Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
26/07/2026, 12:25
General
- Target account_generator.jar
- Size 332KB
- Sample260726-plv4fsed72
- SHA256 25479e373145444be733bd8aeb9aec353705347e7469d02e940336b338cc0cb5
Malware Config
Signatures
- Drops startup file 2 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Modifies registry key 1 TTPs 2 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Views/modifies file attributes 1 TTPs 4 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\account_generator.jar1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\REG.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "account_generator.jar" /d "C:\Users\Admin\AppData\Roaming\account_generator.jar" /f2⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\account_generator.jar2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\account_generator.jar2⤵
- Views/modifies file attributes
-
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\account_generator.jar"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\REG.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "account_generator.jar" /d "C:\Users\Admin\AppData\Roaming\account_generator.jar" /f2⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\account_generator.jar2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\account_generator.jar2⤵
- Views/modifies file attributes
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
JNativeHook-7432773EB4D09DC286D43FCC77DDB0E1E3BCE2B4.dll
83aa4cc77f591dfc2374580bbd95f6ba_d5e54a0f-d754-47a7-8a66-1e2f67368c3c
memory/3328-69-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/3328-61-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/3328-79-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/3328-36-0x000001D2D2250000-0x000001D2D2251000-memory.dmp
memory/3328-40-0x000001D2D2250000-0x000001D2D2251000-memory.dmp
memory/3328-75-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/3328-48-0x000001D2D2250000-0x000001D2D2251000-memory.dmp
memory/3328-73-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/3328-71-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/3328-52-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/3328-53-0x000001D2D3CA0000-0x000001D2D3F10000-memory.dmp
memory/3328-59-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/3328-55-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/3328-65-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/3328-25-0x000001D2D3CA0000-0x000001D2D3F10000-memory.dmp
memory/3328-67-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/6116-50-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/6116-78-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/6116-58-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/6116-66-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/6116-60-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/6116-70-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/6116-72-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/6116-51-0x00000162920B0000-0x0000016292320000-memory.dmp
memory/6116-64-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/6116-54-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/6116-11-0x0000016290810000-0x0000016290811000-memory.dmp
memory/6116-76-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/6116-2-0x00000162920B0000-0x0000016292320000-memory.dmp
memory/6116-15-0x0000016290810000-0x0000016290811000-memory.dmp