Analysis
- user interaction
yes - max time kernel
599s - max time network
554s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/07/2026, 23:43
General
- Target SkyblockDupeMod_1.4.jar
- Size 4.3MB
- Sample260716-3qvkdaf15r
- SHA256 a2273fda78c2c37e1ba7bee1339d996384c0457ae5d8985f8a9c1c44c89a64f8
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 35 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 40 IoCs
- Suspicious use of FindShellTrayWindow 53 IoCs
- Suspicious use of SendNotifyMessage 39 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\SkyblockDupeMod_1.4.jar1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
memory/3256-151-0x0000020D80000000-0x0000020D80100000-memory.dmp
memory/3256-197-0x0000020D94010000-0x0000020D94030000-memory.dmp
memory/3256-176-0x0000020D83A90000-0x0000020D83AB0000-memory.dmp
memory/3256-162-0x0000020D83840000-0x0000020D83860000-memory.dmp
memory/3256-164-0x0000020D93C90000-0x0000020D93D90000-memory.dmp
memory/3556-320-0x000000000D8A0000-0x000000000E11B000-memory.dmp
memory/4224-81-0x0000028A43310000-0x0000028A43320000-memory.dmp
memory/4224-88-0x0000028A433D0000-0x0000028A433E0000-memory.dmp
memory/4224-23-0x0000028A432A0000-0x0000028A432B0000-memory.dmp
memory/4224-25-0x0000028A432B0000-0x0000028A432C0000-memory.dmp
memory/4224-31-0x0000028A432D0000-0x0000028A432E0000-memory.dmp
memory/4224-30-0x0000028A432C0000-0x0000028A432D0000-memory.dmp
memory/4224-34-0x0000028A432E0000-0x0000028A432F0000-memory.dmp
memory/4224-36-0x0000028A432F0000-0x0000028A43300000-memory.dmp
memory/4224-39-0x0000028A43020000-0x0000028A43290000-memory.dmp
memory/4224-40-0x0000028A43300000-0x0000028A43310000-memory.dmp
memory/4224-45-0x0000028A43310000-0x0000028A43320000-memory.dmp
memory/4224-49-0x0000028A43320000-0x0000028A43330000-memory.dmp
memory/4224-51-0x0000028A43290000-0x0000028A432A0000-memory.dmp
memory/4224-52-0x0000028A43330000-0x0000028A43340000-memory.dmp
memory/4224-55-0x0000028A432A0000-0x0000028A432B0000-memory.dmp
memory/4224-56-0x0000028A43340000-0x0000028A43350000-memory.dmp
memory/4224-59-0x0000028A43350000-0x0000028A43360000-memory.dmp
memory/4224-87-0x0000028A43330000-0x0000028A43340000-memory.dmp
memory/4224-60-0x0000028A41810000-0x0000028A41811000-memory.dmp
memory/4224-62-0x0000028A432C0000-0x0000028A432D0000-memory.dmp
memory/4224-64-0x0000028A43360000-0x0000028A43370000-memory.dmp
memory/4224-63-0x0000028A432D0000-0x0000028A432E0000-memory.dmp
memory/4224-66-0x0000028A43370000-0x0000028A43380000-memory.dmp
memory/4224-70-0x0000028A432E0000-0x0000028A432F0000-memory.dmp
memory/4224-71-0x0000028A43380000-0x0000028A43390000-memory.dmp
memory/4224-73-0x0000028A432F0000-0x0000028A43300000-memory.dmp
memory/4224-74-0x0000028A43390000-0x0000028A433A0000-memory.dmp
memory/4224-77-0x0000028A43300000-0x0000028A43310000-memory.dmp
memory/4224-78-0x0000028A433A0000-0x0000028A433B0000-memory.dmp
memory/4224-17-0x0000028A41810000-0x0000028A41811000-memory.dmp
memory/4224-82-0x0000028A433B0000-0x0000028A433C0000-memory.dmp
memory/4224-84-0x0000028A43320000-0x0000028A43330000-memory.dmp
memory/4224-21-0x0000028A43290000-0x0000028A432A0000-memory.dmp
memory/4224-85-0x0000028A433C0000-0x0000028A433D0000-memory.dmp
memory/4224-58-0x0000028A432B0000-0x0000028A432C0000-memory.dmp
memory/4224-91-0x0000028A43340000-0x0000028A43350000-memory.dmp
memory/4224-92-0x0000028A433E0000-0x0000028A433F0000-memory.dmp
memory/4224-94-0x0000028A43350000-0x0000028A43360000-memory.dmp
memory/4224-95-0x0000028A433F0000-0x0000028A43400000-memory.dmp
memory/4224-98-0x0000028A43360000-0x0000028A43370000-memory.dmp
memory/4224-99-0x0000028A43400000-0x0000028A43410000-memory.dmp
memory/4224-101-0x0000028A43370000-0x0000028A43380000-memory.dmp
memory/4224-102-0x0000028A43380000-0x0000028A43390000-memory.dmp
memory/4224-103-0x0000028A43390000-0x0000028A433A0000-memory.dmp
memory/4224-104-0x0000028A433A0000-0x0000028A433B0000-memory.dmp
memory/4224-105-0x0000028A433B0000-0x0000028A433C0000-memory.dmp
memory/4224-106-0x0000028A433C0000-0x0000028A433D0000-memory.dmp
memory/4224-107-0x0000028A433D0000-0x0000028A433E0000-memory.dmp
memory/4224-108-0x0000028A433E0000-0x0000028A433F0000-memory.dmp
memory/4224-109-0x0000028A433F0000-0x0000028A43400000-memory.dmp
memory/4224-110-0x0000028A43400000-0x0000028A43410000-memory.dmp
memory/4224-112-0x0000028A43410000-0x0000028A43420000-memory.dmp
memory/4224-118-0x0000028A41810000-0x0000028A41811000-memory.dmp
memory/4224-119-0x0000028A43020000-0x0000028A43290000-memory.dmp
memory/4224-120-0x0000028A432B0000-0x0000028A432C0000-memory.dmp
memory/4224-130-0x0000028A43410000-0x0000028A43420000-memory.dmp
memory/4224-129-0x0000028A43400000-0x0000028A43410000-memory.dmp
memory/4224-128-0x0000028A433F0000-0x0000028A43400000-memory.dmp
memory/4224-127-0x0000028A433E0000-0x0000028A433F0000-memory.dmp
memory/4224-126-0x0000028A43370000-0x0000028A43380000-memory.dmp
memory/4224-11-0x0000028A41810000-0x0000028A41811000-memory.dmp
memory/4224-2-0x0000028A43020000-0x0000028A43290000-memory.dmp
memory/4224-125-0x0000028A43350000-0x0000028A43360000-memory.dmp
memory/4224-121-0x0000028A432D0000-0x0000028A432E0000-memory.dmp
memory/4224-124-0x0000028A43340000-0x0000028A43350000-memory.dmp
memory/4224-123-0x0000028A43310000-0x0000028A43320000-memory.dmp
memory/4224-122-0x0000028A43300000-0x0000028A43310000-memory.dmp