842fb523b72866a97a9b299e7e4c23dd72fd63f7ea827c770c1151eb021f448b

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JAVA/jre-8u202-windows-i586.exe
Size 65.7MB
Sample260729-k2faqafd53
SHA256 842fb523b72866a97a9b299e7e4c23dd72fd63f7ea827c770c1151eb021f448b
MD5 7602a766f45af60272b6c6eb6231b4f3
SHA1 14efd8251f6899a901a36a69a73d2ca040c8c507
SHA512 3a2f9857021d8425ca6eb65cdbb7a63e58acbff40ff649482ae21135752511a7049362557f9f295442657ed430e1c754c14702e9e5e5d1872e8a777fe9ec8649
SSDEEP 1572864:fYrX1AKcOHOuGk27/yHQKcgqar6AX6rZHTZIJX4Gq8daBi:CX1AIOu07awLgqar/XQZzA4GqoaBi
TLSH
T16CE7331A7AD4C032D5B7963199AD933855B5BCB18932805B73DDB30D4FB02928F31BBA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1104	jre-8u202-windows-i586.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jre-8u202-windows-i586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jre-8u202-windows-i586.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1104	jre-8u202-windows-i586.exe
1104	jre-8u202-windows-i586.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1104	3068	jre-8u202-windows-i586.exe	89

C:\Users\Admin\AppData\Local\Temp\JAVA\jre-8u202-windows-i586.exe
"C:\Users\Admin\AppData\Local\Temp\JAVA\jre-8u202-windows-i586.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\jds240730093.tmp\jre-8u202-windows-i586.exe
  "C:\Users\Admin\AppData\Local\Temp\jds240730093.tmp\jre-8u202-windows-i586.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 2936dd919f3e2bd7d0e14fc95994fe043cdebf37e4a1f631e8fb9c0b0a45535a
MD5 01d91ed5542bd069d6d8f08abef9bc54
SHA1 ffa6ab219da85c0bf03c49797f2f5658304ac071
SHA512 e9dbd1f184f7fa43a3406a161a3434d407e0ffdc426bcd57012d58a59e1a7454b619a402cec9ce7366ab155c8b8048a2d5a7eb660c2f74b0d4a8d9d28a217faf
SSDEEP 3072:YsCVL+3m+PvFz6AZEfeTdmo9Alec55oTg2MzRYYCtDlefHeAPRCRw:Zz6AZEfeTdJxcj
TLSH
T17DF32186852E44FB34138B8783BA6C7445A6255F53AD891C22CFC6EF76458038F6F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download