000-0x0000013192CA0000-memory.dmp
memory/2704-139-0x0000013192C80000-0x0000013192C90000-memory.dmp
memory/2704-138-0x0000013192C00000-0x0000013192C10000-memory.dmp
memory/2704-137-0x0000013192C50000-0x0000013192C60000-memory.dmp
memory/2704-136-0x0000013192C20000-0x0000013192C30000-memory.dmp
memory/2704-135-0x0000013192C10000-0x0000013192C20000-memory.dmp
memory/2704-134-0x0000013192BE0000-0x0000013192BF0000-memory.dmp
memory/2704-133-0x0000013192BC0000-0x0000013192BD0000-memory.dmp
memory/2704-132-0x0000013192BB0000-0x0000013192BC0000-memory.dmp
memory/2704-131-0x00000131928A0000-0x0000013192B10000-memory.dmp
memory/2704-130-0x0000013192B90000-0x0000013192BA0000-memory.dmp
memory/2704-129-0x0000013192B80000-0x0000013192B90000-memory.dmp
memory/2704-128-0x0000013192B70000-0x0000013192B80000-memory.dmp
memory/2704-127-0x0000013192B60000-0x0000013192B70000-memory.dmp
memory/2704-126-0x0000013192B50000-0x0000013192B60000-memory.dmp
memory/2704-125-0x0000013192B40000-0x0000013192B50000-memory.dmp
memory/2704-123-0x0000013192B20000-0x0000013192B30000-memory.dmp
memory/2704-121-0x0000013192BA0000-0x0000013192BB0000-memory.dmp
memory/2704-124-0x0000013192B30000-0x0000013192B40000-memory.dmp
memory/2704-122-0x0000013192B10000-0x0000013192B20000-memory.dmp
memory/3804-163-0x0000022503A30000-0x0000022503A50000-memory.dmp
memory/3804-178-0x0000022503E10000-0x0000022503E30000-memory.dmp
memory/3804-165-0x0000022513E90000-0x0000022513F90000-memory.dmp
memory/3804-196-0x0000022514250000-0x0000022514270000-memory.dmp
memory/3804-150-0x00000225001E0000-0x00000225002E0000-memory.dmp
memory/4952-337-0x000000000DF60000-0x000000000E7DB000-memory.dmp