Analysis
- user interaction
yes - max time kernel
12s - max time network
14s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 22:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jar_mods_injector.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
600 seconds
Behavioral task
behavioral2
Sample
jar_mods_injector.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
600 seconds
General
- Target jar_mods_injector.exe
- Size 5.4MB
- Sample260803-2cfcvs1zfs
- SHA256 0d577d29185c72eec169ea4c0cd171f07815b06d01926ff7de1a3bb896f5bbb5
- MD5 4dd6bef74876037046ee8c40a0338bef
- SHA1 1dff6dc4065918a4d55249109cca9ee8cf112725
- SHA512 26bbeec274f376d90a29fb53ac606e673e0db8ac7a3351e3d6bc4cc22b9c89fb31699a5173e4a8f2ed0ced8bee1b62fac44ed4d790433d84b6169e40e54edc76
- SSDEEP 49152:MlZi8lgDOQVi+6+FWcrlMrby+EIY1hYi/Cq2smDK/eBv1JwbiBOavpwJQb3kO4XS:N7/f/MmKAbiIaeJYY7Jpbt1It
- TLSH T1C9468D03B74A9AADC01BC474834686735A76B4CB0B35A9FF55C859383F6AAF04F38359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService reg.exe - Looks for VMWare services registry key. 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools reg.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 2524 tasklist.exe - Modifies registry key 1 TTPs 11 IoCs
pid Process 4308 reg.exe 4156 reg.exe 6020 reg.exe 1200 reg.exe 2324 reg.exe 1896 reg.exe 828 reg.exe 3256 reg.exe 5136 reg.exe 4924 reg.exe 3572 reg.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4600 wmic.exe 4600 wmic.exe 4600 wmic.exe 4600 wmic.exe 1620 wmic.exe 1620 wmic.exe 1620 wmic.exe 1620 wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2524 tasklist.exe Token: SeIncreaseQuotaPrivilege 4600 wmic.exe Token: SeSecurityPrivilege 4600 wmic.exe Token: SeTakeOwnershipPrivilege 4600 wmic.exe Token: SeLoadDriverPrivilege 4600 wmic.exe Token: SeSystemProfilePrivilege 4600 wmic.exe Token: SeSystemtimePrivilege 4600 wmic.exe Token: SeProfSingleProcessPrivilege 4600 wmic.exe Token: SeIncBasePriorityPrivilege 4600 wmic.exe Token: SeCreatePagefilePrivilege 4600 wmic.exe Token: SeBackupPrivilege 4600 wmic.exe Token: SeRestorePrivilege 4600 wmic.exe Token: SeShutdownPrivilege 4600 wmic.exe Token: SeDebugPrivilege 4600 wmic.exe Token: SeSystemEnvironmentPrivilege 4600 wmic.exe Token: SeRemoteShutdownPrivilege 4600 wmic.exe Token: SeUndockPrivilege 4600 wmic.exe Token: SeManageVolumePrivilege 4600 wmic.exe Token: 33 4600 wmic.exe Token: 34 4600 wmic.exe Token: 35 4600 wmic.exe Token: 36 4600 wmic.exe Token: SeIncreaseQuotaPrivilege 4600 wmic.exe Token: SeSecurityPrivilege 4600 wmic.exe Token: SeTakeOwnershipPrivilege 4600 wmic.exe Token: SeLoadDriverPrivilege 4600 wmic.exe Token: SeSystemProfilePrivilege 4600 wmic.exe Token: SeSystemtimePrivilege 4600 wmic.exe Token: SeProfSingleProcessPrivilege 4600 wmic.exe Token: SeIncBasePriorityPrivilege 4600 wmic.exe Token: SeCreatePagefilePrivilege 4600 wmic.exe Token: SeBackupPrivilege 4600 wmic.exe Token: SeRestorePrivilege 4600 wmic.exe Token: SeShutdownPrivilege 4600 wmic.exe Token: SeDebugPrivilege 4600 wmic.exe Token: SeSystemEnvironmentPrivilege 4600 wmic.exe Token: SeRemoteShutdownPrivilege 4600 wmic.exe Token: SeUndockPrivilege 4600 wmic.exe Token: SeManageVolumePrivilege 4600 wmic.exe Token: 33 4600 wmic.exe Token: 34 4600 wmic.exe Token: 35 4600 wmic.exe Token: 36 4600 wmic.exe Token: SeIncreaseQuotaPrivilege 1620 wmic.exe Token: SeSecurityPrivilege 1620 wmic.exe Token: SeTakeOwnershipPrivilege 1620 wmic.exe Token: SeLoadDriverPrivilege 1620 wmic.exe Token: