Analysis
- user interaction
yes - max time kernel
76s - max time network
35s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 15:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VortexAddonV8CRACKEDBYRAIN.jar
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
VortexAddonV8CRACKEDBYRAIN.jar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target VortexAddonV8CRACKEDBYRAIN.jar
- Size 97KB
- Sample260806-s8223avdpd
- SHA256 c3c9dd13737458dccd445fb3b607ce58f92e416aae46adf6a8f550899571a2a9
- MD5 0ac64518a069e71f53c6deca89dd9549
- SHA1 bdd687a76445dc32c43effc524cba880f4bd8629
- SHA512 e6ca8d46cd8e566e45e8d5314e8e4226c0bc6f2ce1772922ab8c0a3550cb92fd98b024eae366eeff9ecd631ab68601f4e9fdeec681b70731c22fffe400c1f72b
- SSDEEP 1536:lZpED8n1pOpjlxfRoVEsHrWVdWF/DAQD4wEcBjy92/aZ06MVzCgidkYDl8a6Gt2:ar1lx5oVEcGd61DZ29CaO6k5OtC5Gt2
- TLSH T10BA3F1213FBDC02EE5D354FDFD87C361A97395A4D08E980228B8A7A51C1392A1F4A75F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 800 taskmgr.exe Token: SeSystemProfilePrivilege 800 taskmgr.exe Token: SeCreateGlobalPrivilege 800 taskmgr.exe Token: 33 800 taskmgr.exe Token: SeIncBasePriorityPrivilege 800 taskmgr.exe - Suspicious use of FindShellTrayWindow 55 IoCs
pid Process 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe - Suspicious use of SendNotifyMessage 55 IoCs
pid Process 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe 800 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 800 taskmgr.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\VortexAddonV8CRACKEDBYRAIN.jar1⤵PID:2948
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:2104
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:800
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3244