Overview

overview

3

Static

static

3

[CS] Augme....6.jar

windows10-2004-x64

1

[CS] Augme....6.jar

windows11-ltsc_2024-x64

1

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/07/2026, 03:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    [CS] Augmentations-1.0.6.6.jar
  • Size 1.4MB
  • Sample260703-eb24xaa18s
  • SHA256 3ee6eb5110af61b89b4b2fab069ae667c63b38e5d14c4990af93579c6fad33ab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: LoadsDriver 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar "C:\Users\Admin\AppData\Local\Temp\[CS] Augmentations-1.0.6.6.jar"
    1⤵
      PID:3228
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
      1⤵
        PID:2352
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004BC
        1⤵
          PID:3948
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
          1⤵
            PID:1396
          • C:\Windows\System32\ShellHost.exe
            "C:\Windows\System32\ShellHost.exe"
            1⤵
            • Checks SCSI registry key(s)
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            PID:2700
          • C:\Windows\System32\ShellHost.exe
            "C:\Windows\System32\ShellHost.exe"
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:4916

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                memory/3228-2-0x0000024B80000000-0x0000024B80270000-memory.dmp
                Download

                memory/3228-11-0x0000024BF81A0000-0x0000024BF81A1000-memory.dmp
                Download

                memory/3228-12-0x0000024B80000000-0x0000024B80270000-memory.dmp
                Download