SeSystemProfilePrivilege 1620 wmic.exe Token: SeSystemtimePrivilege 1620 wmic.exe Token: SeProfSingleProcessPrivilege 1620 wmic.exe Token: SeIncBasePriorityPrivilege 1620 wmic.exe Token: SeCreatePagefilePrivilege 1620 wmic.exe Token: SeBackupPrivilege 1620 wmic.exe Token: SeRestorePrivilege 1620 wmic.exe Token: SeShutdownPrivilege 1620 wmic.exe Token: SeDebugPrivilege 1620 wmic.exe Token: SeSystemEnvironmentPrivilege 1620 wmic.exe Token: SeRemoteShutdownPrivilege 1620 wmic.exe Token: SeUndockPrivilege 1620 wmic.exe Token: SeManageVolumePrivilege 1620 wmic.exe Token: 33 1620 wmic.exe Token: 34 1620 wmic.exe Token: 35 1620 wmic.exe Token: 36 1620 wmic.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1152 jar_mods_injector.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1152 wrote to memory of 4156 1152 jar_mods_injector.exe 88 PID 1152 wrote to memory of 5136 1152 jar_mods_injector.exe 90 PID 1152 wrote to memory of 6020 1152 jar_mods_injector.exe 91 PID 1152 wrote to memory of 1200 1152 jar_mods_injector.exe 92 PID 1152 wrote to memory of 4924 1152 jar_mods_injector.exe 93 PID 1152 wrote to memory of 2324 1152 jar_mods_injector.exe 94 PID 1152 wrote to memory of 1896 1152 jar_mods_injector.exe 95 PID 1152 wrote to memory of 828 1152 jar_mods_injector.exe 96 PID 1152 wrote to memory of 3572 1152 jar_mods_injector.exe 97 PID 1152 wrote to memory of 3256 1152 jar_mods_injector.exe 98 PID 1152 wrote to memory of 4308 1152 jar_mods_injector.exe 99 PID 1152 wrote to memory of 2524 1152 jar_mods_injector.exe 100 PID 1152 wrote to memory of 5700 1152 jar_mods_injector.exe 102 PID 1152 wrote to memory of 4600 1152 jar_mods_injector.exe 104 PID 1152 wrote to memory of 1620 1152 jar_mods_injector.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\jar_mods_injector.exe"C:\Users\Admin\AppData\Local\Temp\jar_mods_injector.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest2⤵
- Enumerates VirtualBox registry keys
- Modifies registry key
PID:4156
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\VBoxService2⤵
- Enumerates VirtualBox registry keys
- Modifies registry key
PID:5136
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs2⤵
- Modifies registry key
PID:6020
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\vmmouse2⤵
- Looks for VMWare services registry key.
- Modifies registry key
PID:1200
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\VMTools2⤵
- Looks for VMWare services registry key.
- Modifies registry key
PID:4924
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\Hyper-V2⤵
- Modifies registry key
PID:2324
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\KvmGuest2⤵
- Modifies registry key
PID:1896
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\QEMU2⤵
- Modifies registry key
PID:828
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\Xen2⤵
- Modifies registry key
PID:3572
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\Parallels2⤵
- Modifies registry key
PID:3256
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\CurrentControlSet\Services\VirtualBox2⤵
- Modifies registry key
PID:4308
-
-
C:\Windows\system32\tasklist.exe"tasklist"2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
C:\Windows\system32\getmac.exe"getmac"2⤵PID:5700
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get manufacturer2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4600
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" logicaldisk get name2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620
-